hxxps://cdn[.]discordapp[.]com/attachments/1536107774486904932/1536108142302072862/Christmas[.]zip?ex=6a7a33b0&is=6a78e230&hm=93e26fb4ae22304cfaf62948b903e6a57a69d3db49a47fe5c56da5413df90fc5&

Analysis

user interaction
yes
max time kernel
76s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1536107774486904932/1536108142302072862/Christmas.zip?ex=6a7a33b0&is=6a78e230&hm=93e26fb4ae22304cfaf62948b903e6a57a69d3db49a47fe5c56da5413df90fc5&
Sample260809-y72b2acd28

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
872	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307807935873480"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{38879DF5-39C5-476A-ABC9-ADE60BC595E1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2392	mspaint.exe
2392	mspaint.exe
4372	mspaint.exe
4372	mspaint.exe
4080	mspaint.exe
4080	mspaint.exe
3132	mspaint.exe
3132	mspaint.exe
4204	mspaint.exe
4204	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1480	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	3732	svchost.exe
Token: SeRestorePrivilege	3732	svchost.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2392	mspaint.exe
1480	OpenWith.exe
4372	mspaint.exe
2316	OpenWith.exe
4080	mspaint.exe
1956	OpenWith.exe
3132	mspaint.exe
4892	OpenWith.exe
4204	mspaint.exe
4204	mspaint.exe
4204	mspaint.exe
4204	mspaint.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4248	4600	msedge.exe	84
PID 4600 wrote to memory of 3092	4600	msedge.exe	85
PID 4600 wrote to memory of 872	4600	msedge.exe	86
PID 4600 wrote to memory of 3092	4600	msedge.exe	85
PID 4600 wrote to memory of 3092	4600	msedge.exe	85
PID 4600 wrote to memory of 4412	4600	msedge.exe	87
PID 4600 wrote to memory of 4412	4600	msedge.exe	87
PID 4600 wrote to memory of 4060	4600	msedge.exe	88
PID 4600 wrote to memory of 4060	4600	msedge.exe	88
PID 4600 wrote to memory of 4060	4600	msedge.exe	88
PID 4600 wrote to memory of 3232	4600	msedge.exe	89
PID 4600 wrote to memory of 3232	4600	msedge.exe	89
PID 4600 wrote to memory of 3232	4600	msedge.exe	89
PID 4600 wrote to memory of 4460	4600	msedge.exe	91
PID 4600 wrote to memory of 1100	4600	msedge.exe	92
PID 4600 wrote to memory of 4460	4600	msedge.exe	91
PID 4600 wrote to memory of 4460	4600	msedge.exe	91
PID 4600 wrote to memory of 1100	4600	msedge.exe	92
PID 4600 wrote to memory of 1100	4600	msedge.exe	92
PID 4600 wrote to memory of 3928	4600	msedge.exe	95
PID 4600 wrote to memory of 5052	4600	msedge.exe	96
PID 4600 wrote to memory of 3928	4600	msedge.exe	95
PID 4600 wrote to memory of 5052	4600	msedge.exe	96
PID 4600 wrote to memory of 2808	4600	msedge.exe	98
PID 4600 wrote to memory of 2808	4600	msedge.exe	98
PID 4600 wrote to memory of 3760	4600	msedge.exe	99
PID 4600 wrote to memory of 3760	4600	msedge.exe	99
PID 4600 wrote to memory of 3760	4600	msedge.exe	99
PID 4600 wrote to memory of 4404	4600	msedge.exe	100
PID 4600 wrote to memory of 4384	4600	msedge.exe	102
PID 4600 wrote to memory of 3924	4600	msedge.exe	112
PID 4600 wrote to memory of 2480	4600	msedge.exe	113
PID 4600 wrote to memory of 2312	4600	msedge.exe	114
PID 3732 wrote to memory of 4444	3732	svchost.exe	122
PID 4600 wrote to memory of 748	4600	msedge.exe	133
PID 4600 wrote to memory of 748	4600	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1536107774486904932/1536108142302072862/Christmas.zip?ex=6a7a33b0&is=6a78e230&hm=93e26fb4ae22304cfaf62948b903e6a57a69d3db49a47fe5c56da5413df90fc5&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffa9aebc188,0x7ffa9aebc194,0x7ffa9aebc1a0
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,4312133555366777622,7856754621168186264,262144 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,1578145424392295085,16888797197597403400,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,3706283418415532237,8288414216785177514,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,16357860148404259287,14595640089650416472,2097152 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3295925516936498541,10082981544687242498,2097152 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,15410596980258255523,6172129860442229553,2097152 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,459792742878270130,3177548045739911991,2097152 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,3196900495428781190,7421803650981692798,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,1912992664678114271,15323039241852529465,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,9530169250123987197,14840028970684405837,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5692,i,4339602007465551499,11827072225708468577,2097152 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,11806553548913239390,8243882044729510545,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8327209076701158547,14901529089486001325,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8327209076701158547,14901529089486001325,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,3516344829089493380,6258634270711974820,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,9923439649925407292,16977202108292795073,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,15761079239208220830,2212112751954968332,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,8394453771215480741,8392454995500764794,524288 --field-trial-handle=2280,i,12312665634379970666,15880666294016140559,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3260

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4160

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Christmas.zip\Christmas.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1480

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Christmas\Christmas.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2316

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Christmas\Christmas.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\system32\dashost.exe
  dashost.exe {384b9bdb-b1d8-4201-b6936fc043f3a9a1}
  2⤵
  PID:4444

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Christmas\Christmas.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4892

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Christmas\Christmas.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6bbe63d16f75104009a1f6c4deb586e25f16d8cbe5db41d456bc3a6a4e83a0c2
MD5 335dbb88a1448c597f43b78eb215c8d1
SHA1 782fb1264e2a7f413c24071ab80027e2e8785f0c
SHA512 0fde3d7a71a2e76fa38e3466de17faaeda10ce8f74a9dbc53f3713cf60f6b730f280694cc46196535175d0e724a94ee5c91f4250cfe53063c58cf8afa80be1f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7f:fwUQC5VwBIiElEd2K57P7f
TLSH
T186B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c675a31a0e847472a5a5e3067826cc3694393987d9daa3f3048684ccac21b991
MD5 e98f5c0836a2f7eefdd0b695ff7b6bec
SHA1 fdd0144a8174f9f9b873f1515931a0f2646aed2e
SHA512 ae31fd3731e1e6fae4014359d830e9abf09ed8a2081b6e543619320ff8cdc09aa7a0da91b86447aace341d597c8f9511e41e809f34367c53eac78ac29a7eae50
TLSH
T12A613B32E243C8F0EFF7003284D1C22174B667D5FD8BCE962DAE5AB8164D3E18E94518
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9ea6d424d5fbe27004440b5b6b06c87b8303026de9f044b934b9b70459f56a4a
MD5 f927f4b49ad71b3ee9feb2db5e1cee12
SHA1 c5c50d9209c83a09e183248a580e6f2d30f52e8b
SHA512 cda021558854040493e775e27d0f7bcc9369e341f3dc1373c4ab2a429bd2ee1da60f1b85b162c5113c364fc44191bb2f717c7ff232355fb6819c3e85779f4992
TLSH
T156215CF3C3D5866EC90516F06A14AE2BCE2D065543297C2AC9E4EF6BD7E3472E10294F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b75261b543a363fddef0ef314fef708e85be301917df9b02d2709909088baf28
MD5 f07a884c22a65b03ee933cedfd961954
SHA1 2f42c5135bd34a4fe73897d38c23e13c9a817e00
SHA512 3de2c77b522832f44e9872a22038bc158fc21df071edfe3ef88c02728ea47642d05eebde24018ff598a811a378e9d5e93fc5c7efe16f7a256cc1f82383ef6b97
SSDEEP 192:sxZtRIyM/jK1Ml8M9V/f0swbj6V3IdpJHW6+WNGYvxzRvsAQIgrJ:sxZtq1V/f0soj5JHbGqkAs9
TLSH
T18442E7116B34A97BCCDBD20DFA55BF53D6F91422A2900E44A9FCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 32223b7f166fa484770a0afec113e4924c6b43989f1e379331b8bb31e052c542
MD5 7e56a7d6109ea0bcaa008f3f332566b7
SHA1 090f4dc26241c58c2cc6497f160b7889385fadd8
SHA512 50e241295083172c366b56051f1a0fa37194907d38da67f650fb34e66e1e1af20aaf7a2b5c9e5ed9cc35c21298d519eb0cf411bf0bb5e22f80d3dc5dee3cdcc5
SSDEEP 768:0useJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppzro0t:0useJ3xWvhfynu1jaVcL88pA6
TLSH
T1B7D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4467a30c7d23e356856c567e190e2e3c0ef8e4ae39521392a704bd5349dda113
MD5 02cb966c2fb45485af691fb4ba0a6eb1
SHA1 17973b53ea6c5dc1b2028f1edf002725f15c1d5e
SHA512 9ef55a73d71cf8d8e027cffbd9291b014cc93d75f6dcc3a05f2d39627cb5d163bb7471017d7a729bb2b6ae905e2ac7b1e14c798cf6fadafa0fb86430eabb7aac
SSDEEP 48:KYHIhKggkXypQIzKpisnypvKLfhVpk5V0PI0nkKDBrJkX/0aUhfz:KYH+KggmKQIKpieqcAKN22z
TLSH
T198919712313B074278BD2458B6A695379E413B63345479AF7BB840628F27E622EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590b41.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590b41.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c0bcb451524af9de62b5606b1a7804068f22f46e3306d38e984b3cb41ff86a13
MD5 16e149fbd8484df1582eaa259f7bea55
SHA1 ba8b97bd940ab7f1b02dbb8958a7db4518575f22
SHA512 55a9e7bebaa05bd54747c940d81f27b9c46728e319a8d2e805d59cc64d52358cd5d962d8acefecb778f714ea3c4cdd9a2ec5330323a2c37d4e14aa521ceacdd5
SSDEEP 192:uBd+xasuheOwQxMYsN7YBqQDDFwGM7C1HQmiU10Z0V84MTA++FdLCgFd3Eh8z1r/:WZcIPsN7/oxw77mpbTNdtdUGty2r
TLSH
T192726B725C789C3BA9F7B245F48A36135FF4912B96C81F90E6ED7B0C01D66A80316C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8fefea432e71e32f8f02b1ed3eab34ced7764938aa76447d2e8d25fa96c69a8f
MD5 c5a38e572657a33b99dfe3d43d6052f9
SHA1 ff1c0d41ba171190233fdb498f89f1a3b01e7adc
SHA512 2b491e31e46b62d826051092832409ecafc530c5534f3ca8ce5836007ad2dac68b645b3ad05eedfefa2efdcf34ff70b83d5da1045b2e9a0eee80865e56e5b8e1
SSDEEP 192:lONF6vMtPQmiUy0I0pThTA++FdLR847u4U/u:lONF6UtRTT+dVzU/u
TLSH
T138020835AC786C7BAAB7AE49F48A37175FE4216BA5D05B50EAE82F1C00D765C1303C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0cc25e940cc83c0a7a7327430849787b2f678f6cb0fb30d859cd17f5030e9be9
MD5 f672c69817a975300f54ddb64ad5fb95
SHA1 b58f37fbe8a06453699889483135d123e90b7319
SHA512 bbec23b085ce75407d695d03a7091301a4365b5860aecc7630ab15330993373f52302e7ae203f942c8d2794545ff5d0557a3ec981ae7961f067197ee3358bcd0
SSDEEP 384:SiFxZcIBpsNF8TUNTUlIluoxw77mpbTNdtdUOty2r:ZFZ/kwgRxw7g5BUOty2r
TLSH
T1B5823A734CA8993FAEB6AA45F54A32139FF49167C5C4AAA0E7DDAF0C01972980307C55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 3043f7eb2006c0c3bcdc073449c187f2f6a039871147f7e0b140f675bdb39b3c
MD5 01ec9f7c7f7d4c72fb12c513a76ec21b
SHA1 899d2bf72b18cd57da3f0ed95ee5f88a81957aa9
SHA512 0ea333a495ea4ae68f3280602b7cfb8e11d446b7c13b4ef9a95de6f7bdc84192602176cae4663edfe5ffd3bb80eac6522599c0c00aa69ee159cc63f52778d2b5
SSDEEP 192:6ON+6vMnPQmiUy080pBhTA++FdLCgFd3EX80Irq+U/u:6ON+6UnRvB+dtdUItU/u
TLSH
T145121B32AC689C2BAEA3B545F48B36135EB0926BDAC46F90E6DD3F1C01DB65C1307C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 38a43bfa9d9fdc3cceb38ea9377a4679c6c2c995367e646b65a2d74bd597ab52
MD5 5e221557d7560b20bdb0b9edd48853fe
SHA1 353ba84fd48929d5a765285117dc321f7b7b3c70
SHA512 ae21a36d04faa592de49eba78a8fe4f38797e84f8386ea643139319e2628cc19aa7257748a5133c5834069e5cf0470add96453f9617325014821d5e056290b5e
SSDEEP 192:uFd+xasuheOwQxMYsN7YEqQDDFwGM7C1HQmiU10Z0V84MTA++FdLCgFd3Eh8z1r/:qZcIPsN7uoxw77mpbTNdtdUGty2r
TLSH
T112726B725C789C3BA9F7B245F48A36135FF4912B96C81F90E6EDBB0C01D66A80317C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b474cc93e7b8fad7643347fca1dc3755cfee522bce21157d14a3a247d575eff0
MD5 895afdb044aec2900d7d397bef0f5bee
SHA1 c482cdd8e79a35161f36d6fb15c9390a386a8b6d
SHA512 356396026e0ae4b26e10edae92846896f454870aab7409a92a6322a55fa2e0539ae117e55047f3b8fd069a6ad02a25180a0ee391c6080cace2ef107356162092
TLSH
T17E412858A6F91148B3B76F5AAFF6A86D487EB8732E06C89D00110E4F0A62A40DD71737
MD5 SHA1 SHA512 TLSH

Submit Download

Christmas.zip.crdownload

Path C:\Users\Admin\Downloads\Christmas.zip.crdownload
Size 88KB
SHA256 87009b97a0b7aaa111abfcffff61a6d096dec93d9b3341a6542342999b828213
MD5 cf8586476186a8c7beb271194338dd70
SHA1 12a2121ddac6f0b4dbfa8dd96d49a1c55eaa5d35
SHA512 67d4a90d971fd8396bb17c293db05d9afe2d301b708cece1785a734949daf0bf16848101c5bf0b52b48c70713de90c4b9fbc2c4df163708ef881267e336efb54
SSDEEP 1536:nXs9QnkvK/uFlbraEi6H/FSOyLLMTOjf2ojsEJJ9mNnEW:nc9QgMuHnaN6HByLImrl39Wn
TLSH
T1DA930209D74722F83A2C98548CCD4A5E7EC3E06899F4F0E4672790B58D4AF66CE71363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-206-0x00000203BF8B0000-0x00000203BF8B1000-memory.dmp

Download

memory/808-214-0x00000203BF9D0000-0x00000203BF9D1000-memory.dmp

Download

memory/808-213-0x00000203BF9D0000-0x00000203BF9D1000-memory.dmp

Download

memory/808-212-0x00000203BF9C0000-0x00000203BF9C1000-memory.dmp

Download

memory/808-211-0x00000203BF9C0000-0x00000203BF9C1000-memory.dmp

Download

memory/808-210-0x00000203BF930000-0x00000203BF931000-memory.dmp

Download

memory/808-208-0x00000203BF930000-0x00000203BF931000-memory.dmp

Download

memory/808-199-0x00000203AED60000-0x00000203AED70000-memory.dmp

Download

memory/808-195-0x00000203AE5C0000-0x00000203AE5D0000-memory.dmp

Download

memory/2392-216-0x0000022650D80000-0x00000226514D7000-memory.dmp

Download

memory/3132-258-0x0000018FC54B0000-0x0000018FC5C07000-memory.dmp

Download

memory/4080-231-0x000001AE29D30000-0x000001AE2A487000-memory.dmp

Download

memory/4372-230-0x0000017661780000-0x0000017661ED7000-memory.dmp

Download