Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2023, 01:10

General

  • Target

    https://github.com/Matelpro777/MEMZ-4.0-pannel/raw/master/MEMZ-Clean.exe

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Matelpro777/MEMZ-4.0-pannel/raw/master/MEMZ-Clean.exe
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4544
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffcaef746f8,0x7ffcaef74708,0x7ffcaef74718
      2⤵
        PID:2020
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:1560
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2368
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 /prefetch:8
          2⤵
            PID:1776
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
            2⤵
              PID:1864
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
              2⤵
                PID:3336
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
                2⤵
                  PID:4060
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
                  2⤵
                    PID:1376
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                    2⤵
                      PID:2780
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
                      2⤵
                        PID:5036
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
                        2⤵
                          PID:3356
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                          2⤵
                          • Drops file in Program Files directory
                          PID:1632
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7a9665460,0x7ff7a9665470,0x7ff7a9665480
                            3⤵
                              PID:716
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:772
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
                            2⤵
                              PID:4944
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                              2⤵
                                PID:4720
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                                2⤵
                                  PID:4848
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
                                  2⤵
                                    PID:2984
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
                                    2⤵
                                      PID:2548
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
                                      2⤵
                                        PID:5460
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
                                        2⤵
                                          PID:5452
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6164 /prefetch:8
                                          2⤵
                                            PID:5788
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
                                            2⤵
                                              PID:5832
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5904
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6436 /prefetch:8
                                              2⤵
                                                PID:6116
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
                                                2⤵
                                                  PID:6128
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
                                                  2⤵
                                                    PID:4480
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3444 /prefetch:2
                                                    2⤵
                                                      PID:3976
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:1436
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:5268
                                                      • C:\Windows\System32\rundll32.exe
                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                        1⤵
                                                          PID:5568
                                                        • C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
                                                          "C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
                                                          1⤵
                                                            PID:4924
                                                          • C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
                                                            "C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
                                                            1⤵
                                                              PID:5760
                                                            • C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
                                                              "C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
                                                              1⤵
                                                                PID:5784
                                                              • C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
                                                                "C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
                                                                1⤵
                                                                  PID:5808
                                                                • C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
                                                                  "C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
                                                                  1⤵
                                                                    PID:3816

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v6

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    5a10efe23009825eadc90c37a38d9401

                                                                    SHA1

                                                                    fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

                                                                    SHA256

                                                                    05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

                                                                    SHA512

                                                                    89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    c1a3c45dc07f766430f7feaa3000fb18

                                                                    SHA1

                                                                    698a0485bcf0ab2a9283d4ebd31ade980b0661d1

                                                                    SHA256

                                                                    adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

                                                                    SHA512

                                                                    9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    48B

                                                                    MD5

                                                                    425b7f5046ba8e407ea3cbe5db0b45df

                                                                    SHA1

                                                                    becb346f5fd7593d9db066b3eb2ef35016aaae4b

                                                                    SHA256

                                                                    0ee57b4e447bff9fb52ac9af994ae20545424b296fc0e630736cd09e11f6eb2c

                                                                    SHA512

                                                                    e4d09c0196d61fbf93ff29d1f364f8c7081e7d1ddddd9893c4a4279abcfa719ce42c4690571cac8817abe293598ae2ecb8e8265ec2abc81b7954118f75aeda25

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    504B

                                                                    MD5

                                                                    bab95e89eeb73598fe6798b62177b731

                                                                    SHA1

                                                                    9e3830c7641bc9fd2198bcd55868f117a84152c2

                                                                    SHA256

                                                                    77cb23f7d459b83414a5bc2b5dab78d83d180936667fc04c4583839f585f4c67

                                                                    SHA512

                                                                    d5bf75b06440defea57a4ff774cb5fa1f26ccc5a2e0dc69d7a27e36060d56fe21bdc082761aea9306f0c003c1f8524ca60ab8fb6a155c55ca8b123585f880f48

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                                    Filesize

                                                                    70KB

                                                                    MD5

                                                                    e5e3377341056643b0494b6842c0b544

                                                                    SHA1

                                                                    d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                    SHA256

                                                                    e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                    SHA512

                                                                    83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    59d74b08d07f0dd34511e0df7bfada35

                                                                    SHA1

                                                                    b9acfa315955a8f0a18c2c11e8f7aa7aedb8f8bf

                                                                    SHA256

                                                                    c6b789008b9a672d958d4819c7bffcc2a8e27a4a2b3ae9d6cff1a116c15dd5dd

                                                                    SHA512

                                                                    5434cad25bf3c2034b79da86a75e4a21c34ff7c2b123520431e7154e5168ab25753b1f430e27a1f6d7ffd1a04a4bba5632bb8f59155951bec11d5e5b524df135

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    111B

                                                                    MD5

                                                                    285252a2f6327d41eab203dc2f402c67

                                                                    SHA1

                                                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                    SHA256

                                                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                    SHA512

                                                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    3KB

                                                                    MD5

                                                                    3dbcb070118209c6c5abfcb46a8a1884

                                                                    SHA1

                                                                    a992fddc9b4e230f51e13220ad421d20deec04fc

                                                                    SHA256

                                                                    d8f7d436609576188067ed90832eadba95b68bc92f1c3d2fe2ee3c3314b0eb80

                                                                    SHA512

                                                                    21cd6a064c5e90c47e1595c99d4e079fc5052f813241c94b3533191ce63a7aa5f3201d0d841c600930e48dea639fecd6bbac6f8707e403ab90c98a5aa3928395

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    5KB

                                                                    MD5

                                                                    3cd2cdbc00842daf48a827e278afa5f8

                                                                    SHA1

                                                                    97957081c20d802c5742e35ff61989d4fb416b40

                                                                    SHA256

                                                                    18f0427a6aada54585e9d01073e92c298ea277b915c4374df471d15720ec99a6

                                                                    SHA512

                                                                    975064f33c79d54900214e3206c19cf41ceedfe657321d2ff00858e7a2eaf22e639bca6eab11615f4bb0a68af626f4feedf67defdd05a1af6e1f0f7795a0740a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    533c2d4f1933dbe511869195d8031c21

                                                                    SHA1

                                                                    3d9148c06c166f38e2a91517288eab6a59b697ee

                                                                    SHA256

                                                                    72a23e8020b06a4ffcb493084fb6db76a92c485f2bc7312e5181493acd395ebb

                                                                    SHA512

                                                                    b18f7cb0c91ab08fa090a6e85d4d543e33e41deba9b8306250891ec057f49745c16944d4750a3a57ecc0834eff5ead55517ae93fa6ceb2f5dec0d8d673cb184b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    d90e9b575472e156cd918725fff52589

                                                                    SHA1

                                                                    7aefaa2277ec075843c429930fb434397224d660

                                                                    SHA256

                                                                    263ea0c1e7504f57072c2ea8ae2cb77985688e0e4266e12e3ec599f06fbd0768

                                                                    SHA512

                                                                    b4153d836c0c2132238ee1813ad3750019464ff30bd944a7b4ac5b5f7477e28ee6c7a2692346c800ce838f42942b6b65457339fc5390cc91a7bc3f4503f13d75

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    4KB

                                                                    MD5

                                                                    9d4c56f268a130b9f2e7679396c06387

                                                                    SHA1

                                                                    5574d748680ca3fcfd6575844b529dfeff4d09b4

                                                                    SHA256

                                                                    c6aaa4e60515dd18688fb16bd5bacfbf5c32cdf4d2249209274ca17aacd6d159

                                                                    SHA512

                                                                    6ae34515f9832eebfea86266d87c99ffd13927153341585fc5ba495513d33188514d7dffc3e1682e6a6b1a822f5e03cc0210d24ce83c064ab13eb8edfb759cec

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    0085da6a52673ee8acbc21b093d69f55

                                                                    SHA1

                                                                    5992e4f9ca44f77c7b0241aba4b6c6f7a01df9cf

                                                                    SHA256

                                                                    88947a81e1adf3044721cc32549baae52e438aee98db6dc9905ef5bf66f7a87e

                                                                    SHA512

                                                                    01e28869307e182df1c4369bc651d1793af6a592e0843ec238ba95367193a61c490c4b8305f3b0cea11585f3d8a4da200eeb6ed1f9f6efc6e1f88c402a8b73f1

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                    Filesize

                                                                    24KB

                                                                    MD5

                                                                    5edab6d3ffbeee247ccb4423f929a323

                                                                    SHA1

                                                                    a4ad201d149d59392a2a3163bd86ee900e20f3d9

                                                                    SHA256

                                                                    460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

                                                                    SHA512

                                                                    263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\ecd5a073-9ae4-4f3f-b184-5096695b5f1a\index-dir\the-real-index

                                                                    Filesize

                                                                    72B

                                                                    MD5

                                                                    9f142036934b2494f30be250270800f4

                                                                    SHA1

                                                                    146e7a93f3e5320fa64f0a96fc4e203db8685b57

                                                                    SHA256

                                                                    0813f2d21e49bd5f944b869ecd1bde168a44651632a0482dafaea7a4decf5b22

                                                                    SHA512

                                                                    7315b1bef7cd62d73f009e2f8d96c577fbe58bc6dc937475555a044e291b5390605cec82c7e058f696221462340307055ebeb74e14956f26d1ceab328d0fc19f

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\ecd5a073-9ae4-4f3f-b184-5096695b5f1a\index-dir\the-real-index~RFe5783d6.TMP

                                                                    Filesize

                                                                    48B

                                                                    MD5

                                                                    570c5b00766153b2b56af140f95157f5

                                                                    SHA1

                                                                    6e8ea02e09ccadabc679c53cae8e3f29dc2210cf

                                                                    SHA256

                                                                    fd1acaaa872e64a6f856790eea0279f807926d156d994640d872a1cdf72d8859

                                                                    SHA512

                                                                    e02334b7d73373e98542ad53dbd89820d6e741d6da67f848d69c9868631d95f1f6263817347cd968783ae773fd1f3d9eba64bc68688de7a99d4ae1b0e6c63614

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\index.txt

                                                                    Filesize

                                                                    85B

                                                                    MD5

                                                                    8e0c4275e4451726bf673c5c2adeda3a

                                                                    SHA1

                                                                    b401225378f1d9e0bac2df51649c465dd0991580

                                                                    SHA256

                                                                    83dd4a00c5c254c467e4e2fba1424d63ace73136dc6f6695575a83ab6f87961b

                                                                    SHA512

                                                                    d082ab7c9f5509c42f83d66023070042266cfc9bf84913e30539beb3a9696921abdafae075ac5c8d9e5841abe3059bff7c4b46d80e785bb7ac4719cd577ce8c6

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\index.txt

                                                                    Filesize

                                                                    80B

                                                                    MD5

                                                                    2fd0ee19ed4d4ea9008f6733b16a23ed

                                                                    SHA1

                                                                    04b3787e0a39a3a3728fafe954f1d3f524ac110f

                                                                    SHA256

                                                                    131814891349869bf9eca8d417679de264b32e336eaf47332ca46f923d68d742

                                                                    SHA512

                                                                    c476364b12399c1267eefc9a7040c6fe2aaa4f3b938b8f0e412b583a99c40923e2304558d1549a6b69b2ebc002716981b3cc99f66758b7ad09b1f8f0ecd2100e

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    875B

                                                                    MD5

                                                                    816064523e7135487b26f1acc0e9e4ad

                                                                    SHA1

                                                                    189b23fbddb3db9f032bbd7419e46e51557575d1

                                                                    SHA256

                                                                    aca52e5a50eaed34ec12893c395c744c382d0431689bf630d431c11d7a6e9206

                                                                    SHA512

                                                                    444ebf6663a2ce1919ec6820b672d7b0e16bd31eb156867b38c85d4c8439b4cfb8f1341c53bee76042af132b9bab737730ba7d6b3d7a374e3c6a01f7295a18b1

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578d0d.TMP

                                                                    Filesize

                                                                    539B

                                                                    MD5

                                                                    9268773314dca7cbe31926d979ebcb84

                                                                    SHA1

                                                                    b74f98ad436861aa35033dcad57a8ff719484ca3

                                                                    SHA256

                                                                    5dabdee42a369b23aa8c721e04621f7de570425bb31a9a65a674b1ed1bc1603e

                                                                    SHA512

                                                                    6ca8f4e5262d1afa3e5ed667f8b9b99be62cbf9a3f4ece8d8704216ccb6713bb9031618074eb07c4970df7badcffa42c0ff1bd70011ae7bc0479a12fde371d93

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    206702161f94c5cd39fadd03f4014d98

                                                                    SHA1

                                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                    SHA256

                                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                    SHA512

                                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                    Filesize

                                                                    41B

                                                                    MD5

                                                                    5af87dfd673ba2115e2fcf5cfdb727ab

                                                                    SHA1

                                                                    d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                    SHA256

                                                                    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                    SHA512

                                                                    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    46295cac801e5d4857d09837238a6394

                                                                    SHA1

                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                    SHA256

                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                    SHA512

                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    9KB

                                                                    MD5

                                                                    173791cdc0b7f86b8d88c18acacea69a

                                                                    SHA1

                                                                    5529d716b3ba04af6cd7a8eebf89d4ff94bed613

                                                                    SHA256

                                                                    e3de45a443da2b846af878b23cbbc0e33bf9100263cedcd2c478126c75f2cb44

                                                                    SHA512

                                                                    bb79ae3c073b51b978bc90d7f77c874b76b7c4ae99ce9ac777f46ecc18a0b34ca35f920a677ff8fdba3cf78e0ce9a4142567384bb392143bfecb2421092ef30f

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    12KB

                                                                    MD5

                                                                    6079689e6904e262b5465f0332405a49

                                                                    SHA1

                                                                    ec034855a6a5fe646aa2ea6634812fd9962bf8a6

                                                                    SHA256

                                                                    e8cb2324c65ca76e15eec6ca20332e806d8266f8c822ae9482eff7c154b94654

                                                                    SHA512

                                                                    a2570747ddccb1cbdd8f2eac29e2be96466b34744b9fdbd154a6e6f8ed29506ff952ed63f366afb8256a512228cc4b285fc9b1611dc3d69f93ce519efef8b4f2

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    12KB

                                                                    MD5

                                                                    e949628ea6d8c919acfddb5ec3ba4d9e

                                                                    SHA1

                                                                    46b75d91ed69a6c04c38adccf704251ceb82e104

                                                                    SHA256

                                                                    8e3a3a05c88708388bfd2abd313994f181f591f01715b1a9c9ac966efde87939

                                                                    SHA512

                                                                    5be23d86126ce15e435cea3c1836a2998279f56d1f50d54dc04f4c747e1336837009a4010af0c56c8a6c2c14c7326378a1c1f31dd0d6c7968ae1d8aec8868870

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    12KB

                                                                    MD5

                                                                    88bac66da10ff610e835859e08416e1a

                                                                    SHA1

                                                                    1c61b63403a572a87671f1be1a1fdea285b1f8e3

                                                                    SHA256

                                                                    708c6b24ea30310f254d7d8625ac5ba06de7ad98123151c034ef6a6b4feb98e2

                                                                    SHA512

                                                                    524d64b88b33b71a4c2904d8ed12276638e6dc28f763e37fffd4932d86775b08320486399e41c71d742bfb6462b4467414ff7f21f53c95f4d6ca3a94d0a7e473

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    13KB

                                                                    MD5

                                                                    ad89f926d88598be67d5ab1f89142bed

                                                                    SHA1

                                                                    d5be735005a943861926e869aaac7519c98b4b54

                                                                    SHA256

                                                                    2ededc7acc82b00d6c818043ad2d2725abcd42fd39212280335f034bf1568e02

                                                                    SHA512

                                                                    8b8f64fce4181b82901ca01d104ae29189a5e6e1f9ee0b12207a403b2a370c98fdc89bf401b74c1c126e159dc5e916242c1b58a97e15ea45795588d16386f8b7

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                    Filesize

                                                                    3KB

                                                                    MD5

                                                                    f77f18fb595c6a79be877eaa56f6c6c3

                                                                    SHA1

                                                                    66f3eea46c28b266636b9c5f160164aab0407b39

                                                                    SHA256

                                                                    3ea974b8ad587cf29906985c2d669551b5ca0b319f917aeacfd1215f308d8049

                                                                    SHA512

                                                                    63f7dcd28ce1b26d6b0f77144078506cf4cd8fa5acfe98c7a70a47548582aa8cc217586802f02dc14d6e54ff56236b74060ebb570bac9cc4260ed231dc8cefe1

                                                                  • C:\Users\Admin\Downloads\Unconfirmed 497619.crdownload

                                                                    Filesize

                                                                    1.6MB

                                                                    MD5

                                                                    a7a5c04005c17d1fa983f835cffbd183

                                                                    SHA1

                                                                    c79fb9d8fdbead904459bd9d1ffadf6ce43c9374

                                                                    SHA256

                                                                    3494f9352c5bd48f55caddbbb63515f8058763e28f8e5f8fa5411a5de835ca8e

                                                                    SHA512

                                                                    9a7aa97489f376c2cb4864c2d4f6a41978a25a5f0171c30077ceb4302fd58e5823f199f0dcf89f57ec48d31ebfbb01a8d258a1e7d0b391b7ac613bba6f2a1cee

                                                                  • C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2.zip

                                                                    Filesize

                                                                    9.7MB

                                                                    MD5

                                                                    5a0901dfdb36813e50f9a779a6841d1f

                                                                    SHA1

                                                                    385087aa72b713cc19190c7d364062020dc976d8

                                                                    SHA256

                                                                    c1eab41cfdb38cb9e3c7dab2bcaa8f80aeeb7a1d17485853c6d9624ef6a44185

                                                                    SHA512

                                                                    be4d7cccca684f7e45be473f23d7f42bf9bb1c110250207aabbc50abbb204ce7758e3cc732215f6c9f9ef20d60ed05605f8e6afe923390aa31b288dcd55e1642

                                                                  • memory/4924-555-0x0000000000310000-0x0000000001990000-memory.dmp

                                                                    Filesize

                                                                    22.5MB