hxxps://github[.]com/Valyse31/Valyse-1[.]4[.]1

Analysis

user interaction
yes
max time kernel
163s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/07/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Valyse31/Valyse-1.4.1
Sample260719-3hlmhaf13k

Score

6^/10

costura discovery packer

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
75	raw.githubusercontent.com
76	raw.githubusercontent.com
77	raw.githubusercontent.com

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/memory/728-381-0x0000000007280000-0x0000000007538000-memory.dmp	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Valyse Launcher.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1740	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289774711358174"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{DDB70A7C-3D41-4F76-82EE-3EC2A5A53701}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
728	Valyse Launcher.exe
728	Valyse Launcher.exe
4920	msedge.exe
4920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	728	Valyse Launcher.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3748	2164	msedge.exe	81
PID 2164 wrote to memory of 1740	2164	msedge.exe	82
PID 2164 wrote to memory of 4176	2164	msedge.exe	84
PID 2164 wrote to memory of 4176	2164	msedge.exe	84
PID 2164 wrote to memory of 2288	2164	msedge.exe	83
PID 2164 wrote to memory of 2288	2164	msedge.exe	83
PID 2164 wrote to memory of 2288	2164	msedge.exe	83
PID 2164 wrote to memory of 5084	2164	msedge.exe	97
PID 2164 wrote to memory of 5084	2164	msedge.exe	97
PID 2164 wrote to memory of 5084	2164	msedge.exe	97
PID 2164 wrote to memory of 3928	2164	msedge.exe	87
PID 2164 wrote to memory of 3928	2164	msedge.exe	87
PID 2164 wrote to memory of 3928	2164	msedge.exe	87
PID 2164 wrote to memory of 4196	2164	msedge.exe	89
PID 2164 wrote to memory of 4196	2164	msedge.exe	89
PID 2164 wrote to memory of 4196	2164	msedge.exe	89
PID 2164 wrote to memory of 3252	2164	msedge.exe	90
PID 2164 wrote to memory of 3252	2164	msedge.exe	90
PID 2164 wrote to memory of 3252	2164	msedge.exe	90
PID 2164 wrote to memory of 3152	2164	msedge.exe	91
PID 2164 wrote to memory of 3152	2164	msedge.exe	91
PID 2164 wrote to memory of 3152	2164	msedge.exe	91
PID 2164 wrote to memory of 4760	2164	msedge.exe	92
PID 2164 wrote to memory of 4760	2164	msedge.exe	92
PID 2164 wrote to memory of 4760	2164	msedge.exe	92
PID 2164 wrote to memory of 3260	2164	msedge.exe	94
PID 2164 wrote to memory of 1276	2164	msedge.exe	95
PID 2164 wrote to memory of 3260	2164	msedge.exe	94
PID 2164 wrote to memory of 1276	2164	msedge.exe	95
PID 2164 wrote to memory of 5084	2164	msedge.exe	97
PID 2164 wrote to memory of 1128	2164	msedge.exe	98
PID 1128 wrote to memory of 2028	1128	msedge.exe	99
PID 2164 wrote to memory of 2580	2164	msedge.exe	100
PID 2164 wrote to memory of 1324	2164	msedge.exe	101
PID 2164 wrote to memory of 2580	2164	msedge.exe	100
PID 2164 wrote to memory of 1324	2164	msedge.exe	101
PID 2164 wrote to memory of 1324	2164	msedge.exe	101
PID 2164 wrote to memory of 3092	2164	msedge.exe	102
PID 2164 wrote to memory of 2616	2164	msedge.exe	105
PID 2164 wrote to memory of 4204	2164	msedge.exe	106
PID 2164 wrote to memory of 2088	2164	msedge.exe	107
PID 2164 wrote to memory of 1884	2164	msedge.exe	108
PID 2164 wrote to memory of 1884	2164	msedge.exe	108
PID 2164 wrote to memory of 4784	2164	msedge.exe	109
PID 2164 wrote to memory of 4784	2164	msedge.exe	109
PID 2164 wrote to memory of 1068	2164	msedge.exe	111
PID 2164 wrote to memory of 1068	2164	msedge.exe	111
PID 2164 wrote to memory of 1068	2164	msedge.exe	111
PID 2164 wrote to memory of 4028	2164	msedge.exe	113
PID 2164 wrote to memory of 4028	2164	msedge.exe	113
PID 2164 wrote to memory of 4028	2164	msedge.exe	113
PID 2164 wrote to memory of 3412	2164	msedge.exe	114
PID 2164 wrote to memory of 3412	2164	msedge.exe	114
PID 2164 wrote to memory of 4920	2164	msedge.exe	115
PID 2164 wrote to memory of 3720	2164	msedge.exe	116
PID 2164 wrote to memory of 3720	2164	msedge.exe	116
PID 2164 wrote to memory of 3720	2164	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Valyse31/Valyse-1.4.1
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffc35a9c188,0x7ffc35a9c194,0x7ffc35a9c1a0
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,16926952797539019766,9991407727634066913,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,4293570224309335057,2785273553583331284,262144 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,6060498850663726273,4901710393960027300,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,13191373557534875809,6568295521348501760,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,14403210701731400357,13757758977259841897,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,16762592647911840521,17818880921065542563,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,10079669693807381640,3367506026849474052,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4372,i,14636245330073231473,963018550851686959,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4420,i,8644380601751354791,15695096947918235094,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:9
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,12321138926253205079,17738992527776021071,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,12841994432529026803,5305275795229739908,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,15765641547546089968,3840097454508531521,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,15765641547546089968,3840097454508531521,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,9282999314807864785,12688942813569311263,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,2147077040658184539,8495536387300253231,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6708,i,10666525174084077866,12809732119211356371,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,14403344220285236150,15548732077235995427,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,16449166916324859334,5468297322359149394,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,14197503437188757802,4287937248347062216,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,4260423818698190394,17389966420536351852,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,16631759640701567317,6800120893637958198,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:14
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,13684397145172043912,9634978616676397975,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:14
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5920,i,13561812149199569467,6109639388072893253,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4476,i,13408883156884491532,2702547758717441167,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,1284545318869604197,7737378139777014424,524288 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:12
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7852,i,533338216777776702,44108716379915329,262144 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3544,i,929524844487312403,18078846566936989927,2097152 --field-trial-handle=2060,i,6816264609765613380,13186730337042327188,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2428

C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe
"C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2\Valyse Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 07127bbd242a0bc98c0f33e32449e67cb9d60fc1bc388da6c91cab59e672e6b6
MD5 7d7abc621c20cc97d8696a0fea45f758
SHA1 3323dbf6e948f8c97673ffb439917b10d5599936
SHA512 8f1d2729f13aaf9f4ef22a0b4627b3c7e7bf04d0be434711be6421e4e8b7604e2f2aac72074a29c4a4e1b175dd3097724f45975488f8df35fe34cc580e69b03b
TLSH
T15FD023207B3C75D2D738153584334B10777D8557355AC1467111440D8C76885D7C9987
MD5 SHA1 SHA512 TLSH

Submit Download

0054853f-4490-4dc1-82cd-55ff7595b381.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0054853f-4490-4dc1-82cd-55ff7595b381.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

312b4422-e3ed-4d79-a4d1-2b0b0bf4b32a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\312b4422-e3ed-4d79-a4d1-2b0b0bf4b32a.tmp
Size 13KB
SHA256 66e84ad534bddb7373f84ce8dc2e8db40af56f4641b9fe5d692c00912231b365
MD5 05963f52713b1f0c7fd0b13b35f09781
SHA1 e90cc5d94dce0e9be9a005ae7dc2fab3225d4075
SHA512 21b3b548471c9197d73076687d31aa78f0e95b327d9ce37c6c47e4b0151d1f345ca78a8404747a9e724be440939951dd7cb92a75d8ab38b0f2b3a590bb649796
SSDEEP 192:sxZCR6yM/jK1Ml8MFs/fRszL+ZIyIdpstP/W6+WNYiR/Y0uBHnoJiYIgrJ:sxZCAds/fRszL+ZI7s/bD/5u509
TLSH
T19352D7526A34597BCCDBD20AFA55BB53D6F50463D2900E48AAFC9A0C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 68KB
SHA256 6dbc461a49b2a4d4312bd272383ef4a0a4472999baf1423240a576ab6953ac99
MD5 5f16a2f0c29d5575bd2335f64edffdb8
SHA1 cb5b12fc3f8de7d854219534d661942884b6ab58
SHA512 13509796fa872e1087322da39d83086c82291bf49a64c704e6e5e05d1d9df1ed1216b3b2c29cfd38ced066d07def40b0e30bf3a01bfde3f49f998b22d3a803f3
SSDEEP 1536:6nS7ChLVxkopkMxOIdzaA79aelJcW1DNxD:vWhLVxkopkKBwvelJhD
TLSH
T19A630262A99C291E0B345E5B2FAFB275A06CDF0E1D21403D1FC483D925934B50E6EEE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 38KB
SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
MD5 04bd0131c5ce154413f71d20017679e6
SHA1 a83459180dca62eb56edee213409f83e12fa6172
SHA512 5818141afbbc45553e72fc106699d9357437f1c2751751dab4f51ad7127e92a6ff85fb67905073addfdec5dd581c8c22ffc8dd6b85919d6a1d72550ebda5376c
SSDEEP 768:hrGgBfBZrOcgLWz/irLn2nTXzHXP0JsdgCQL1/UAv73nWEjvvuUwp5:hrGA51OQ2naXzP0Jsdns73WEaz
TLSH
T1170302AD7D526331E7FB684CC972AA1340C424498063CB1FBEFF098E9D44A4FE056A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 22867165576cfe75fd6be3df65048bcb677f7a73326bd6ea3799bde92ca11528
MD5 3f1591a5712162711013ecb0bfe208d8
SHA1 2108ad274b0ded7e471b4333c316b0670e5c50e2
SHA512 a28edaa24f974cb44753b18a73c80e671c4b09cdeae78d3316ae03e7c93f0abc4134231bfde63a3cb3974ff6506aa8fc1917673c6c30fb245ddbee5ae0f995cb
SSDEEP 192:Zd+8mkNXXP7cqcs3p/upowB1hwBcGiliNTYBVBGf+9NVXy04ShgE:rx9M7Ni+m6xhl
TLSH
T10FF1C6859801212BC3A8413251F442DC7D7366BFA25BDE773944923FAF2A3A9E0C325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 688472a5a793b3a0d17c6c4e1c8e32b9ce7035932437ac63684bcc2cd134648c
MD5 333d5db814540d2b86a4a5c15f40f762
SHA1 fb71a6722f319543ee7d3cccdf062af9afbaf3b7
SHA512 653026e6f930f97811fb511385a2c04a53dc47281ed044d9ab831cbdc55d04e8f7aca4bd02d639819ea8cca81e3b48cf1bfba87da3bd8be22ab3a55092164b28
SSDEEP 96:vqwugwfw9WD7cMIY90XwUDwbzLrliX2Y+Uf+/wo4ZsrwdjVn4j0hhdc:FU6KcMI/XwUDw33liGYbpo+XNS0hhm
TLSH
T1A2F192D44941211BC3AC403250F856DC7D7366BBA25BDE773940923FAF2A7AAC0C729E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 ebfa86fa2672bd3b4facf6378a5aeaf4f97b8a87d91077ee1db2c74e9d03c3c9
MD5 d144ed72e267b39990b546eea5036e78
SHA1 4bac7db70773d66ffb6c07a4e9e5f895525c69d2
SHA512 dc5c8ce5a3856afc5be730c270acb99a044712b6b282d60e0ca91ffcad384a516bff3bcf7cac36f45a9e1f1303d3b2de8395425d8c9654e168aa2c8287b22a64
SSDEEP 96:oqP35ziXh7c8/xKw9XwbzLCL+n8Hwq9//r2djaU90Uh:bCBc8/Uw9Xw3+L2q5qNh0c
TLSH
T1CBC14D9141410517C3A9843090F151DCBDB366BFA2A7EE773A44827FAE2A7AAC0C7297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d174.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d174.TMP
Size 3KB
SHA256 e4ba35d47d538971b97166c30a2cbc4882fd7a9d7750b451b7bed81c234ba5be
MD5 84ab6da6789cba2f5755b325a7a8b1cf
SHA1 8a0c843f21456318d75df6f1e7a5cfcec079a962
SHA512 e53b10932ffa98d6fdbafea60e9e8888a5621bdfbac303a5385dfdc5c896431cf02be6718d9840b3743e931a22da97c1eb8b575aa5d1a74be925a9fdb97c2828
TLSH
T1D561F6E681520663E3A90030A0F052DC7CB174AEFB876FA93D84537F293B7B2D056369
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c7bfcb9c6e6460c07e6e537fa6b21148ca5d62091761d00c95c74fdead92dea9
MD5 b3d3a16d7ae9708ff233f3eae219eaee
SHA1 a5c9fb95df4d2040650a6c8a264ca10384ae7e7c
SHA512 50677baaa7ffb98b78498fb6995eca4f42f18affe660543b338f2f3a982f7cccd07a28d33240a39b9ae08ddb0e6edc14fbce97a62340e45a6136442b7417c9fd
SSDEEP 3:MsEllllkEthXllkl2zEgltf1:/M/xT02zjj
TLSH
T1B744040FFFC04405C5041034D431C35033F0F4D405135753347504135CC55400F40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bf0794a4d43e4c7cb143f87e4f796eff50c8750f8c566acb4214e7482157d288
MD5 3de1f8f85bb88ebf1a185c582a541c59
SHA1 dcb76d04f660a18a17ca7da38ec1a36289198065
SHA512 4c679157ffbae2b6d6ad85556b1bbcfad969bf0265571e795228988e74171c9193b1ff063fefcddfe341edcef66cbc8e04dd5ebe35322b561293d83867751397
TLSH
T157818CF787E6866DDA1155F0EA18AE2BCE1D0911831C3C29C5E0AF5BD3F2471E141B6E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c4839c104fa01c767d8bc8fc9508baaf64b58619b2fbeb5290cb4de9308d320a
MD5 504ca50299a4ba791c9b590c30d7645b
SHA1 63a01fecc53c7a55a31bf9758755ef1d8ff2e336
SHA512 9087b746c791210d621da066ed4cda4f1bb9cf19b3b2abaa7bc29fbdfd4aef1d31a4b38f4ba863f308f66b8c050277258e21b6eb92e9ea12c8287c101f80ae56
TLSH
T1FE4149F787E2956D9B125AF0AA18EE2BCE2C0511831C786985E0BE57D3F3871E10275F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4253253d6f49185f15a869e40895cf748a359ed78626e9e3e42f09e89c26c45a
MD5 7f2015aa11d760d16141410a6778fa49
SHA1 0b217406baa6014386b64f3e070bd40fd0878ba3
SHA512 60d64835e81f799d26d0c9a146c4e2ba4988cda67bd3002500d60840a574ab44882a0cf51088e03109c3e2b5e20dfed99fe157ce5f6341fb3db2776a1d0d0321
TLSH
T12C719CF787E5866DDA1255F0AA18AE2BCE2D0511831C3C29C5E0AE5BD3F2871E141B6F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6ec6b774686f11059062695df236bfa7adeeaf57cc3057266777b72320798cea
MD5 a79413c8b0640a6bdd476b442a6a1b86
SHA1 3275cdd30929e751f2661479a95d3ebbb806c064
SHA512 24434bd3a61ab1a474e8f5969d3e1b456792df28b94560ba01f6983ea07615b135c61aa87b4217c8ec380c26d0edd4f942cb5f51db66c5480ea12c6fd53dacd5
TLSH
T1C7D0226B220170B5A5AC3EA390AEFCCECB2E10204943DDD620D0689C0D3686D092B145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ab71c45a807f4df4a3dd240a473d429e3f3a0d5dc2f4937e6b25a29bbadd5a04
MD5 390871761ead1b7a8ac0a0f7f60402b9
SHA1 30e01d6fcc7142647f817f35519864fdc0bce070
SHA512 4cd22df2917f40fc1c019256acb28502065bbd5fde86d9753e98ad18387325a4914515ca3b1d0563e4368770d9368dba37f57110ee9ad9d7fba74e5d89ed1870
TLSH
T1A8D023171101B0B565BC3F97505DFCCFC72F10550443DDD520D0645C093186D5D17249
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59cfba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59cfba.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 77b91288df0671ca7beb6d1bc3be1e74e80688692c8c014ac6ae8feaf465ad85
MD5 d59b050a3432e6cb9ff6b0061f85fcaf
SHA1 e5430f5b11537be10ad5e107a59e197647754732
SHA512 694b9e8788902a16ba50ae9424bd660cce70186fa2e3f3b9d31495d83f328e601c2686d07b28b2773c1a6aa798da0d35286ae133048b02c2856fd9f70b04008d
SSDEEP 384:sxZCAqam4s/fRscWv8L0rIDG/bZ8p5uxV08WhM+:sKnam4s/ftYs0rIa/bq5O0/
TLSH
T14B82C652662089B7CCDBD61EF9657F53D6F504239A914E4CAAFCCA1C00EA6FD2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 adc1e284745d45bb5ff66afcccc55014d0a86fefbff3a8518208eb8f60d0e30b
MD5 56093c7e0d4bfa438082703815fb70c8
SHA1 10796e19673c1ae26a5057dedf899ef0da3efbdd
SHA512 4fd924b4b4c8753c40c4e600ee3db463cfce72602dbaec74a3a9187da5c45b64965be83045fb5e23c44a1cf9fdfa085ec2d3cddc6e81dd7a9a8ba2033016f06f
SSDEEP 192:sxZCR6yM/jK1Ml8Mos/fRseL+ZIyIdpstP/W6+WNYiR/Y0uBHnxJiYIg5/J:sxZCAQs/fRseL+ZI7s/bD/5uY0f
TLSH
T1E952E9526A34597BCCDBD20AFA55BB53D6F50423D2900E48AEFC9A1C01E6BED6213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 15310ae625a1a51ce39279269b4772b47986344834fae9385faf1e9d43229c0f
MD5 14feaa7c66bf5392430561bf82bc1914
SHA1 4b4db819b1a2e4d5de7cc554e4150be5eac4cc39
SHA512 2405a9989e20208467601f2464644f2062cbf4d7c2b1f269a91f46d1053f31bd350e00802ee7c090e6bf78c934f31b574fc10e0461c0a4f66c7449a64794171d
SSDEEP 384:sxZCAqkm4s/fRseL0aIDG/bDQZ5uQo0CWhM+:sKnkm4s/fj0aIa/bE5NP/
TLSH
T1C882C752662489B7CCCBD61AB9717F53D6F50423DA514E4CAAFCCA1C00EA6FD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 0bf9f1cc3add6b326ad246b395a8461d4f3b7d77a857bbf9e00f36592d4648a1
MD5 8fbce7393eeaef882b6f323b0a9ef7b8
SHA1 bbf19e08f7893bd340d6b9571569dfa6d0f5d723
SHA512 3b15c962cfde1443ba52b11669728d8636b3fdeed2a398a986d8aca1e07eb6bb6b934b42adaa8b51e90c39034a3242fc0aef74feaa4bdb78300007aa48dfb65e
SSDEEP 384:sxZCABm4s/fRseL0hID9/bDo/5uto0p2hM+:sK0m4s/fj0hIx/be5we/
TLSH
T12D82C652662499B7CCCBD60AB9757F53D6F50423DA510E8CAEFCCA1C01AA6FD2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 8cff46584f00a4e94c6e0e5286aa306232dc049ecf6eef1da13fa24c6ee6aff4
MD5 35cbbef5cb02c40f6afcd07e89774631
SHA1 0b4407f8a3e61cca19bd7d48a653fe0da7821c74
SHA512 df3a90af9bfef4159e070d22750bf6dbe06b02cd8c11cb0c7c354af2497be6f841d881749e9511d66c5a18f4435eb56e471beaf02b62d1103437ef00d41b32c1
SSDEEP 768:j2/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060lG4rozU:j2/Lh8dF2/kWRmAcQ3wu1jaKKjLp0DlH
TLSH
T171E23B3B690CCBBE4F840EADEC266F976ED801CB96584D5447EA894C03C73EA411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2020c41ab6b4f324334f0bc78058383253f82f1abc646b6b309523a4d304e90e
MD5 d07c6c4b7d7f4690111aaa67ecd4d6c5
SHA1 f606c4fa549c2fcc4408f2307acfd77aafc7db25
SHA512 e8260fdfa0e78fdf0e69f88760581b1038d4a6e17b810fac8495d8f72f3afe0d66997a0febd8305c59afe09281b259c07c76acb198a0d488ca928a6eaaa319bd
SSDEEP 96:K08gKFGiy98IysMhnoH8lQhK9Ilyhhic4KhmqiWIKHqf:aBy98IysMRoHcQOIlyfrzPI
TLSH
T1B9B112D231BA02423D3D2648B256DB2F9A82B2A73119E52F37E940790E27F650DFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d2e529f-8a6d-4dc1-927c-b71b101df096.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3d2e529f-8a6d-4dc1-927c-b71b101df096.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8282a7b8910ed9ad921bbb74132a03726f7612bc2d7ddc8a7e0cf5fe916f08be
MD5 e33de28f449832ccd018ec37a631cca5
SHA1 c4dbd19d1ef00ff84c4db7216c2311ade99600dd
SHA512 8ca6b975c49813d87a12a1f4ce8b4a505ea6c4f05d48b386ce7c4e92f39ecc19835974101ec4708496c11969b7908d57ae1403fd282c8000e6da6307128dea59
SSDEEP 384:wtNn/s3n9Sf8N6eL40HRAy0Fptab8DgOObjI9G6w7OUN:wj+9UkC5bob8g29Md
TLSH
T131929D326C386D779EA35955B5473A1B5EF4827B93C82F48DAECAF0C01DF2AC4306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 aeecf9266fe8c3992c72bf5449ff977409d50fad479b2cfbebf4c61fcdcf93a1
MD5 98ab08df51b9bf79da7c79d7f5d6a53a
SHA1 d71eecfee5c773d8aefe34c832b9affd2af0eaab
SHA512 2aa7e11e61090a88de31bdc38a727279e73036a2f93f4adca99f0d31a0cd3bb5e2fb18f544a3f7700b987ef503ba8c9cd0c50b5c5753b60c366dcbd18def240f
SSDEEP 384:8iFKtNn/s3n9S+8NC8TUNTUlIlZL40HFNy0Fptab8DgOObjI9G6w7OUN:nFKj+9D/wgB35bobmg29Md
TLSH
T1FDA27B335C68997BAEA39E85F94B36179EF481BB86C46A44E7DC9F0C01DB2EC0306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 dbe6e2d3268631c18270bf3e5ef46c380aaa53b8a05e7d35210a4cf8631c888f
MD5 deb0da2db55fca92b0df77d880d5448b
SHA1 1f237d8dce1cc0dea8ae92b30fc1a6a4d1d7bf7d
SHA512 b47b7b18d70c2b9ecdf449aa04cce56d0764f14ed9cc955e8e6da9327dabbfcdcd9fa75939883b40af55344da70ec4a3fa4332e0f931fc2d4235f43e50484470
SSDEEP 768:nF2j+9DbwgBO5bob82td1K7k3q48MrIQ29Md:79DL+bobRn1K7k3DrrIQ2+d
TLSH
T14AF27EEA48D7993EC46E6B0BA77E2D2659BCC17BB5A45908F7844B0CCC6257FE301510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1de018b4d4033a00d0b0b6e88d35f40d2afd81628d6530b53e51e5874fda9c32
MD5 b93972ee41b86f92d4803e7cd5e67ed7
SHA1 a37fb51163f740391812461a694eb02e8e594815
SHA512 678866c30b3a03ddd3a84b95a4f0f8a2fcf0a67f5665d50f9b4ab20a9e8edeff32d84f5b1a4768e92c1de44e68f9e70f22b8419693a2ea96f20fa6c952fbd726
SSDEEP 384:3tNn/s3n9Sk8N6KL40HKAy0Fptab8DgOObjI9G6w7OUN:3j+9/095bob8g29Md
TLSH
T1E6928D325C386D779EA35955B4473A1B9EF4817B93C82F48DAECAF0D01DF2AC4306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6c3e9a9b78da7e5331b98c4058007c0faadcbeb7d79c1a3e524bb173711c2172
MD5 94a054e9b04008732816d616a0c77826
SHA1 cb0aeed5c092f19e0f7558934934d8243ef17370
SHA512 a8f72e386e366c2844ccf25bcdab350759ed7c4a14af141953bc01088977435f2469a9654775cfbcfa834c1557ebf98199e1ea6ca42eabf332d65ca94362d5e6
SSDEEP 192:qGNI6d9402QmiUyJvRTBF2oP1aRR/jGwbT0hLU6:qGNI6740Sm5TBFpta1ILU6
TLSH
T11D02D83668782CBB9EA36E49F44737176FD5112FAAC46B44DAE41F0C41DB29C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4a9b533fd7f365289e77e4b24f8313c9aeca82bbd1ddfcc2c6a4cdb8be294b30
MD5 6825eed5c1687c44fd4e895d8c81e022
SHA1 44c7ad7f95457a46bfa9a97f4c2744d3e75fe415
SHA512 72ebeb32c6e98fd287be0178eda68c8eaaa9358bf5f5ce1a58625cf15605fde458a8db877760d2e11710c3830fa81bffb2a4eb4d2625139d015375008ee9ee59
SSDEEP 192:VGNb6d940tQmiUy2RuBF2oP1aRR/38yiDLqbU6:VGNb6740rNuBFptab8PgU6
TLSH
T1B6120A37A878687B9EA3A845B48735176DE5423BDBC47B44D6EC2F0C41EF29C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f4a57c36c39e095f53bf841e1187428d8cc96041bac4b83d2f4a228f79c140b5
MD5 6e9e865ab319c3f11fb61fb6e8aef204
SHA1 6d9a8bd7160966c642803f5f5c2e44cb8ff7dee4
SHA512 cca3d0fbcc4aa70dbdcbbff5307d7f3a1b84e9336d3274aa1672d55194706ab6acf93a156bb6850fc4bcb854588e1599de5239c5eac79da7becb7785b43f18f2
SSDEEP 384:3tNn/s3n9Sk8N6ZL40HKAy0Fptab8DgOObjI9G6w7OUN:3j+9/h95bob8g29Md
TLSH
T142929D326C386D779EA35955B4473A179EF4817B93C82F48DAECAF0D01DF2AC4306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cac3648e939a3e041255ba6d7b34ee60e6cf92115c65fc858b8e5f6d1fcd0b59
MD5 cd27b1b68e2da7af026c0b08b76d39c4
SHA1 3f4361b4556005cc06b99bd6ad7dba27181ccaea
SHA512 3c39a30acd19182d5a8fa1f85bfec77c2d21dc03f09865098afb673b3d9cdbe9cdb710a22ddf4d065891bd8fc99d0d849a98967553fea74d8c50ba25628f9f71
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a4ab6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a4ab6.TMP
Size 392B
SHA256 5acf306ff98b27702d34521f3b0494f92cc27e4bb0de7f4ea5e24bb93c63fad2
MD5 9edd9fea2ae2126f2adb03b94035c5c5
SHA1 d1d45893eb7a7a0f692f9dc16af9e09d29c28f23
SHA512 3e421f8ea3f8caec25360c274a4c5813bf51c2c1011cebe00ed6bb00f29eacfd2ee30e6a08cc6d250e652bbe27c8c1088827b29e9b23abfb24f215387e03429e
MD5 SHA1 SHA512

Submit Download

d44812fb-5bc8-433f-a5a0-1f0f1be1367f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d44812fb-5bc8-433f-a5a0-1f0f1be1367f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_2karxaza.tls.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2karxaza.tls.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ValyseOfficialRelease1.4.1-b.2.zip.crdownload

Path C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2.zip.crdownload
Size 9.7MB
SHA256 c1eab41cfdb38cb9e3c7dab2bcaa8f80aeeb7a1d17485853c6d9624ef6a44185
MD5 5a0901dfdb36813e50f9a779a6841d1f
SHA1 385087aa72b713cc19190c7d364062020dc976d8
SHA512 be4d7cccca684f7e45be473f23d7f42bf9bb1c110250207aabbc50abbb204ce7758e3cc732215f6c9f9ef20d60ed05605f8e6afe923390aa31b288dcd55e1642
SSDEEP 196608:qOBYd/QUPKCBFcHyxu1GHbnqVHJHfPhgNtMmfYdHgDK+E98Fh:qOBsPP35vHkHhgTMmAdHgDYw
TLSH
T146A6330ACB5CA6FDC402879C99F13CE1FB22D531986BFA9E1C32639350D5C71991E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ValyseOfficialRelease1.4.1-b.2.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\ValyseOfficialRelease1.4.1-b.2.zip:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
TLSH
T1CA900297040444480F5535C459DC9418B11E7554CD454688EC5140D6D98409D42E9416
MD5 SHA1 SHA512 TLSH

Submit Download

memory/728-376-0x0000000000F90000-0x0000000002610000-memory.dmp

Download

memory/728-454-0x00000000115B0000-0x00000000115C1000-memory.dmp

Download

memory/728-455-0x00000000115F0000-0x00000000115FE000-memory.dmp

Download

memory/728-457-0x0000000011920000-0x000000001193A000-memory.dmp

Download

memory/728-456-0x00000000118E0000-0x00000000118F5000-memory.dmp

Download

memory/728-458-0x0000000011940000-0x0000000011948000-memory.dmp

Download

memory/728-460-0x00000000081A0000-0x00000000081A8000-memory.dmp

Download

memory/728-453-0x00000000115A0000-0x00000000115AA000-memory.dmp

Download

memory/728-452-0x00000000114B0000-0x0000000011554000-memory.dmp

Download

memory/728-451-0x0000000011490000-0x00000000114AE000-memory.dmp

Download

memory/728-444-0x00000000103D0000-0x000000001041C000-memory.dmp

Download

memory/728-443-0x000000000FC70000-0x000000000FC92000-memory.dmp

Download

memory/728-442-0x000000000FBD0000-0x000000000FC36000-memory.dmp

Download

memory/728-441-0x000000000F7E0000-0x000000000FB37000-memory.dmp

Download

memory/728-404-0x000000000FD90000-0x0000000010336000-memory.dmp

Download

memory/728-406-0x000000000ED50000-0x000000000ED9A000-memory.dmp

Download

memory/728-405-0x000000000EC60000-0x000000000EC7E000-memory.dmp

Download

memory/728-402-0x000000000EB30000-0x000000000EB52000-memory.dmp

Download

memory/728-403-0x000000000EC90000-0x000000000ECF6000-memory.dmp

Download

memory/728-401-0x000000000EB80000-0x000000000EC16000-memory.dmp

Download

memory/728-400-0x000000000F160000-0x000000000F7DA000-memory.dmp

Download

memory/728-399-0x000000000EAA0000-0x000000000EAD6000-memory.dmp

Download

memory/728-398-0x000000000EA40000-0x000000000EA5A000-memory.dmp

Download

memory/728-391-0x000000000D340000-0x000000000D34E000-memory.dmp

Download

memory/728-390-0x000000000D380000-0x000000000D3B8000-memory.dmp

Download

memory/728-381-0x0000000007280000-0x0000000007538000-memory.dmp

Download

memory/728-380-0x0000000007140000-0x0000000007170000-memory.dmp

Download

memory/728-379-0x00000000076E0000-0x0000000007D0A000-memory.dmp

Download

memory/728-378-0x0000000007030000-0x000000000703A000-memory.dmp

Download

memory/728-377-0x0000000006AE0000-0x0000000006AE1000-memory.dmp

Download