hxxps://github[.]com/Matelpro777/MEMZ-4[.]0-pannel/raw/master/MEMZ-Clean[.]exe

Analysis

max time kernel
130s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2023, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Matelpro777/MEMZ-4.0-pannel/raw/master/MEMZ-Clean.exe

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ad8a860a-7416-40cd-b6e0-4a2b6fd91eb7.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230401031220.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d93b5b04e245d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EF8D7B4F-D03A-11ED-8227-CEBAE7FD2CA5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{11A41CF1-2025-45DA-8351-1782926A06A5}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 497619.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2080	msedge.exe
2080	msedge.exe
772	identity_helper.exe
772	identity_helper.exe
5904	msedge.exe
5904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2788	iexplore.exe
2788	iexplore.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2788	iexplore.exe
2788	iexplore.exe
4544	IEXPLORE.EXE
4544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 4544	2788	iexplore.exe	86
PID 2788 wrote to memory of 4544	2788	iexplore.exe	86
PID 2788 wrote to memory of 4544	2788	iexplore.exe	86
PID 2080 wrote to memory of 2020	2080	msedge.exe	96
PID 2080 wrote to memory of 2020	2080	msedge.exe	96
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 1560	2080	msedge.exe	97
PID 2080 wrote to memory of 2368	2080	msedge.exe	98
PID 2080 wrote to memory of 2368	2080	msedge.exe	98
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100
PID 2080 wrote to memory of 1776	2080	msedge.exe	100

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Matelpro777/MEMZ-4.0-pannel/raw/master/MEMZ-Clean.exe
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffcaef746f8,0x7ffcaef74708,0x7ffcaef74718
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7a9665460,0x7ff7a9665470,0x7ff7a9665480
    3⤵
    PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8482420514023268164,18039986360932529746,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3444 /prefetch:2
  2⤵
  PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5268

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5568

C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
1⤵
PID:4924

C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
1⤵
PID:5760

C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
1⤵
PID:5784

C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
1⤵
PID:5808

C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
425b7f5046ba8e407ea3cbe5db0b45df

SHA1
becb346f5fd7593d9db066b3eb2ef35016aaae4b

SHA256
0ee57b4e447bff9fb52ac9af994ae20545424b296fc0e630736cd09e11f6eb2c

SHA512
e4d09c0196d61fbf93ff29d1f364f8c7081e7d1ddddd9893c4a4279abcfa719ce42c4690571cac8817abe293598ae2ecb8e8265ec2abc81b7954118f75aeda25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
bab95e89eeb73598fe6798b62177b731

SHA1
9e3830c7641bc9fd2198bcd55868f117a84152c2

SHA256
77cb23f7d459b83414a5bc2b5dab78d83d180936667fc04c4583839f585f4c67

SHA512
d5bf75b06440defea57a4ff774cb5fa1f26ccc5a2e0dc69d7a27e36060d56fe21bdc082761aea9306f0c003c1f8524ca60ab8fb6a155c55ca8b123585f880f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
59d74b08d07f0dd34511e0df7bfada35

SHA1
b9acfa315955a8f0a18c2c11e8f7aa7aedb8f8bf

SHA256
c6b789008b9a672d958d4819c7bffcc2a8e27a4a2b3ae9d6cff1a116c15dd5dd

SHA512
5434cad25bf3c2034b79da86a75e4a21c34ff7c2b123520431e7154e5168ab25753b1f430e27a1f6d7ffd1a04a4bba5632bb8f59155951bec11d5e5b524df135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3dbcb070118209c6c5abfcb46a8a1884

SHA1
a992fddc9b4e230f51e13220ad421d20deec04fc

SHA256
d8f7d436609576188067ed90832eadba95b68bc92f1c3d2fe2ee3c3314b0eb80

SHA512
21cd6a064c5e90c47e1595c99d4e079fc5052f813241c94b3533191ce63a7aa5f3201d0d841c600930e48dea639fecd6bbac6f8707e403ab90c98a5aa3928395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3cd2cdbc00842daf48a827e278afa5f8

SHA1
97957081c20d802c5742e35ff61989d4fb416b40

SHA256
18f0427a6aada54585e9d01073e92c298ea277b915c4374df471d15720ec99a6

SHA512
975064f33c79d54900214e3206c19cf41ceedfe657321d2ff00858e7a2eaf22e639bca6eab11615f4bb0a68af626f4feedf67defdd05a1af6e1f0f7795a0740a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
533c2d4f1933dbe511869195d8031c21

SHA1
3d9148c06c166f38e2a91517288eab6a59b697ee

SHA256
72a23e8020b06a4ffcb493084fb6db76a92c485f2bc7312e5181493acd395ebb

SHA512
b18f7cb0c91ab08fa090a6e85d4d543e33e41deba9b8306250891ec057f49745c16944d4750a3a57ecc0834eff5ead55517ae93fa6ceb2f5dec0d8d673cb184b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d90e9b575472e156cd918725fff52589

SHA1
7aefaa2277ec075843c429930fb434397224d660

SHA256
263ea0c1e7504f57072c2ea8ae2cb77985688e0e4266e12e3ec599f06fbd0768

SHA512
b4153d836c0c2132238ee1813ad3750019464ff30bd944a7b4ac5b5f7477e28ee6c7a2692346c800ce838f42942b6b65457339fc5390cc91a7bc3f4503f13d75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
9d4c56f268a130b9f2e7679396c06387

SHA1
5574d748680ca3fcfd6575844b529dfeff4d09b4

SHA256
c6aaa4e60515dd18688fb16bd5bacfbf5c32cdf4d2249209274ca17aacd6d159

SHA512
6ae34515f9832eebfea86266d87c99ffd13927153341585fc5ba495513d33188514d7dffc3e1682e6a6b1a822f5e03cc0210d24ce83c064ab13eb8edfb759cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0085da6a52673ee8acbc21b093d69f55

SHA1
5992e4f9ca44f77c7b0241aba4b6c6f7a01df9cf

SHA256
88947a81e1adf3044721cc32549baae52e438aee98db6dc9905ef5bf66f7a87e

SHA512
01e28869307e182df1c4369bc651d1793af6a592e0843ec238ba95367193a61c490c4b8305f3b0cea11585f3d8a4da200eeb6ed1f9f6efc6e1f88c402a8b73f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\ecd5a073-9ae4-4f3f-b184-5096695b5f1a\index-dir\the-real-index

Filesize
72B

MD5
9f142036934b2494f30be250270800f4

SHA1
146e7a93f3e5320fa64f0a96fc4e203db8685b57

SHA256
0813f2d21e49bd5f944b869ecd1bde168a44651632a0482dafaea7a4decf5b22

SHA512
7315b1bef7cd62d73f009e2f8d96c577fbe58bc6dc937475555a044e291b5390605cec82c7e058f696221462340307055ebeb74e14956f26d1ceab328d0fc19f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\ecd5a073-9ae4-4f3f-b184-5096695b5f1a\index-dir\the-real-index~RFe5783d6.TMP

Filesize
48B

MD5
570c5b00766153b2b56af140f95157f5

SHA1
6e8ea02e09ccadabc679c53cae8e3f29dc2210cf

SHA256
fd1acaaa872e64a6f856790eea0279f807926d156d994640d872a1cdf72d8859

SHA512
e02334b7d73373e98542ad53dbd89820d6e741d6da67f848d69c9868631d95f1f6263817347cd968783ae773fd1f3d9eba64bc68688de7a99d4ae1b0e6c63614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\index.txt

Filesize
85B

MD5
8e0c4275e4451726bf673c5c2adeda3a

SHA1
b401225378f1d9e0bac2df51649c465dd0991580

SHA256
83dd4a00c5c254c467e4e2fba1424d63ace73136dc6f6695575a83ab6f87961b

SHA512
d082ab7c9f5509c42f83d66023070042266cfc9bf84913e30539beb3a9696921abdafae075ac5c8d9e5841abe3059bff7c4b46d80e785bb7ac4719cd577ce8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\19b6cf247613cc2a293a024fa2e980aae478e411\index.txt

Filesize
80B

MD5
2fd0ee19ed4d4ea9008f6733b16a23ed

SHA1
04b3787e0a39a3a3728fafe954f1d3f524ac110f

SHA256
131814891349869bf9eca8d417679de264b32e336eaf47332ca46f923d68d742

SHA512
c476364b12399c1267eefc9a7040c6fe2aaa4f3b938b8f0e412b583a99c40923e2304558d1549a6b69b2ebc002716981b3cc99f66758b7ad09b1f8f0ecd2100e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
816064523e7135487b26f1acc0e9e4ad

SHA1
189b23fbddb3db9f032bbd7419e46e51557575d1

SHA256
aca52e5a50eaed34ec12893c395c744c382d0431689bf630d431c11d7a6e9206

SHA512
444ebf6663a2ce1919ec6820b672d7b0e16bd31eb156867b38c85d4c8439b4cfb8f1341c53bee76042af132b9bab737730ba7d6b3d7a374e3c6a01f7295a18b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578d0d.TMP

Filesize
539B

MD5
9268773314dca7cbe31926d979ebcb84

SHA1
b74f98ad436861aa35033dcad57a8ff719484ca3

SHA256
5dabdee42a369b23aa8c721e04621f7de570425bb31a9a65a674b1ed1bc1603e

SHA512
6ca8f4e5262d1afa3e5ed667f8b9b99be62cbf9a3f4ece8d8704216ccb6713bb9031618074eb07c4970df7badcffa42c0ff1bd70011ae7bc0479a12fde371d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
173791cdc0b7f86b8d88c18acacea69a

SHA1
5529d716b3ba04af6cd7a8eebf89d4ff94bed613

SHA256
e3de45a443da2b846af878b23cbbc0e33bf9100263cedcd2c478126c75f2cb44

SHA512
bb79ae3c073b51b978bc90d7f77c874b76b7c4ae99ce9ac777f46ecc18a0b34ca35f920a677ff8fdba3cf78e0ce9a4142567384bb392143bfecb2421092ef30f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6079689e6904e262b5465f0332405a49

SHA1
ec034855a6a5fe646aa2ea6634812fd9962bf8a6

SHA256
e8cb2324c65ca76e15eec6ca20332e806d8266f8c822ae9482eff7c154b94654

SHA512
a2570747ddccb1cbdd8f2eac29e2be96466b34744b9fdbd154a6e6f8ed29506ff952ed63f366afb8256a512228cc4b285fc9b1611dc3d69f93ce519efef8b4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e949628ea6d8c919acfddb5ec3ba4d9e

SHA1
46b75d91ed69a6c04c38adccf704251ceb82e104

SHA256
8e3a3a05c88708388bfd2abd313994f181f591f01715b1a9c9ac966efde87939

SHA512
5be23d86126ce15e435cea3c1836a2998279f56d1f50d54dc04f4c747e1336837009a4010af0c56c8a6c2c14c7326378a1c1f31dd0d6c7968ae1d8aec8868870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
88bac66da10ff610e835859e08416e1a

SHA1
1c61b63403a572a87671f1be1a1fdea285b1f8e3

SHA256
708c6b24ea30310f254d7d8625ac5ba06de7ad98123151c034ef6a6b4feb98e2

SHA512
524d64b88b33b71a4c2904d8ed12276638e6dc28f763e37fffd4932d86775b08320486399e41c71d742bfb6462b4467414ff7f21f53c95f4d6ca3a94d0a7e473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
ad89f926d88598be67d5ab1f89142bed

SHA1
d5be735005a943861926e869aaac7519c98b4b54

SHA256
2ededc7acc82b00d6c818043ad2d2725abcd42fd39212280335f034bf1568e02

SHA512
8b8f64fce4181b82901ca01d104ae29189a5e6e1f9ee0b12207a403b2a370c98fdc89bf401b74c1c126e159dc5e916242c1b58a97e15ea45795588d16386f8b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f77f18fb595c6a79be877eaa56f6c6c3

SHA1
66f3eea46c28b266636b9c5f160164aab0407b39

SHA256
3ea974b8ad587cf29906985c2d669551b5ca0b319f917aeacfd1215f308d8049

SHA512
63f7dcd28ce1b26d6b0f77144078506cf4cd8fa5acfe98c7a70a47548582aa8cc217586802f02dc14d6e54ff56236b74060ebb570bac9cc4260ed231dc8cefe1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 497619.crdownload

Filesize
1.6MB

MD5
a7a5c04005c17d1fa983f835cffbd183

SHA1
c79fb9d8fdbead904459bd9d1ffadf6ce43c9374

SHA256
3494f9352c5bd48f55caddbbb63515f8058763e28f8e5f8fa5411a5de835ca8e

SHA512
9a7aa97489f376c2cb4864c2d4f6a41978a25a5f0171c30077ceb4302fd58e5823f199f0dcf89f57ec48d31ebfbb01a8d258a1e7d0b391b7ac613bba6f2a1cee

Download Submit
C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2.zip

Filesize
9.7MB

MD5
5a0901dfdb36813e50f9a779a6841d1f

SHA1
385087aa72b713cc19190c7d364062020dc976d8

SHA256
c1eab41cfdb38cb9e3c7dab2bcaa8f80aeeb7a1d17485853c6d9624ef6a44185

SHA512
be4d7cccca684f7e45be473f23d7f42bf9bb1c110250207aabbc50abbb204ce7758e3cc732215f6c9f9ef20d60ed05605f8e6afe923390aa31b288dcd55e1642

Download Submit
memory/4924-555-0x0000000000310000-0x0000000001990000-memory.dmp

Filesize
22.5MB

Download