371ddadf46485dd23b8b9f526988fbf2fa37e57ef1ee710e780961396cac14ca

Analysis

user interaction
yes
max time kernel
89s
max time network
91s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FigmaSetup.exe
Size 144.8MB
Sample260709-kjddeags2x
SHA256 371ddadf46485dd23b8b9f526988fbf2fa37e57ef1ee710e780961396cac14ca
MD5 e7f4e6f476a17033d115b5bdf9bd95bf
SHA1 4073c34f792fa984f7944615721b282d33abbfe2
SHA512 15a1349dee4bc7581b02f727f36e43939ecc6169aa35df0747e290231ec9905a77321dad5f6c940a26816ee2cd4667e6fd1457b135f16e2e5dc5c6ecc2df3b0b
SSDEEP 3145728:/1c7GmGDyNLxITfhOZiUlQ/gsymNx6isDw6FsbRrnQIYYmZPI:tcSmHRxOJOd2JX6isDl6RrnQIYYmZPI
TLSH
T165783361CECDC47FEEDE6FFA554D99E0912EFD6D14200111CD833BA29BA30D11A26B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Figma Agent = "\"C:\\Users\\Admin\\AppData\\Local\\FigmaAgent\\figma_agent.exe\""	figma_agent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Figma.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Executes dropped EXE 15 IoCs

pid	Process
4736	Update.exe
4432	Squirrel.exe
4800	Figma.exe
4880	Figma.exe
3684	Figma.exe
1892	Figma.exe
6084	Figma.exe
3880	Figma.exe
5008	Figma.exe
1540	Figma.exe
2068	Figma.exe
4344	figma_agent.exe
2560	figma_agent.exe
1372	Figma.exe
4104	figma_agent.exe

Loads dropped DLL 10 IoCs

pid	Process
4800	Figma.exe
1892	Figma.exe
5008	Figma.exe
5008	Figma.exe
5008	Figma.exe
5008	Figma.exe
5008	Figma.exe
2068	Figma.exe
1540	Figma.exe
1372	Figma.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FigmaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	figma_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	figma_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	figma_agent.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4976	msedge.exe
6788	msedge.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Figma.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Figma.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Figma.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Figma.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Figma.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Figma.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Figma.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Figma.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Figma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Figma.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2464	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280600887807995"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\.fig\ = "Figma.exe"	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\.deck	Figma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\figma\ = "URL:figma"	Figma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\.jam\ = "Figma.exe"	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\figma\shell\open\command	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\figma\shell\open	Figma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\figma\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Figma\\app-126.6.12\\Figma.exe\" \"%1\""	Figma.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{B5BCE71A-603C-4744-A5E5-41287DA5F3D5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{36E7354A-A015-4330-AD56-92608FAAD6E4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\figma	Figma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\figma\URL Protocol	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Applications\Figma.exe\shell	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\.jam	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Applications\Figma.exe\shell\open\command	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Applications\Figma.exe\shell\open	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\figma\shell	Figma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\.deck\ = "Figma.exe"	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Applications	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Applications\Figma.exe	Figma.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Applications\Figma.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Figma\\app-126.6.12\\Figma.exe\" \"%1\""	Figma.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\.fig	Figma.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
5716	reg.exe
2848	reg.exe
5668	reg.exe
4944	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	Update.exe
4736	Update.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4800	Figma.exe
Token: SeCreatePagefilePrivilege	4800	Figma.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe
Token: SeCreatePagefilePrivilege	1892	Figma.exe
Token: SeShutdownPrivilege	1892	Figma.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4736	Update.exe
1892	Figma.exe
1892	Figma.exe
1892	Figma.exe
1892	Figma.exe
1892	Figma.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1892	Figma.exe
1892	Figma.exe
1892	Figma.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 4736	1956	FigmaSetup.exe	88
PID 4736 wrote to memory of 4432	4736	Update.exe	89
PID 4736 wrote to memory of 4800	4736	Update.exe	90
PID 4800 wrote to memory of 4880	4800	Figma.exe	92
PID 4800 wrote to memory of 3684	4800	Figma.exe	91
PID 4736 wrote to memory of 1892	4736	Update.exe	93
PID 1892 wrote to memory of 6084	1892	Figma.exe	94
PID 1892 wrote to memory of 5716	1892	Figma.exe	95
PID 1892 wrote to memory of 3880	1892	Figma.exe	96
PID 1892 wrote to memory of 5008	1892	Figma.exe	97
PID 1892 wrote to memory of 2848	1892	Figma.exe	99
PID 1892 wrote to memory of 5668	1892	Figma.exe	101
PID 1892 wrote to memory of 4944	1892	Figma.exe	103
PID 1892 wrote to memory of 2464	1892	Figma.exe	105
PID 1892 wrote to memory of 1540	1892	Figma.exe	106
PID 1892 wrote to memory of 2068	1892	Figma.exe	107
PID 1892 wrote to memory of 4344	1892	Figma.exe	109
PID 1892 wrote to memory of 1372	1892	Figma.exe	112
PID 1372 wrote to memory of 4104	1372	Figma.exe	113
PID 1892 wrote to memory of 1092	1892	Figma.exe	115
PID 1092 wrote to memory of 5564	1092	msedge.exe	116
PID 1092 wrote to memory of 4988	1092	msedge.exe	117
PID 1092 wrote to memory of 4976	1092	msedge.exe	118
PID 1092 wrote to memory of 4988	1092	msedge.exe	117
PID 1092 wrote to memory of 4988	1092	msedge.exe	117
PID 1092 wrote to memory of 5412	1092	msedge.exe	119
PID 1092 wrote to memory of 5412	1092	msedge.exe	119
PID 1092 wrote to memory of 4376	1092	msedge.exe	121
PID 1092 wrote to memory of 4260	1092	msedge.exe	122
PID 1092 wrote to memory of 4376	1092	msedge.exe	121
PID 1092 wrote to memory of 4376	1092	msedge.exe	121
PID 1092 wrote to memory of 4260	1092	msedge.exe	122
PID 1092 wrote to memory of 4260	1092	msedge.exe	122
PID 1092 wrote to memory of 4716	1092	msedge.exe	124
PID 1092 wrote to memory of 1028	1092	msedge.exe	123
PID 1092 wrote to memory of 4716	1092	msedge.exe	124
PID 1092 wrote to memory of 4716	1092	msedge.exe	124
PID 1092 wrote to memory of 1028	1092	msedge.exe	123
PID 1092 wrote to memory of 1028	1092	msedge.exe	123
PID 1092 wrote to memory of 3460	1092	msedge.exe	125
PID 1092 wrote to memory of 3460	1092	msedge.exe	125
PID 1092 wrote to memory of 1336	1092	msedge.exe	127
PID 1092 wrote to memory of 2328	1092	msedge.exe	128
PID 1092 wrote to memory of 1336	1092	msedge.exe	127
PID 1092 wrote to memory of 2328	1092	msedge.exe	128
PID 1092 wrote to memory of 5856	1092	msedge.exe	130
PID 1092 wrote to memory of 4704	1092	msedge.exe	134
PID 1092 wrote to memory of 4704	1092	msedge.exe	134
PID 1092 wrote to memory of 1812	1092	msedge.exe	132
PID 1092 wrote to memory of 1812	1092	msedge.exe	132
PID 1092 wrote to memory of 6440	1092	msedge.exe	136
PID 6440 wrote to memory of 6468	6440	msedge.exe	137
PID 6440 wrote to memory of 6684	6440	msedge.exe	138
PID 6440 wrote to memory of 6684	6440	msedge.exe	138
PID 6440 wrote to memory of 6684	6440	msedge.exe	138
PID 6440 wrote to memory of 6788	6440	msedge.exe	140
PID 6440 wrote to memory of 6800	6440	msedge.exe	141
PID 6440 wrote to memory of 6800	6440	msedge.exe	141
PID 6440 wrote to memory of 7060	6440	msedge.exe	143

C:\Users\Admin\AppData\Local\Temp\FigmaSetup.exe
"C:\Users\Admin\AppData\Local\Temp\FigmaSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Squirrel.exe
    "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:4432
- - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
    "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe" --squirrel-install 126.6.12
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
      "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Figma" --gpu-preferences=SAAAAAAAAADgAAAMAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,6092507235773682344,10682119251336614448,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,4115278948418550274,5185283342210539335,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1948 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:3684
  - - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
      "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Figma" --standard-schemes=file --secure-schemes=desktop-file --cors-schemes=desktop-file --fetch-schemes=desktop-file,file --streaming-schemes=file --field-trial-handle=1952,i,6092507235773682344,10682119251336614448,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,4115278948418550274,5185283342210539335,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2024 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:4880
- - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
    "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe" --squirrel-firstrun
    3⤵
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
      C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42\Crashpad --url=https://o22594.ingest.sentry.io/api/5265832/minidump/?sentry_key=303d5e72c2104327893b10231fce024a --annotation=_productName=Figma --annotation=_version=126.6.12 --annotation=plat=Win64 --annotation=prod=Electron --annotation=sentry[contexts][browser][name]=Electron --annotation=sentry[contexts][browser][version]=42.5.1 --annotation=sentry[environment]=stable --annotation=sentry[release]=126.6.12 --annotation=sentry[tags][initial_figma_id]= --annotation=sentry[user][id]=9caea265fdd64ea0be25a9609b649f66 --annotation=sentry[user][initial_figma_id]= --annotation=ver=42.5.1 --initial-client-data=0x47c,0x480,0x484,0x478,0x488,0x7ff7dbcea148,0x7ff7dbcea158,0x7ff7dbcea168
      4⤵
      Executes dropped EXE
      PID:6084
  - - C:\Windows\system32\reg.exe
      reg query HKLM\Software\Figma /v DisableUpdater
      4⤵
      Modifies registry key
      PID:5716
  - - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
      "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42" --standard-schemes=file --secure-schemes=desktop-file --cors-schemes=desktop-file --fetch-schemes=desktop-file,file --streaming-schemes=file --field-trial-handle=1928,i,10650564271774035890,15870313116250401108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,125768824286487111,12392953503090960312,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1964 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:3880
  - - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
      "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42" --gpu-preferences=SAAAAAAAAADgAAAMAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,10650564271774035890,15870313116250401108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,125768824286487111,12392953503090960312,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1924 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5008
  - - C:\Windows\system32\reg.exe
      reg query HKLM\Software\Figma /v AllowedOrigins
      4⤵
      Modifies registry key
      PID:2848
  - - C:\Windows\system32\reg.exe
      reg query HKLM\Software\Figma /v AllowedOriginHosts
      4⤵
      Modifies registry key
      PID:5668
  - - C:\Windows\system32\reg.exe
      reg query HKLM\Software\Figma /v ProxyUrl
      4⤵
      Modifies registry key
      PID:4944
  - - C:\Windows\system32\taskkill.exe
      taskkill.exe /im figma_agent.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2464
  - - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
      "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42" --standard-schemes=file --secure-schemes=desktop-file --cors-schemes=desktop-file --fetch-schemes=desktop-file,file --streaming-schemes=file --app-user-model-id=com.squirrel.Figma.Figma --app-path="C:\Users\Admin\AppData\Local\Figma\app-126.6.12\resources\app.asar" --enable-sandbox --enable-blink-features=CSSAnchorPositioning --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1783585826656799 --launch-time-ticks=601235668 --field-trial-handle=1928,i,10650564271774035890,15870313116250401108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,125768824286487111,12392953503090960312,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2980 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1540
  - - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
      "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42" --standard-schemes=file --secure-schemes=desktop-file --cors-schemes=desktop-file --fetch-schemes=desktop-file,file --streaming-schemes=file --app-user-model-id=com.squirrel.Figma.Figma --app-path="C:\Users\Admin\AppData\Local\Figma\app-126.6.12\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1783585826656799 --launch-time-ticks=601350802 --field-trial-handle=1928,i,10650564271774035890,15870313116250401108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,125768824286487111,12392953503090960312,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3120 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2068
  - - C:\Users\Admin\AppData\Local\FigmaAgent\figma_agent.exe
      C:\Users\Admin\AppData\Local\FigmaAgent\figma_agent.exe --from-desktop-app
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4344
  - - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe
      "C:\Users\Admin\AppData\Local\Figma\app-126.6.12\Figma.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42" --standard-schemes=file --secure-schemes=desktop-file --cors-schemes=desktop-file --fetch-schemes=desktop-file,file --streaming-schemes=file --field-trial-handle=1928,i,10650564271774035890,15870313116250401108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,125768824286487111,12392953503090960312,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\Users\Admin\AppData\Local\Figma\app-126.6.12\resources\FigmaAgent\figma_agent.exe
        
        "./resources/FigmaAgent/figma_agent.exe" -m --files_stdin
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.figma.com/app_auth/15654e61-7448-4a50-90cd-59195d63fa9d/grant?desktop_protocol=figma&locale=en
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffdabc5c188,0x7ffdabc5c194,0x7ffdabc5c1a0
        5⤵
        
        PID:5564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,14377301249753735748,17159579785099059616,262144 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
        5⤵
        
        PID:4988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,10736451674743498960,2759000283485495552,524288 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,10172066978123409277,4628104145765631805,524288 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
        5⤵
        
        PID:5412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,15634487992799729174,4208602020014359203,2097152 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        5⤵
        
        PID:4376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,1077218115910158174,2121238167030613808,2097152 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        5⤵
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,3757686420700725486,15327513750064393306,2097152 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
        5⤵
        
        PID:1028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,7892432314767898357,5137730070883728810,2097152 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:9
        5⤵
        
        PID:4716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,13864925863001082261,2754320046136592224,524288 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
        5⤵
        
        PID:3460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,647358537036840560,3729084007838586056,524288 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
        5⤵
        
        PID:1336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,5736037917010781947,13556835969505927091,524288 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
        5⤵
        
        PID:2328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15540610542361254670,8077474777022018920,524288 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
        5⤵
        
        PID:5284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15540610542361254670,8077474777022018920,524288 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
        5⤵
        
        PID:5856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,2596514720721658526,7386656910075730299,524288 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
        5⤵
        
        PID:4704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,11047149316088359239,6814837255644019221,524288 --field-trial-handle=2676,i,1021679880529718079,12336130512859742409,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
        5⤵
        
        PID:1812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffdabc5c188,0x7ffdabc5c194,0x7ffdabc5c1a0
        6⤵
        
        PID:6468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,18140359330930796914,14574304534961971770,262144 --field-trial-handle=2292,i,4186436675929391841,12352712504943935791,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
        6⤵
        
        PID:6684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,13732798425637533258,2618280101418590448,524288 --field-trial-handle=2292,i,4186436675929391841,12352712504943935791,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:6788
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2704,i,5051351605857846613,6802298637622162188,524288 --field-trial-handle=2292,i,4186436675929391841,12352712504943935791,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:13
        6⤵
        
        PID:6800
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,13813819242564430271,15290506374896075932,524288 --field-trial-handle=2292,i,4186436675929391841,12352712504943935791,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
        6⤵
        
        PID:7044
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,13813819242564430271,15290506374896075932,524288 --field-trial-handle=2292,i,4186436675929391841,12352712504943935791,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
        6⤵
        
        PID:7060

C:\Users\Admin\AppData\Local\FigmaAgent\figma_agent.exe
"C:\Users\Admin\AppData\Local\FigmaAgent\figma_agent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1660

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\D3DCompiler_47.dll
Size 4.5MB
SHA256 6cd30157a12466edccb0dfe7078c486bd0af1334559c6415ba47e94d8f8e547a
MD5 2132fe9d494c0e348defb1d4d8b1286b
SHA1 44804fd37e579a681657eac715c57cd03227910d
SHA512 53ed7285c1f572c11de505c0bcc889416c9fdb3b8b399256845ec9c8b919082c6d53f6864902974b790a9d87358e0d031baa36f2977ce570fa867f7a97f1ca89
SSDEEP 49152:I6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:IUdeqt737jFm5wd
TLSH
T13A268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\dxcompiler.dll
Size 24.5MB
SHA256 b60fc14fa9ef5d3cce8eaa287840d3a1c27a9a7ff17b52c406a9193b4b5c736c
MD5 5a80052b3fdb1b343f919e3280ce5cca
SHA1 890ef1082ad62652605e2f9638140c33f6ec49a0
SHA512 3270710113be5f5602917bc21a4ce3ae9223c2c01f3614959c337985474888bc3f5f088208594e0e9f62af7980cd485ff570092bd4fc6803fafbdd9d1a7ccda9
SSDEEP 196608:IKkG+l2tvb3nmgD131GYN7aPtAH+R4gQiUiV1gFould/5AmO0rL:I5G+lkvb3nV1GYIP+H1gQoV1Ioul3Al8
TLSH
T179473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\dxil.dll
Size 1.4MB
SHA256 a4d1df2dc4a7e1ca49f8877031dac1b1f3de5900cab9ccc801629ebdbbd08bc6
MD5 fdd8694d51c0334f09f9d2c1c0df0b5c
SHA1 a998d136031dcd49db0588aa5a5a74656c99d63a
SHA512 e6d14a39d69e9e0a7327214c611092de429696dedd43d90b255bae1e2c194a4df9d4d34a211de435f8e5c6e8aee695437e92e9fd98009f6678c37a6c24a02963
SSDEEP 24576:+cuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/P:+sHMPzbOxBduHdSCde8ZF1/0Wy4oV6bW
TLSH
T166656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\ffmpeg.dll
Size 2.9MB
SHA256 f3ebb0f1b3c76e0adb066b76036f665d0d2f0bc8ad7d8b54295d351b2013df6b
MD5 f9f5dad4299cf3ffec02703bd94e07ca
SHA1 7ea08fd91ce94196cae83f80c20127d30932bf5c
SHA512 9efd4d5f6c14906c9fd000fa98b95e82d8ed1b90fa85cda0d550fc946acaa88815ccd8e5f034691680f4199a354f7d1074e93dde4d914d04a50f56b0e3299812
SSDEEP 49152:Rv3nwJt5w3heAaTPLO6lNU81IQbx6i1N2fgPvA7lPUaLu2JiaoosxpSS3:Ry5yfa3O6l5PaLu2hoUm
TLSH
T144E5AE03F6D251EDD029C03497ABA213F271780A4F205AEF17A05A253F66FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\libegl.dll
Size 477KB
SHA256 7f25a7f911a21ab30262b278a445af14c6a969d37141bc9e706d7fc6f65fd69e
MD5 20be9c59284f07fc8c7ebfa92f15f31a
SHA1 89b7664ef86eda4ed80bf16933b12b76f962be37
SHA512 dc498c47678e21d0908ca8f79d60c980e3861936ea408656090d631081bafdcc84a994d9906a029006c062047ea352736d72a6fbc2ca918ad2a06f7b4880684e
SSDEEP 12288:i6/vCrog5QZ9yJNe8DcQir3YB9ANZMBgM:i6/vCrovjLA94MmM
TLSH
T196A48D15B3E948A9E07BC1388A538643EB71B4460B61F6DF02A0D2793F77BE45A7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\libglesv2.dll
Size 7.6MB
SHA256 e0412e1d882b3c2b2b48b325280d2ee85853fdaa3584da5ea13e2e384db9b908
MD5 d811dc3432f6805e52ebf7c15bf0adc4
SHA1 7dfda44a350c51884879b6b3de3f6e96b39bb487
SHA512 686d05cf0a3fc4ad64eca5e9b72fe934d1e04d24f3b9f172e38b6f4cc33ba568561265a30dbf6e51837e83d8bf3dfe151cfdbba6f3a61368f49fdf36394c681d
SSDEEP 98304:P28+0qrgWEefZGd0Txn5XUTMSEyGEEEEV:d+0qcYfLctrA
TLSH
T185866B03F69681D9C05DD278876BA223FA30B8550724B6CF2AA457152F6AFF0EB3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\resources.pak
Size 6.6MB
SHA256 70d973f4b90bce28ae9d2f69c953979bdf26a29298d21f5ec13143a2e7dc96fb
MD5 b06586e10866be98dc50b24c2fc638f6
SHA1 3b14411c8e23c6a28f00bb95c5829ba59eb53d78
SHA512 a922b1e137a102a8c649e20844b1c6e490f6f3ac151cad72879010641dcf33f8f9f9a62dd8ebd18b746e40d994629c8094454f6b03809ca5aba4cba161436a4e
SSDEEP 196608:ZuBRYyfmdDTz9u4bkriACmZnC3gEL34tVrW:ITlO/zlkrDntEoVrW
TLSH
T11B6633D277E2A80FCD90677A85448F35599C6F2532E0B1A3888C6215ED9DF6C0AC4F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

figma_agent.exe

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\resources\FigmaAgent\figma_agent.exe
Size 9.9MB
SHA256 99b61631e7d1e0f7878ed82e9e5e29e1efc278083eb65a3255d05b9095e8f8cf
MD5 adc69d42234e426cbb553a5149cc433b
SHA1 fd9bb1c4662f4b409e91f985bd8b2a538dcfb64d
SHA512 d6ef26d98c5662357762b90f019603ce4b6d0cc477c925018be30103e3b24e650a37f14482f57aca1338a948acc496ca097449d0e17e2c082c24f2ba30fad241
SSDEEP 98304:H3YAMSccqRE6Rt5Lhs0AEm+CR4qYEIWr1Xq7+XFejOCjPdZkTq++LCdQbr:HDcch67J5CiqYWlSsepl2Tq+0/
TLSH
T168A65B02FEC291FEC98F02B0A00D93394A7F991453158DE7DE87ADB85BA63D11D3662D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\resources\app.asar
Size 9.2MB
SHA256 69aeae11b6fb49666420c7d55232e361a6bf0af202f3d105aa791ca39bee730b
MD5 eb0bb137c5e59acac2151ebee4e89181
SHA1 833d56674f512add377c5a38f2b85cc6d143eb27
SHA512 af2654313c01b7d35662b0831b4f841a19841fabe1bbf15e8577a699e97cc4de6570eb5b97b38e8474792d4b5e8c140a0cfdf266653968844d4607c3a1a31be7
SSDEEP 49152:k5vZaT6s5AzsAERrdvYxQcrrccxHOukFGInzjwp6NJelt4Gpj7dHNVJ2vLyfLUtv:k5cjhMgjwAJeb4YjlNrmihs
TLSH
T19EA66BA4B9916976DF76D1FDC83A8202F2E81E1AD448C427F7E8D4D962F848540BBF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bindings.node

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\resources\app.asar.unpacked\bindings.node
Size 220KB
SHA256 98e627626bb01b35c95de8956c8ef9791a20042499b8b118c19b81a32c45bdf3
MD5 db4f0931b7865b1493214b3f9463b0a7
SHA1 d692f4e8cee524b16f40147b7b927dc1a330352f
SHA512 fb7531f289d45daf078ab51cb388b327c67ebce9a762e75bb3dcc7bd756fc9b1c358c2e8ba9895377caa8b88d450c5aff4c0e589300077a7e352713e2ad2314c
SSDEEP 6144:rJRKcYfumZmRO/b5AdhAfnyhwIPDdniMMs:1WKdhsHI7pMs
TLSH
T162248E19B3A404F9EDB782748E939912E672780507B0D6DF03A047789F3B7D1993EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_rust.node

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\resources\app.asar.unpacked\desktop_rust.node
Size 2.2MB
SHA256 912f1a3dc2c2772eb25d6384b64e16f998790445c0fc44db3b69c99104cad981
MD5 67a205e592bf70f4a628224f64743821
SHA1 73243666988979d8b5af725daad4e5066d01d68d
SHA512 0aabcccc8eb32100cd293426f91eac256a8ff3ef2bfd4607c3a0b8081dd7ebaaa5760aaace0c54606108fb8afd3b1b4461e33812d566fad3ab8e9736f80a8e7d
SSDEEP 24576:8RwAin5IXkE1zXrsKOKOGhLTCAkuZS9V7BI2OBbTX+5tGd8GLEhO8waNZjTnAhP4:zPQYbKOyCA2X99OB3CPhiarTe4
TLSH
T1CEB58C12B65A14ACD16BC034C2978A67E771748A0B21BAEF15D446B92F37EF12F3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\squirrel.exe
Size 2.2MB
SHA256 8e6ae2cd8ef5453a764d6408b0079deca0c2448b77c7e09795b4a9ff936b6447
MD5 a09963413be0e92ec2fee356f957daab
SHA1 a14f644bb1f1f0e1874fcc9b78828ee2f7d33cc4
SHA512 a5ed79ab846d73a49dabc033107e96369cbdc412994d06343a9e1780d3e049cefc25bac4da13977c9faa8398f0bcaf79f14c2913ebf1c20124712776270c2ea5
SSDEEP 24576:WWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m3OP:3t3UCiag6CKM2zCyZuOjJaxSS5qhH
TLSH
T136B51912EFD8CA2FE59E2BF5902C09A443BFEC856261E74BEE4B79652B837404D01357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Figma\app-126.6.12\v8_context_snapshot.bin
Size 704KB
SHA256 df9460b22168f0cadd582ab07da1bf72c640b1955fb2aadaaa6c652a92b5780c
MD5 868af70424ae1d846583ca63cc5af54e
SHA1 c9d89ceeb93e65e7cbd654ba42e4233d6afc039b
SHA512 0aedbbeaa283a62a45c4831648fada3b748831da7b067d68092c7a9a42ec91ed2a544dd0a2557273dc90845624769ab14322db32fad531e0f1861e496d438b6c
SSDEEP 12288:c15XrgAJ8ph2NdOeP8POqYUdEMH+jURWYS:c1pqP4H8POqYkEMH+AtS
TLSH
T1D5E49676FB0ACA26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ad521761c2a4a57d12b6b4f6c05b4c0afd8cf9a5e16500ce20a6aa485489a03
MD5 4d76127fd33feb31a9e49ee2b8800598
SHA1 948622838f9c8c13dd9f160f195785be0988ed01
SHA512 4eb103c9be8d6079b2a15681b595e75864fe59afc3ae7ab7f68d4f843a588a95236ea50b161a4cff6a804062757a2cd2d2def165afb754be1320ddcdfa5cd032
TLSH
T15ED02324BF25FDD7C734147B94304B00757555737D574107E524444C8C754C26B876E6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e9eceb5cc4bcc9773dc4920c030963a4771811c48ca4faf24c0bf5cd8d4c9a6
MD5 44fded65e8f23a4e3f0101fc94fba54b
SHA1 07bd2d65cf25db8a9e13cc0d68f444f0edfcfb81
SHA512 20e8353b964c4d39bf2d4d2de5bcaba0b4f428daa14e2e026909f2990aaab0f2b6c3c0ed67c97833c57360ba1b2f8ff0ac1d21c3b1532b7478f9e2de1ce52df9
TLSH
T173D02274BF28FC47CB173872A420CB117BE2A6A1BD5AD423D130444C9C356D22A8F1EA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000038
Size 29KB
SHA256 101a06f25091a25f2db0b4ad730865cd540bf62cf65414ac92b53451c954d7f7
MD5 c41a75b293bd2208ce138130dd73749e
SHA1 22df7e5272aecc3c0162a1710ac1c74b1e30119c
SHA512 d89d5612ed9323af84d9d446e0a4476ca37b03f136a8d0e18f9322ecd77007729beab667ff0c6d9f478ccd21a7cbec39f35b538314a235a9a2e0ee216e4f6b55
SSDEEP 768:1j8E01icIZFn6axqlzSBpI+lpVkcsRPx4BPGL99nqUA0:1EIFCqCypIPilLUX
TLSH
T1F4D2F1D3443EED09D928D242C1AE7E0138B75C8F9909A91D2E28D4A950DBDD9913E3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5e34ccade1842e0bc7ffc4772225b422c7367faee328757e6c2921f3472e53b4
MD5 517a23b7b9fdc01ddcec3e24e5abdc7d
SHA1 a44577cf1743fd46d0ab32ca7ec644358dfda405
SHA512 7b9696c9cc1693b1faec05b6de997a15e1a9bdead2d9a38d0d1d7bca90e04869ca98e7030306d12bd07fd274bc70caa8418c5fc3a3e8d2c85df386fa8268f8ab
TLSH
T1BE517210037E17F1C3648D3764E3F296FAF4C3C9C54B6E2E2A52B0B51A86788048102F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.figma.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7ffced56a2259448a31b408d14864073c3a0bf23be997bd44c7383c0fae86044
MD5 a78da9a3bf27dfc2e36198c88ac00983
SHA1 28060964a3e324776783b8a5aa5879d768dedbb8
SHA512 9cd5780325ef414d538455d2dc21dd4d1e2146bb9f3181e29261e12f534dd5cde438352ced1d259608317eaab93c83740d812396d80b62e3112669f5bdca39a8
TLSH
T10D61ACF383F5862E891196F4EA14AF2FCE1D0555832C7D6A89E4AE1B93E2471E101E4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9230b0b250fa38bd65239edef48f755e37c6a75d1c4035590870b93be3b93aa2
MD5 11c8b1619ad88a7659e13ba98e5c57eb
SHA1 4c570c965d3628df897836048defb9520af2fe70
SHA512 b9972b15e680de39029abcca56e4223595b4b38b445329de50ee24cca8f15b9a941260fd54c89393d672c66acd6f096f9e665a45b3396a91ddb5f166dccd86a9
SSDEEP 192:sxRoR4yM/jK1Ml8tCS/f/sXWpVhQ3nIZ7dgyzoA8pJg/g6+WNxuPn/YHDtRg+Ig3:sxRo+dS/f/sXWvh42Jg/S/5E/Ct3
TLSH
T14B62C8156A34997BDCDBD20CFA557F53D6F91563A2901E48AAFC9B0C00E76EC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8530cda07728c2da2c7e03320cd6e6d3103297e5fa8e0c4b9a23974ab2160740
MD5 b280fbc7be910efbc380274157084bc0
SHA1 49cba24fbb873540823c067f32e2df541b7c8427
SHA512 c167a3bcaf2227d55b9d7a434b178eaa95f0612a6898796b67ee49d616c7195a15b4955763b7d81deb3c7cc1323fa2753b7c8bfca6259137e1a40d4f2ab1943d
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVik3XguYroMGnBh:Jl6hhQE7b2WgqcfHwu1jaVk3QujMGP
TLSH
T10CE2EB3B780CCB7E4F804A9CEC29799A6DE801CB96D8CD5447FA894C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 77629feb8109b7e3ec19e6a7510c06eaf67a349b4d19ff68d68471c9d106e39b
MD5 1d8e8a936bcb9da4bfec992bd07a2c66
SHA1 02ebd9c6a6c3e1335328cfb432a9845da17e1587
SHA512 ea13bf2ed997a953deb0b34a1f85dd62ce822fd0a4b1d2dc78d5782475bd239fe7a321eb3dd8bcb65383c9c102f963dd19915042c4892fe32e3bff722bf8be2e
SSDEEP 96:KRQh0gS+yoW2r7gooK4tgaocII7aglHdqjXNn7vWj4mgfvK4+gBvcldQzLOjyuIK:CQh0gS+y/2rEostgaHII7aglHdqjXNnU
TLSH
T1C591C84832370381787D644D81D88DABEAC2756B3105792B37A806E35F67E429DFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada8600c-df7f-4399-8af3-1ffeb4b72d57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ada8600c-df7f-4399-8af3-1ffeb4b72d57.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d875ef9c-a7c6-429a-86ef-72b120a60fb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d875ef9c-a7c6-429a-86ef-72b120a60fb5.tmp
Size 414B
SHA256 023bc38b259af875f78ad7abbd26eae6204d9a6a35806497dd6fbcf53c0a5c58
MD5 79d248d7c653c1c0c8a0027a61ee5cb9
SHA1 fcf6b63990fd70c62cf72b378b5296ccc62ddfcf
SHA512 a24460845088a5e57fedef35c8b26aeb73a5f1c6ec5c4485809e4f74e26173bb1f5fb9ba3b00600173679470eadfa415b7bc44887808b75fda2a84948905ebae
TLSH
T1D0E02BAACD21EC3B58FD571855404787F751132717C0581B3B3D420CCFB1A3A4185C2C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 e54ca70c8d50c06e967597c18dab9d55da8a9444daa45eabe1323dbb7be9a352
MD5 4fa6c39a4d35dbfb0320744dcd2f438c
SHA1 6afcc4aefd17981dc8aa6386d9c5a2b48abf21bb
SHA512 9320a6d75eea9017ed75cebdfd9a51d46bb60c277a11f7ff9d2dc195197cd78f63f6e3c91b883bc779fc06415d6850e20723fbfd77f4ec25929fb57275c0d349
SSDEEP 3:MsEllllkEthXllkl2zEflWE:/M/xT02zZE
TLSH
T1164404447FD00545C50014314051C374137CFC11CD1177C334D11D337CC75410D00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bbca9fb45b53b3601956eaf96bb882e75fcb94addba1948587a3fc622d3493e7
MD5 360d295200b0a847af04b9862b952ab9
SHA1 6280dc765823a6de5180ddd1603efacb25972b9e
SHA512 28bcad263447dd6f85bc4f988c448e682dc65826aeae77e914edb616ea067a962cebc6e0f5c41e24e3dbb2fd86a4f4efed89777644e799c7998dd2533ce20c58
SSDEEP 768:Vrv+4UNbda3d6YreNSLfHfZtCX7DGFzoqPcNMCNZBeVH1SkM:Vbsb433pfHfG3WkqPaHEH1Y
TLSH
T17B03BFB6A8A455374CF3C6C9B75B36076FF0016746840B94D8EE2F0E839F5AD130BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5750b1c93403bdea93bb5ec981980becb4363b3817f25ed618e411d34487a257
MD5 12c77892c8706535c149e915a990bef4
SHA1 b7999442b59724aefc084277707701253e8a7f09
SHA512 f367bc0f01fc93eb90b758099adb6c0d6d89b8806715a7abab956da77017bda4a4b8273bffbd8954c67ff5a02c42de50d22687420b09387000a5223a533fb7f6
SSDEEP 768:Bj+9M3t6YreNSLfHfZtG2X7DGFzoqPcNMCNF4b9M6:c9M3rpfHfq23WkqPaib+6
TLSH
T198F2BFB4AC654D274CE3C288B71B3A9BAFF0156745841F48D9ED6F0E468B2AD070B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2d47d64-fa4f-4b56-999e-11f5e33feb7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e2d47d64-fa4f-4b56-999e-11f5e33feb7c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 79B
SHA256 cc3d4f3803ee3fa93dc9f56c0cfe3e2c7598398ee5af0fdc2d8c7c9408d3432d
MD5 9a392f302b3d8cd6a52ac420cf4c9bcd
SHA1 555ee3676f09c59681960cc72c2d434abe1efb48
SHA512 85636bd7d697f2e4538ddfcff5c9d149e084b3b0045feae46dc315e81e2793f46687dff6be13524126a20d48f42e9af0f33d6b64a7cab70776957fa46be1cf04
TLSH
T1ACA012AE4D1A51D9848A21440E1400035A210031400461C9B6CC19444C9940148004C8
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 55cc4b250b17bc1c943fac87f7befd2c3fba09605bc1574e81daffd13c8a2121
MD5 72848159a1abe9f5302d3d11ab6570e1
SHA1 b3648c804f82803c627ad5a73e59299bb9e781bc
SHA512 6d89f32745dafeefd5c3436a34a3c10286cdc64e9445dde7e5d6cc156d12b037d975566b2cb8c60bdb1a526332d09f8a86b3570fd200a0784e3fc171d9c12672
SSDEEP 24576:eWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2y:vt3UCiag6CKM2zCyZuOjJaxSS5qh6
TLSH
T174956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 3KB
SHA256 cc9087cbd7825348b5df6407af99ba92a8dc068f5a935e59ead53cc093caace8
MD5 663c9cc026fbd0c4707ff4ea3ac499e0
SHA1 13b9f6e78498e35a6166ca2fd471a406eb01d4d5
SHA512 60fb59bc8c6a0d957780aa767eddbd2019d3b06de11c2110e2c3eb5d807cccafc976f173b03da5168738f23581b49a8dc5b722a69307c350f5f48127b8ffc1f2
TLSH
T1A3610D667335C59DF040C130BD823D05B736B7B0C5A3829691FA34169671E929DB821B
MD5 SHA1 SHA512 TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 352KB
SHA256 21c7d8d090cbfa290fd42e29b8fca80fb34b86ed4c673d1875dd7c782660b014
MD5 fb85e94ab2e61895a74c8ff71001fff7
SHA1 04f7d10eaa183e969ddeaa847ca005a052b13811
SHA512 d157380552b318f3c4290ec42505e842286dda9a0262ef27a1615530d3ac448f3cb617e9a6a8233099821d5f2109985d1db150ffd5df691d9aa5e98aa7a555bb
SSDEEP 192:TGuHbklGslU/JWDKCxbC9Sn0V01chyxcL6ScGmrQuQOWp7tge/AfhGHAcQlS3CzK:wlL1iectChxQ5ozJAGj/Bo9b
TLSH
T170745762DFEED62EBBDC6FFC065C4FA680AEED2111166641CDAB3E5593274C1240620F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1092_1256210911\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65c0cd53-58d4-4a54-ad04-70796bb3d812.tmp

Path C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42\Code Cache\js\index-dir\65c0cd53-58d4-4a54-ad04-70796bb3d812.tmp
Size 48B
SHA256 383c44b6ea2203437ede6bf1c2d13bc5ade885b65fe76fed9594b3ad0a591dea
MD5 dae3f2609c6e5a3a3e5277f56a83d246
SHA1 c5375c3a22a97cc671e5328ae368ac6e784f11e4
SHA512 a368cd94393b5dd9ded698670e6e69e244da02c6cdf7e59c388d10f83cec9eda344ffab57d206e84f2d22aa8a14644dae2920c99233e507f862266a38fa3ea08
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 ac6d6034a7f2f1bd4691f183eb6320f43b6fa0426829883e3fb2abff5d633de8
MD5 b494245484c9426bdfd6d34d2009bbf8
SHA1 0a0af2f4c663de4a42a122fe91c8a9b0aa09b372
SHA512 8fd8a54734ef4c773caf7e5cfadba69f81f4f333e6a898c5bde09c1dd78c6760130ba9f41e9f3986a463afb22fbb9e139a4df74e830586f1495e269ab826594f
TLSH
T176C04C20F78656C1C3944E324CC61F6C3278081E12177C617A5AF5396591F69F9C21B5
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

57b75e3f-4b87-4241-b01b-ad9f8f488751.tmp

Path C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42\Network\57b75e3f-4b87-4241-b01b-ad9f8f488751.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42\Network\Network Persistent State
Size 1KB
SHA256 d26b0835249479e2fe11eeb73e75fe0526fb4a2ce9587b22dccb3b5002baea11
MD5 618d4efe26ebdbff8690ba284c0856b1
SHA1 7de08460965e61496ee06b5be1474cba5b6e49fa
SHA512 901836ef3960342a80c70185ab61b517300a604cd88b676c42a681ef6219950dfa65b8fef69a0108af38d029d34b22ef2ad987fec3c839cd48942d01d597d194
TLSH
T1692165E7CBF9057E8A2293F95F293E23C4BE2918436C3C4688C9AF4E53E14755A0058E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Figma\DesktopProfile\v42\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

settings.json.temp

Path C:\Users\Admin\AppData\Roaming\Figma\settings.json.temp
Size 13KB
SHA256 39bfa6d72a1675aad772d11ec0794fa18185dba466b993b76b129414258523a5
MD5 07bace82637431324dfd4d9fbbf79081
SHA1 19806a2052fd747a9786e0e7cf0163641811e18a
SHA512 ce5a110c7e98ec9b987f9d2b0d8e9517a01ec06d1a09cb9b9ccf85a5260dc0349902776ec44a8262ff3ec9ca4ad40f6d57b140fafc995c558fa46d50773e8f10
SSDEEP 384:q6U9UoJolpoGo8oio2PotonoJo2oaJyvAQyvnhJyvQNF8yvFNFrJyvt4yvAFJyvs:U9IwJuYJ3NK+NVJ3JJwZJDXJ7lJv+JS4
TLSH
T11452E524504A5AB64DD6E3DB4AFDA6911EAD206CE3CC4401FDF9CFD3D2CEE1B6402989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1540-186-0x00007FFDCC960000-0x00007FFDCC961000-memory.dmp

Download

memory/1540-187-0x00007FFDCD710000-0x00007FFDCD711000-memory.dmp

Download

memory/4432-103-0x0000000000A60000-0x0000000000C8E000-memory.dmp

Download

memory/4736-110-0x000000001C3D0000-0x000000001C3DE000-memory.dmp

Download

memory/4736-10-0x0000000000CA0000-0x0000000000E76000-memory.dmp

Download

memory/4736-160-0x000000001D390000-0x000000001D3B0000-memory.dmp

Download

memory/4736-109-0x0000000021D00000-0x0000000021D3E000-memory.dmp

Download