hxxps://cdn[.]discordapp[.]com/attachments/1198738993433542778/1540940194570567700/frames[.]zip?ex=6a8bc7e3&is=6a8a7663&hm=72e24d1cee14bfca92b6f6b0333763605c39869de5636c11f3c3cf1a8feb5fbf&

Analysis

user interaction
yes
max time kernel
125s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1198738993433542778/1540940194570567700/frames.zip?ex=6a8bc7e3&is=6a8a7663&hm=72e24d1cee14bfca92b6f6b0333763605c39869de5636c11f3c3cf1a8feb5fbf&
Sample260823-e3dkmaxwbw

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
400	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319328747192900"	msedge.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{2F272D2A-836B-4C82-9742-70FB6E17B586}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheVersion = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5276	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4524	mspaint.exe
4524	mspaint.exe
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5276	PaintStudio.View.exe
Token: SeDebugPrivilege	5276	PaintStudio.View.exe
Token: SeDebugPrivilege	5276	PaintStudio.View.exe
Token: SeDebugPrivilege	5276	PaintStudio.View.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4524	mspaint.exe
5276	PaintStudio.View.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 4936	1156	msedge.exe	84
PID 1156 wrote to memory of 400	1156	msedge.exe	86
PID 1156 wrote to memory of 640	1156	msedge.exe	87
PID 1156 wrote to memory of 2120	1156	msedge.exe	88
PID 1156 wrote to memory of 640	1156	msedge.exe	87
PID 1156 wrote to memory of 2120	1156	msedge.exe	88
PID 1156 wrote to memory of 2120	1156	msedge.exe	88
PID 1156 wrote to memory of 3848	1156	msedge.exe	89
PID 1156 wrote to memory of 3848	1156	msedge.exe	89
PID 1156 wrote to memory of 3848	1156	msedge.exe	89
PID 1156 wrote to memory of 1664	1156	msedge.exe	90
PID 1156 wrote to memory of 1664	1156	msedge.exe	90
PID 1156 wrote to memory of 1664	1156	msedge.exe	90
PID 1156 wrote to memory of 2600	1156	msedge.exe	91
PID 1156 wrote to memory of 2600	1156	msedge.exe	91
PID 1156 wrote to memory of 2600	1156	msedge.exe	91
PID 1156 wrote to memory of 1772	1156	msedge.exe	92
PID 1156 wrote to memory of 1772	1156	msedge.exe	92
PID 1156 wrote to memory of 1772	1156	msedge.exe	92
PID 1156 wrote to memory of 3476	1156	msedge.exe	95
PID 1156 wrote to memory of 3476	1156	msedge.exe	95
PID 1156 wrote to memory of 1696	1156	msedge.exe	96
PID 1156 wrote to memory of 1696	1156	msedge.exe	96
PID 1156 wrote to memory of 3204	1156	msedge.exe	97
PID 1156 wrote to memory of 3204	1156	msedge.exe	97
PID 1156 wrote to memory of 984	1156	msedge.exe	98
PID 1156 wrote to memory of 3204	1156	msedge.exe	97
PID 1156 wrote to memory of 984	1156	msedge.exe	98
PID 1156 wrote to memory of 4808	1156	msedge.exe	100
PID 1156 wrote to memory of 4544	1156	msedge.exe	102
PID 1156 wrote to memory of 5128	1156	msedge.exe	127
PID 1156 wrote to memory of 5132	1156	msedge.exe	128
PID 1156 wrote to memory of 5148	1156	msedge.exe	129
PID 1156 wrote to memory of 556	1156	msedge.exe	131
PID 1156 wrote to memory of 556	1156	msedge.exe	131
PID 1156 wrote to memory of 5512	1156	msedge.exe	133
PID 1156 wrote to memory of 5512	1156	msedge.exe	133
PID 1156 wrote to memory of 5440	1156	msedge.exe	135
PID 1156 wrote to memory of 5440	1156	msedge.exe	135
PID 1156 wrote to memory of 3288	1156	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1198738993433542778/1540940194570567700/frames.zip?ex=6a8bc7e3&is=6a8a7663&hm=72e24d1cee14bfca92b6f6b0333763605c39869de5636c11f3c3cf1a8feb5fbf&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffce555c188,0x7ffce555c194,0x7ffce555c1a0
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,13562781637712704278,13302324256985072949,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:3
  2⤵
  - System Time Discovery
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,8778872581630386213,15934086543159124860,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,15465897933948535524,16414331799460464642,262144 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,8091063129753498986,9138762404895929143,2097152 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,959151595516822788,9057869601226818485,2097152 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,18437650347492533596,10556997731514716468,2097152 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,2730181715608435867,2348931478815205859,2097152 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,3324338192506784484,12706668346003001796,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,10207493729866906366,14013981148730143167,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5676,i,14855732861982159877,10552371332272075550,2097152 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,2018304958742403829,13895629911230416955,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5714212833581657770,9052465192756251383,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6695136387840755603,16030371633543114241,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6695136387840755603,16030371633543114241,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,16811399909160911259,3877492602055579625,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,8750078289943258335,12246452014438967217,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,6411422682391988517,7694968736991097439,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,8596974013791858664,14489694208859155123,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,9979084424783709685,4575488733832025203,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,5003224296004652341,18062644427291036397,524288 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4164,i,10060804349525904231,16011853304605104798,262144 --field-trial-handle=2960,i,4456105980420435076,16977349723913881693,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3076

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_frames.zip\frames\output_0001.jpg" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:1768

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5276

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\New Text Document.txt
1⤵
PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6af51605563604ca2ee71ad7670d013442b02cd8364a18d2598fe6a5fda6025c
MD5 76afa73ff5db7b56706ce826f582a201
SHA1 ba97cefacf0e87b78ffa089866d4c4f9e4600586
SHA512 2c71b93499bd004d653b91aca4acecc5fa2e0a581060d8a8e2fa01eb2b1f6905f95c6ec02ede50659464a0b3e789cc7a149a1318ba8cc428bcbf23aea2e7a48d
TLSH
T1F7E07DC52CC9C33FA744748795BD438C82A0361BE6C8A98B1B04C48970418D8B7E6690
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1cad3e41b85e8baa4232de4d1eb3f5c033e536e74889525f9c4fd54e8afd2900
MD5 896e9fe117bd7bf4fad428c891db3502
SHA1 9dbafb81ba1dd5b5c489b3c2a1a9b3dd88cc2a7f
SHA512 fcd37d746f7170427204204dd7540a519415d2290d62eadcdfbb86e113063042db39d66469b7afd0d19b1bcbef6e175759c99f6b61f611efd0eb99adac32b641
TLSH
T1A8612A37208282D0E31A3170A1E033543EB68DFDF0439E565DEC447522B43EE8277E18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 66a845a2c83503d31e2fa0f2f2bf61766155e5d9149a005da9e09257970fb8bd
MD5 f239f0130a10f3e3c9042f6d9c4c4c18
SHA1 b4bc90864fc8d44506b666698bf15b548092ea22
SHA512 3eb9c6e064e69260fa0f8f30f96953a6f6a4933e3482d80c4df52a293bdaafe43d44020f4f2b08657822e26ca3b9b63caef5e0feb860781e502c21133f1161d4
TLSH
T1C521ACB3C3D58A5EC91516F0AB146E2BCE2D0605432D3C1A89E4EF6BD7E3076E10294F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7f1c0470a59a10e57c0bffc6b9949428bcbaea64b6c9e8c20c6b4cd012778b33
MD5 5df616507bbc8ac8474e2dd8fb770520
SHA1 3c00bac88b6f6991725c6784db997550f22b2818
SHA512 46d58635fa94f67ff4be37e6679f92f25e5e421e798c99b9bc45aad37f26effd49df82d47888c91c827189bc51e26c31f95934e2a176d9273ccc8c25645bb8f6
SSDEEP 192:sxZ/R89i/fksD8zIdpJHW6+WNGYCIj6C4Ig5CJ:sxZ/4i/fksD8sJHbGF/E
TLSH
T1E322D9116E38A57B8CC7E21DBA157F53E7F9503261E41E98EAFC961C05E66CD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5de31557b0c821a06bf784f04b3f705ad45caf43541687dc6779e1b2f405e744
MD5 75b1adc67a701277365009cfe47a9a81
SHA1 71378ec125f4237461f7d83ebb40d7ccbe655ce3
SHA512 6659cf22e2861018170b2219a506a94ef4aee4a50e88b0cac651f69fbfef5bde3390c0dd526dc7546601975b1c8059970e7806ca3cb72e68aefca6b2eb2845a3
SSDEEP 192:sxZ/R89i/fksD0zIdpJHW6+WNGYCRP6C4Ig5oJ:sxZ/4i/fksD0sJHbG8/u
TLSH
T19A22D8116E38A97B8CC7E20DBA157F53E3F9507261901E48AAFC961C05E7ACD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 42d3b687d711da2265befa52605d94deb11f771b1c91e50a42e060e6f2d838bd
MD5 8077b08bd12128eb574b84c5ebc129b3
SHA1 4c804b7f529733dc14f6bf1516af3f25da0ea21b
SHA512 a80411fef76dd8fd2f3e8239fcdbef0cdeae29a8765fd0bf4c82a893ee052d882f01c622cd1123626f1558f0bfc7965ee68d690cd081f8da4aa802ba02060bae
SSDEEP 192:sxZ/R8ji/fksD0zIdpLHW6+WNGYCQI8cC4Ig5oJ:sxZ/Oi/fksD0sLHbGyc/u
TLSH
T14032D9156E3469778CC7E21DBA157F53E3F9507261A01E88EAFC961C05E7ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f205c35b10c19eca04a0e769bd2acfadab3ec585637851fc3062e02e8e748b10
MD5 29509d6265386698172462de04278879
SHA1 1e1bf2880eff4359322a285b1b0255d59222ff52
SHA512 3b14d364ccf8438f6acb252a744b44a4713c86cadf5d684089ea39eb9aec1f6f88b1c76a182bb91c048f1baa9bdb96d9930e7a17a64b3e107a4ed3552a20ce86
SSDEEP 192:sxZ/R89i/fksY8zIdpJHW6+WNGYCI36C4IgrJ:sxZ/4i/fksY8sJHbGX/9
TLSH
T13122C8116E38A5778CC7E21DBA15BF53E6F9503291D41E58EAFC961C04E7ACD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 46ba65d453d49cc1c3f5dac7d60c1c4b9b89387d5b3f4514673be96367e04721
MD5 8f3f83a522b30ecf7a4bb5f88d2e621c
SHA1 bbc6c607dcf904f6345ffaf5652f122579253db3
SHA512 08ec928a1f3b811f5dbb5ecbb084f135f1d448e92e1518c00bea5c7fa0c76e10ac26f079d6e635aa8aef5fe85fd1a30a6f8c177ef67af8c370f79785cd08d8f6
SSDEEP 768:Y4qbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrLroO:Y4qbUj+WvSCs6u1jaaZLbWr4O
TLSH
T1F5C2E83B340CCA7E4F801E9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a3e45e50c432c45de7653ad92af151e5f2a05eeb606b0af2e4f3c8d0505975f5
MD5 7053c369bbed654adf5ddf67caef087d
SHA1 b5737589e66dd868ef494b731acba58359855337
SHA512 65fa3f28537ac1ee5b658b8059cc224174291525642598821e244177f890fc293c28eff662f8d1eaf3f47cd00ea0c90a5f33aa53a57ba50886b6bece65e4cacd
SSDEEP 48:KIWjcwWsMxhQRsIGIxKz4L2xfOhEJIMSyF5IZKiM8Abof7BpZ2Dpe9Ik72KRTZFh:KwzuKsou256KiMhcgKtOeSCEKHqS
TLSH
T15DB1920975BAA2506C7E284CB263A9660A463063300DA4BF7FAD40B34E66E525DFDDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5942cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5942cc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f0e1df8fd3200cc76f91d13b624d806c1548aa74e2cbf3acb17f926d299e7926
MD5 65c5660bcbe259a2caac1e886b1ec2a8
SHA1 fcd58ced73e586fe1d51ef1b511208e489527998
SHA512 7e0d7a28a5acdbd0f8463f4d63c54b59ddbe23d911868c1b9421f930711e2300048ef101cd7963b2eae08c96265fb80085a8ecf624e9eeccdf643437be82ebcc
SSDEEP 384:riF2ZcINsNe8TUNTUlIlDBfgUo/uEa+sOk+cD5Jiva0on:GFkNTwgPoFaZOkVtJitE
TLSH
T19AA26C334CA88C7B6DA6DB85F94A22179FB48067C589AAD0D7DC9F1C01DB6DC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 36161964b1ab5501f96a4d98b247b227d9dab5c2cc0d9a1fec35e2148502ed94
MD5 608db17d995c4a3b02898aa7cbaa00be
SHA1 03b78dd5d90578986f3121eb44542fa24dadba01
SHA512 4e770d081e1e1ddfb06e54bd2855b3643e52b313076e821d1f6da2047c9743b03d1d5c7468230fecc5c873c9c20f40cacf9c90b6609ee265072430c2f2886f98
SSDEEP 384:xZcIBsNODBfgUo/uEa+sOk+cD4Jiva0on:ZBroFaZOkV8JitE
TLSH
T1FD927D325C785C7618E6E249F88A2617AFB88067D6CD6FD0C5DC9F1C01EAA9C131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 1dec9fb1a91d0b1ff35250608939ebf13f7a19fcd9bc9f5bda84e0271f68861c
MD5 8d7831eac02edf715e69008ae2fc1e4e
SHA1 96a6861de5fccc9deae34d0253b2baaafb064069
SHA512 e6d7617b8ef2b28b74039e1c047ed3b2261ff0c1416bcc6e29bedcb85ca91a4b964caaec234b0ee6ec38ae83e185448eeed63a8cbd762ba5f9897e8c42234b2f
SSDEEP 384:riFPZcIasNe8TUNTUlIlDBfgeo/uEa+sOk+cDjJiva0on:GFHaTwgPaFaZOkVPJitE
TLSH
T112A26D334CA88C7B6DE6DB85F94A22179FB480A7C589AA90D6DC9F1C00DB5DC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f3ae2df8441e3e8e856ef4d90a8ee47fe919671fe311691e2d2a4d2d98e5ed3d
MD5 ef673d86c3c153671874b01b323c1bdd
SHA1 14fce1dd8df34dea396809a55ab1207d10fbd5e0
SHA512 4396080ab4a4dd39856f8377983ce0e7efd4a5c6c76f3df002c17d328698e372d940b0dfc14bd36a76003b2b2675f6cd9a88acc42ffbdd773a9ed435c3bc9090
SSDEEP 384:GZcIBsNOSBfgUo/uEa+sOk+cD4Jiva0on:UB4oFaZOkV8JitE
TLSH
T158827D325C785C7618E6D249F88A2617AFB88067D6CD6FD0C5DCAF1C01EAA9C131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 de7b2584985d5a7858026a4c4e02974d50996add3caef6543308f5f3a88204eb
MD5 2bee79d5e6f07edbf9c57fd98120c664
SHA1 1c77e3355cdc67ba9060651095bec49e3c580033
SHA512 101cbf295fba792e6e5823212c4c5e6acf7ce48ecad32556ed7abb021e64b0a22fe3e1cacfc43beb1e21a4132f9da50f832d63fb341e302cab96726df5cc79ef
SSDEEP 384:riFPZcIasNd8TUNTUlIlDBfgeo/uEa+sOk+cDjJiva0on:GFHaGwgPaFaZOkVPJitE
TLSH
T14EA26D334CA88C7B6DE6DB85F94A22179FB480A7C589AA90D6DC9F1C00DB5DC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9cbe5fa2c85328c46a86bcfdb1dc0fc9623bda4be6dd6d37285b9ca059d70910
MD5 97d9557109c3d6db6c291aff6570c781
SHA1 6bba5852f095c04ea6c96f45eb897c403d8a3a5d
SHA512 6154ffe3611965fd3660261f80e1f4ddbf97082e7000f7f4f73bd8fe50998c0eff933e3ad07ef387bde2d002fff4b181dd2b04335404fed075ee5153af2c4e80
SSDEEP 384:yZcIBsNOuBfgUo/uEa+sOk+cD4Jiva0on:ABYoFaZOkV8JitE
TLSH
T189828D325C785C7618E6E245F88A2617AFB88067D6CD6F90C5DC9F1C01EAA9C131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 41823b9fdbe05e712aa2843030d2860875fc5f0975430e0831c6c48d7f009d40
MD5 5d1d1c71965cbe686ef1091b2850399a
SHA1 52deff1db59284dd9cb413362b27842f7c518ce2
SHA512 6dd89a10267e8b8c8ae301745cacebbdaf5b06acc15a456c7e732aed54c2f933eb530140857e7e4d9f06ac1d993ebae6b36728fe15d962653dcb615e59999995
SSDEEP 192:eONf6DbJQmiUybxCBa+jYOmeW+E/0e4S9NzDqMbU6:eONf6/WCBa+sOk+cDTJU6
TLSH
T1F5120932697C5C775DD2A544F88B3663AEA45127DA4A7B90D6DC2F0C01EFA9C130F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1124cb8bac36c2e86f997cd14c9dcb1866b15570ce4f7a7f479565cd35c11535
MD5 0fe6e2c5fdb3d9c480429069994aa066
SHA1 c3ef8f115a529c40977dcb6dff8dc7752a36d712
SHA512 8edca9a7ac735e56006c458958c45f7c344adc8d92c9b46d6edf3698af5124a4c4da0b9c33dcf1da3d446eab9d08b7df6ecf7e0cbb81d848bccf7e6bbe43ad7f
SSDEEP 192:vON16Db6QmiUy4xHBa+jYOmeW+EKRgXwU6:vON16uPHBa+sOk+MgU6
TLSH
T10202E93569385CB79EA26E49F88B2727AF94203BD9562B94DAD81F0C00D765C230B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

808b91c4-71ca-43f4-94ca-46b002738777.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\808b91c4-71ca-43f4-94ca-46b002738777.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2c788d1823dbc5e67e086cefa5136906fb6140825ecce9389634e8fa8253d27f
MD5 20fac1695144a2399f76f8329af674f5
SHA1 d30637a1e76946246334f8f288e851819fe5f6b5
SHA512 6f872e1e1e886259d0368e13c12fef2da819948431cffb7543254f80f4c69573d2a2ddbed160d4643968269c8a3d8d0fd2a2b98449ee75876e3a3ff1d21001b4
TLSH
T1FC41C65DA6EA1148B377BE5A9BF6646D487EB9372F0B949E00100D4E0A63A40DC71B33
MD5 SHA1 SHA512 TLSH

Submit Download

Projects.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
Size 237B
SHA256 0285f7ab6ba272bdc9ec87f41e2641ba00ea7af9b7c6baa19f9a1ea3113c5a50
MD5 812cd262f7d569af5d0ac1e8e29078a7
SHA1 dac38e2c0e9235f329ffeef643a18e8fb5e8eb92
SHA512 16882a4fa5bb6d0816c3a2506d657e682c84fac1c50fac420c6aab3cb1cdb4f691e749b6035cde9fc77ed2a81b392744bd9d17dae2c4a5527938961ea951b149
TLSH
T1BFD0973F80445E7D9280030016DA88C171A44374A9100808F44AAC28A1B244C1276822
MD5 SHA1 SHA512 TLSH

Submit Download

Projects.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
Size 245B
SHA256 2f223cbf71ced872c3e8a734bab14741371f2f3535acca0d69c510b815fb7da7
MD5 42ba44253955d7f35456d1a902f974e5
SHA1 b3a4362514931151ecfbbb3945f2f823eb5e11b9
SHA512 b203d18673f6c77a6cd34fc071da8c94b8fee62538437e267dfa4ce982591690b0781f0342ee05f24e3aedb489a32927cba9fde2a643b75dbd88c9bcc59f8fbb
TLSH
T1E9D0A76B44444F1E818183505B594DC775E807B562545D0CF849FC6AF673449157AC25
MD5 SHA1 SHA512 TLSH

Submit Download

cloudCommunitySettings.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json
Size 2KB
SHA256 52bfb22aa2d7b0ce083d312fb8fa8dcda3063207186f99fc259aebd9064cbedc
MD5 f4e4a03ebd0ab3a953c56a300d61d223
SHA1 97a9acf22c3bdd6989d7c120c21077c4d5a9a80e
SHA512 12aa71eea45720a4d7d057da0b662635671e4cd165ad2e0d30a3d2a43950b47dd60c26c1bbbe049418f815850e571b8d93e4c8b8cbbd686abc3cf7926ba719c2
TLSH
T12F519CEB0003BD5826FF95057133F52FF48FE096548856DB98C1E8BFE6A9064B29A028
MD5 SHA1 SHA512 TLSH

Submit Download

frames.zip.crdownload

Path C:\Users\Admin\Downloads\frames.zip.crdownload
Size 15.1MB
SHA256 de4cdf173f7c384eac7e6a98e3a77fa7836b4b5c1543ebbdd5c2ea7dc8792681
MD5 688db7bfb4e826c5803757961ba2233f
SHA1 99ba789a15affd55ac5b6097ba0cb6c3c0acd79d
SHA512 fdbc4c83172cded3d1a08342706c54e7a1e9050da165b395d8ada60eeb8fa98ae859b319395f9ac719e07d4a94935f8beffb38209b4b9621ddac55d36c531f52
SSDEEP 393216:/4clYo+9OSY0aESBX3l2w8tC7vMr6qfwGZo:wclYFoZBl2EUWqf9i
TLSH
T1C9F612DBEA450441C0E3E7B0A40A0CDE6D8C51553B3CBDB66A65CD845B83EB60BCAF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-184-0x0000019B39F60000-0x0000019B39F70000-memory.dmp

Download

memory/1768-193-0x0000019B4A2B0000-0x0000019B4A2B1000-memory.dmp

Download

memory/1768-180-0x0000019B395A0000-0x0000019B395B0000-memory.dmp

Download

memory/1768-195-0x0000019B4A2B0000-0x0000019B4A2B1000-memory.dmp

Download

memory/1768-197-0x0000019B4A340000-0x0000019B4A341000-memory.dmp

Download

memory/1768-191-0x0000019B4A230000-0x0000019B4A231000-memory.dmp

Download

memory/1768-199-0x0000019B4A350000-0x0000019B4A351000-memory.dmp

Download

memory/1768-198-0x0000019B4A350000-0x0000019B4A351000-memory.dmp

Download

memory/1768-196-0x0000019B4A340000-0x0000019B4A341000-memory.dmp

Download

memory/5276-291-0x0000022BC8600000-0x0000022BC86DE000-memory.dmp

Download

memory/5276-290-0x0000022BBD4A0000-0x0000022BBD8D2000-memory.dmp

Download