hxxps://cdn[.]discordapp[.]com/attachments/1531560171271356520/1558929239539982376/prodigy[.]zip?ex=6acd397e&is=6acbe7fe&hm=c62119fbb2170416484d981ba6a9ed97ad4c997fe560bdd1bc1bc9657285c46f&

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1531560171271356520/1558929239539982376/prodigy.zip?ex=6acd397e&is=6acbe7fe&hm=c62119fbb2170416484d981ba6a9ed97ad4c997fe560bdd1bc1bc9657285c46f&
Sample261011-zygrpse16p

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4372	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{4B1DFCD3-9742-4045-9B95-C833F0590F54}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheVersion = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheVersion = "1"	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1340	PaintStudio.View.exe
5892	PaintStudio.View.exe
6084	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4708	mspaint.exe
4708	mspaint.exe
5836	mspaint.exe
5836	mspaint.exe
3804	msedge.exe
3804	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6084	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	PaintStudio.View.exe
Token: SeDebugPrivilege	1340	PaintStudio.View.exe
Token: SeDebugPrivilege	1340	PaintStudio.View.exe
Token: SeDebugPrivilege	1340	PaintStudio.View.exe
Token: SeDebugPrivilege	5892	PaintStudio.View.exe
Token: SeDebugPrivilege	5892	PaintStudio.View.exe
Token: SeDebugPrivilege	5892	PaintStudio.View.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4708	mspaint.exe
1340	PaintStudio.View.exe
5836	mspaint.exe
5892	PaintStudio.View.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe
6084	vlc.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4800	3528	msedge.exe	86
PID 3528 wrote to memory of 4372	3528	msedge.exe	87
PID 3528 wrote to memory of 4680	3528	msedge.exe	88
PID 3528 wrote to memory of 2328	3528	msedge.exe	89
PID 3528 wrote to memory of 4680	3528	msedge.exe	88
PID 3528 wrote to memory of 4680	3528	msedge.exe	88
PID 3528 wrote to memory of 2328	3528	msedge.exe	89
PID 3528 wrote to memory of 4224	3528	msedge.exe	90
PID 3528 wrote to memory of 4224	3528	msedge.exe	90
PID 3528 wrote to memory of 3960	3528	msedge.exe	91
PID 3528 wrote to memory of 4224	3528	msedge.exe	90
PID 3528 wrote to memory of 3960	3528	msedge.exe	91
PID 3528 wrote to memory of 3960	3528	msedge.exe	91
PID 3528 wrote to memory of 5068	3528	msedge.exe	93
PID 3528 wrote to memory of 1044	3528	msedge.exe	94
PID 3528 wrote to memory of 5068	3528	msedge.exe	93
PID 3528 wrote to memory of 5068	3528	msedge.exe	93
PID 3528 wrote to memory of 1044	3528	msedge.exe	94
PID 3528 wrote to memory of 1044	3528	msedge.exe	94
PID 3528 wrote to memory of 4208	3528	msedge.exe	97
PID 3528 wrote to memory of 4928	3528	msedge.exe	98
PID 3528 wrote to memory of 4208	3528	msedge.exe	97
PID 3528 wrote to memory of 4928	3528	msedge.exe	98
PID 3528 wrote to memory of 724	3528	msedge.exe	99
PID 3528 wrote to memory of 724	3528	msedge.exe	99
PID 3528 wrote to memory of 4912	3528	msedge.exe	100
PID 3528 wrote to memory of 4912	3528	msedge.exe	100
PID 3528 wrote to memory of 4912	3528	msedge.exe	100
PID 3528 wrote to memory of 2448	3528	msedge.exe	103
PID 3528 wrote to memory of 2440	3528	msedge.exe	107
PID 3528 wrote to memory of 1892	3528	msedge.exe	108
PID 3528 wrote to memory of 1892	3528	msedge.exe	108
PID 3528 wrote to memory of 1892	3528	msedge.exe	108
PID 3528 wrote to memory of 4500	3528	msedge.exe	116
PID 3528 wrote to memory of 1764	3528	msedge.exe	117
PID 3528 wrote to memory of 5012	3528	msedge.exe	118
PID 3528 wrote to memory of 5392	3528	msedge.exe	130
PID 3528 wrote to memory of 5392	3528	msedge.exe	130
PID 3528 wrote to memory of 5580	3528	msedge.exe	134
PID 3528 wrote to memory of 5580	3528	msedge.exe	134
PID 3528 wrote to memory of 2676	3528	msedge.exe	141
PID 3528 wrote to memory of 2676	3528	msedge.exe	141
PID 3528 wrote to memory of 3804	3528	msedge.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1531560171271356520/1558929239539982376/prodigy.zip?ex=6acd397e&is=6acbe7fe&hm=c62119fbb2170416484d981ba6a9ed97ad4c997fe560bdd1bc1bc9657285c46f&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x24c,0x7fff7337c188,0x7fff7337c194,0x7fff7337c1a0
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,10662298101814539827,3603970771428978471,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,2392696602696695887,10721340369670823701,262144 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,3393277634804186191,3444180035704355688,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,11573016509967504992,2821056857076375055,2097152 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,8182704062914897509,8059971551854060568,2097152 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,11104840646252628238,15763487047153588539,2097152 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,4359060886889733277,6379030171348735601,2097152 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,458451946578760119,4692957208512169895,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,18126114966951860051,2650712115783082206,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,15020929302823683463,14938647163691267363,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5676,i,5683468208862990136,11205857602696883615,2097152 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,8025863928212305909,10539625934208441204,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,8025863928212305909,10539625934208441204,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2521180662632314684,17979221413766506557,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5152,i,6928652934702570266,5438224307704817939,2097152 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,10034024477884518688,13463707493456455479,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,17837241530593731163,8059033385947072990,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,4943271830246659455,18367670256927357681,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,12199621112870735525,3533979456899499657,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,15222561826390795520,3873443343165306361,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,15358494310072161399,3771851860715084882,524288 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7032,i,5765197054682667021,12535455463727466669,262144 --field-trial-handle=3008,i,6067726912891836774,16380907780845568571,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3712

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_prodigy.zip\PREDIGY\2tn8n4.png" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4992

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1340

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_prodigy.zip\PREDIGY\15 YR OLD FINAL\eLYUJ.png" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5836

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5892

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Temp1_prodigy.zip\PREDIGY\qdg46o.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

188ac8a2-8ab4-41fd-b0e9-479f9af78a79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\188ac8a2-8ab4-41fd-b0e9-479f9af78a79.tmp
Size 12KB
SHA256 5de9aea1e52f71af62008aba55d2f8900416bbce00ad00b0f26405e49c6e2f91
MD5 b02e0d4b8bae689e8ff40d503e1a8793
SHA1 852e955701299baa3197b2817729aaa9186596bf
SHA512 20ca4bccec5625ac16b722c28b4fb59ca4774974c6feaf539e9d632baf8408ebb00fc5365ac4f90485dc4e611f30b83d069b18eeb944433a1ea8e53e6e0439b3
SSDEEP 192:u/LsNDvQFIvcUb87gQmiU1ZiIy4h//WA7C1GezdaopqeELy7:csNDvT9bkgHV9h//WIC1Hv26
TLSH
T178424A36A8B4EC3B9DF7A554F04736139F7440A7EA882F94DADD6B1C02DA1EC130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

458730b3-f9dd-4bd4-a780-c0e36e26dfb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\458730b3-f9dd-4bd4-a780-c0e36e26dfb2.tmp
Size 8KB
SHA256 11c9d5c06395c68464c0514ef79a4316d75dbf45cec0ca333a4bbf0ca6958a2b
MD5 6743e3370b90d51c3db00f3bd705bcf8
SHA1 f4adc464714ec5bddc7b90f1d4a1b8d71612c8d4
SHA512 92698fb91e75eaddb4361a888c0ec1fea6aec5e1128c908746c0a332123c97c934fa596cb09056af17bae81b82f09fee9eebaa86c3f5a14fb21c97165d7d8083
SSDEEP 96:KqONkLQsjpfbUmjH5ih/cIPURHl8h4otop5FaDlBKP4v+Y1xf//ojdhxlDeYu7Mf:BONz6JUm0QmiUyGbso//WA7MBCwPU6
TLSH
T1F002E839AC68BC7B8EF39E45F04777239FA4107BA6955F80DAE82E2D01D759C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66195b75-b2ba-406a-8b1a-34269857e335.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\66195b75-b2ba-406a-8b1a-34269857e335.tmp
Size 18KB
SHA256 adff16e4ed1085652855c44f903d3228bc05be545b8a70dda0d68f1c18acea05
MD5 37aee469f9b171f21389293ae1d0316f
SHA1 01ac5d74d2a9a269b8f382f4461335b26adb9b15
SHA512 370a261ce88aa89792a003358d0ff2f716dd1ed2ac7772105ae87969a00c1e9812afec69ccc81b497c05be24e020387b8b80b1f8a58e6c2e1ccb425bd10bb695
SSDEEP 192:u/m+xasuheOwQxMksNDvQFIvcUb87dKQmiU1Zisy4h//WA7C1GezdaopqeCVTEFp:lZcInsNDvT9bkdGH39h//WIC1HvMTq
TLSH
T147827B326C74AC7B9DE7A558F48736139EB48063EAC42F94D5DCAB1D02EA1D8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e09429f-3d46-40b0-a778-a0887e4bd70f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e09429f-3d46-40b0-a778-a0887e4bd70f.tmp
Size 21KB
SHA256 2837c46d48a29c36a74f6eadc7e9ec2cc5fb47120730ba0216d60c170a5727cd
MD5 72a9ba10f20a59ae25638a01564727d0
SHA1 4c1f23ff86cd5aaee7e4ba1477372676c5946420
SHA512 b5b42379948de5167955b7d99e8ded99a709c6de6c54a13fbee4172ba0565062737537323dd240e317bf676cc9ffad383f2b1d859e738eae742726f1c94fdbc3
SSDEEP 384:JViFNZcIt1sNd8TUNTUlIliT9bkDH39h//WIC1xvMTq:JcFVfIwgJj/+vMTq
TLSH
T1A5A26B335CA4D97B9DF7AA54F45B32138EB440A3DAD46F94E6DC9A1D029A1DC030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

2cb0158f-4d53-4167-9804-a89fc0c3f29a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2cb0158f-4d53-4167-9804-a89fc0c3f29a.tmp
Size 9KB
SHA256 240bfe2f83ed3ed238737aa20e8c28ed4924d1317d94b739007cd001caee58c4
MD5 14c4859ef918bcd33700734e9fe309a3
SHA1 9e2d5af9dcec79890e1c8bbe9a8ee126cb739990
SHA512 a992b5aefac6ca78e95b3fdd64b3ca9d89144dcccdd3bd9c337eaba657383e5f64d6fb1e5e49d3bb7b4118484dfa03edbf4df786944d918e1033bbf87645c779
SSDEEP 192:sxZWRKnl/feDsKgEdpJHW6+WNGY36cgSKIgrJ:sxZWGl/fQsKnJHbGXb9
TLSH
T1C112A6526E38A57B4CC7E20DFA65BF13D6FA503261D11E58A6FC861C05E66DD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7091744b-27a1-40eb-b679-5ac67f41bdc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7091744b-27a1-40eb-b679-5ac67f41bdc8.tmp
Size 9KB
SHA256 fa9f7417502c79405aa0f6c5524957d69715be706a8bcaa137a2f33d330f7a50
MD5 d3ef2d191a06ab53e0c98825065762ed
SHA1 f06a47794f1b45b16f256c02bed4f76ccde144bf
SHA512 f12228fb98d3c82e9814f6d20dde70bf255089cdb03f716e497b65b76f6aa128cb9fcd4cbc4c22bb215ddc87158c324a102c0cb5eea608e9705666e33bc63f69
SSDEEP 192:sxZWRKnl/feDsBgIdpJHW6+WNGY36cgGKIg5gJ:sxZWGl/fQsBhJHbGXDy
TLSH
T1F222C8126E78A57B4CCBE20DFA65BF53D6F9503261D11E48A6FC861C09E66CD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f4ddd96-b0b5-47fb-aa02-662385cdd083.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f4ddd96-b0b5-47fb-aa02-662385cdd083.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 05fb53bb4f9d3379397ff490f860484fafafd6bbd93efe7f60543adb7ec5cf2a
MD5 6b240043d2b67c3e2dd466d11cbe69c4
SHA1 297c811fb66d7ac800d6d884bc90c12a3a1635a0
SHA512 c4a1b9a98330c93cdbcc8c22b546864dd827f32d9d7b81933b4ae5b515f3ee5a4cdf0b0a0b053c1af066f20f185479c653e0f90d9f5be1a868266b566d0a1191
TLSH
T136E026E406C9C32EA31CB8CB417C678D8BAE261ED2E06A0E1714C6847046744B782AA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 826271e2f584e4c4132fbbd76806c8e7b2deca2072ddc706b40104ca0a7ec0d2
MD5 f8ecbb0ab3a7a72d37bc0719fb94d32d
SHA1 f82e437716f83f1d073990df14c975f1047b8855
SHA512 8cfcdff2f059a3e33b2ab84834f352235ab79ec7419b6c84c4cb1c462a1d15cbe52bc50a28a931f62e2a9379bd0468baa322a092043b3c685a3bd90f8d5d12be
TLSH
T1A0E07DE504CCC32EA749A9CB027C63CF8F88366BD2C8790E1700CA84F086290B6D76A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 71bdde19c1be39428a564d36543fbf0fbfff8079d66017852e4f56648857bf38
MD5 fadbbb7dcd13302cb117b62d5ebbf12c
SHA1 3177216e45cbd0204a9c8a8214bd150d5d68ff44
SHA512 4edcb2abdc655025ddc7919cc43f2f95a961eb4b236cd37bc1f557bec07b9d8b2e77052f1146a3d7bbf6bbb0a4f4bddc325079812a691b8fe5fc3cc29b978a0a
TLSH
T131510FCF63D44461FBEBA17C81DD3E87363755C1249FAEC235A8C8BB940BBA04119464
MD5 SHA1 SHA512 TLSH

Submit Download

f20091e3-82ff-482a-985d-89b144eca943.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f20091e3-82ff-482a-985d-89b144eca943.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

c530fd93-b7f2-44c8-9cc5-b7e1d40eb14d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c530fd93-b7f2-44c8-9cc5-b7e1d40eb14d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

feb905fc-055b-4e43-9463-74e94820c627.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\feb905fc-055b-4e43-9463-74e94820c627.tmp
Size 1KB
SHA256 b9599f931b23282fb29c080d6e93063540c9224846323158b5eca2aa868a490f
MD5 f0aca9a1356cb4edb2a059560b1eda14
SHA1 b41d9c8f1f80ebf2e2d11a0a60cac1bdaad43bd5
SHA512 cb1cf74aa62884537b2e7fdeee4db4bf373a0d1aefee539d52be32aee770b18ef46aca4d0f30b5d2cc98f2d1d8a881e14d63ca310a3ec742fe5d61d36033f01a
TLSH
T12F2186B387D58A6EC9055AF06B24BE1BCE2D050942283D1A89D4EF6BD7E30A6E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

ff06d005-41d8-45de-b681-63ac69dceaa8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff06d005-41d8-45de-b681-63ac69dceaa8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 57863743960c9a059b4705e9117cabb45d2502fa821d3f2c71e35f960b88d403
MD5 99b0e70645d4cbb9260463b9145448c8
SHA1 fc16969d861edfd650add7c5e4cd3e3bb897a80c
SHA512 665d805f7a776832ae9465b2233f20f0e75bd0687769f9494c43999cf81d477662fe9955b9c6979bfa793b881968affa26ca23d90323351dc9f4cb9b81230c5b
SSDEEP 48:K0q1YEqo4pb0TkIS8pK9g1apxS5YrMYayLo3uyYCmnb+l+ISKnK9m1cnxw3YNuyq:KIZCK6QK2/eKgILXCK8w6qe4KTa6
TLSH
T17AB14805716A420138BE164C92F8C5AB565130F37028E96F7FAC52E24EAEF211DFDED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3627dc5-6c4c-4a3b-bcd5-44eafa793c72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c3627dc5-6c4c-4a3b-bcd5-44eafa793c72.tmp
Size 10KB
SHA256 c878ab30d569a65561acd205d1ebd50e754c48fef24e930a01b053f587fd4af7
MD5 b4d9c80c4499d734ce4533fe7b3a7e61
SHA1 28ea8f2bcc0e28bb374df3743f17ad9e061e36de
SHA512 8c10b8b1eea4f8ac0776e00f54b44befeab0c90b2b8eb1fff1c5d0f77d632208980e8039a51e7e4111aaa60feb457464a6a667589f87fb33cbcc4883109d6a3f
SSDEEP 192:sxZWRKhl/feDsbgIdpLHW6+WNGY36cxtGKIg5SJ:sxZWsl/fQsbhLHbGXafw
TLSH
T1E922D8526E74AA7B8CD7E20DFA65BF13E6F9503261D11E48A6FC861C05E6ACD130B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce6da2e4-082d-499d-8650-d3e464f40882.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ce6da2e4-082d-499d-8650-d3e464f40882.tmp
Size 27KB
SHA256 5218123fb505db0a9ed5dcfd50ab15f44df70f3b67cf08c664b831a620db371c
MD5 b5cf357a5894c1201c4471c3f0474fb9
SHA1 a66777c09710866aaad92c61747d490e803ee5a6
SHA512 5cd8ac043870ce5ade7069bc86eef8416d7d0512dd74557d4ac666132d6db4bdc64383c3a8fac9e5f5735a049a6157aa1d93baf9fc21b3d62dfa3d045c60fd97
SSDEEP 768:sWKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/zroCm:sWKlm7QWvUYe0u1ja8/L/E/ACm
TLSH
T168C2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcf7a1eb-f1c1-4fd3-94fd-a5852a97ebb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dcf7a1eb-f1c1-4fd3-94fd-a5852a97ebb5.tmp
Size 10KB
SHA256 a7b125369c715a589af0ecc48eb2b64daccaf8cea4ed4292abe9162a5ae1539a
MD5 841be2d0defadc3ea81eb901e52b6b42
SHA1 af33d612b458f2630638817c7c36179fb69ad4b6
SHA512 bdd94e6850620366c60c004c58f144128ad899a974959bd5dcbaf98e0e2c39f7974564ad5f3696db44ca7994953c92a2c0db2fc571f88fb85a9e4d37c64d783d
SSDEEP 192:sxZWRKhl/feDsbgIdpJHW6+WNGY36DxKGKIg5SJ:sxZWsl/fQsbhJHbGXVsw
TLSH
T1C322C8526E64A67B8CD7E20DFA657F13E6F9503261D11E48A6FCC61C05E66CD230B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4d412ac-6eb7-4dd6-a7df-a34616a627a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4d412ac-6eb7-4dd6-a7df-a34616a627a7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29d1faa4-6ab1-406e-ad10-a2d8e62cf702.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\29d1faa4-6ab1-406e-ad10-a2d8e62cf702.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab18ac9c-b2c0-4e33-87a5-1c1b26ec07de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab18ac9c-b2c0-4e33-87a5-1c1b26ec07de.tmp
Size 8KB
SHA256 a0c41048422f43da1bd6b6dd2d432ea8149e77af2efff634b66dd1fde7e16194
MD5 41a8baa7d6cc2052950e248710401ff3
SHA1 dc605fa7e4a600c2a1d9681eaae3d9dece146802
SHA512 fdc5128032bd91b9a26c0ff125125156fce9adaeb7491da2b66ac41167393d4bd0d2017f716b05e2d521b4bb295d25a8aba3acfb03b389609a387387abc2c34a
SSDEEP 192:/ON+6JUZQmiUy7Fbfo//WA7C1GezJNxpqeU6:/ON+6+3I5fo//WIC1nvU6
TLSH
T14312F936A864AC7F5DE3A954F08736139E744167EB896F90D9DC2B2C02EB59C530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5f6cac5-3c8b-483b-a1f4-0a11073336ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b5f6cac5-3c8b-483b-a1f4-0a11073336ad.tmp
Size 18KB
SHA256 277afbdf5b688cf61df0693891ff8bebed3ed8b5bdcc21bf08d3d74e15640acf
MD5 ce8ba3779ca5531ebfd933f0f6613e1d
SHA1 8d6495dfd3bf9dd67fcc519bcda1b59d17e0cb09
SHA512 d3fa0a5b55b7abec78e2cd4978da9fb3710e1f398dde068c68b2c39f70b277d2e1f9a72e5167684af4e76f2c59c8dfcec0bbff3cf84074cb84c1d0b73d8796ff
SSDEEP 192:uGTx+xasuheOwQxMksNDYPQFIvcUb87lQmiU1Zisy4h//WA7C1GezdaopqeCVTEH:jZcI7sNDiT9bkDH39h//WIC1HvMTq
TLSH
T1F2826B326C74AC7B5DE7A558F49736139FB48063EBC41F94D6ECAB1D02DA1D8130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5109de61-61cf-4136-85e4-46becc879c13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5109de61-61cf-4136-85e4-46becc879c13.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a99d30431f535b364728aba5abed58eb7d7a74c22910f5379b95550752bb9dcf
MD5 49934c9cefe8642faa13ad8ba2b4afcd
SHA1 baac2287c78e2dd94761a422bc7ef06592daaa35
SHA512 06e4e9e6e17e91801c8559088246f91eb53d8bb9d828e61473ad3e15bcaaf419599e2e282c9175617742712f7621c283e50b6d60c8d3093433181ebc8b82596d
TLSH
T123412858B7ED1108F3B76F59ABF7A86D887FBD332E06945D00110D4E0A22B4188B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Projects.json.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json.~tmp
Size 238B
SHA256 0f13da9782c8c332921feea06c6e99ca6bcaaaf3d6debf82b97ac4beced2a8f7
MD5 7de2c3acaee7e5438c0a5f9215a71145
SHA1 0365099561199944dcfc3cd460173bbc18cb1063
SHA512 04e269257f9e5e40a1feda80f1c125fecb50ad0541b1a6cb83c07baf499bf74c7ebd9e647fc5685b5183f1f1cdd0721d2dfe4c41ae2642f524bed7fc29f07576
TLSH
T1E6D0A75741C45E6FA9E003144AAD4985E2E94376F9544428E88F5DA869A70DE4126428
MD5 SHA1 SHA512 TLSH

Submit Download

Projects.json.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json.~tmp
Size 238B
SHA256 f65be42b1af29f16301a093e4b7b4b1996e2d60ff2091fdee45afa2d39cc1f93
MD5 be249649956d99db199f4701a5abb966
SHA1 54bd40aaa9bd75ee0566a571aa337fee214054ce
SHA512 75a8e71cd51df8acb6d476791c661139b760fc6f88f92dfd29d567c6ad78840c276188d7af975a8a32d8457141a8cc5a0412444cf5e9848eff858d7da611f50d
TLSH
T106D0A77B41884E7E91C4130A859D85C2A1E457BAF6541418DC0E6CA8AEA30981336460
MD5 SHA1 SHA512 TLSH

Submit Download

Projects.json.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json.~tmp
Size 239B
SHA256 934dc8081c8708d0434912b384f2c436ae8af581dfd5af4f53715660472b1da0
MD5 500a493adf531b4003f7cf2d029b58b8
SHA1 8b615fb096df576f3c52d2aa49f78ac7d0931824
SHA512 306ef054cb2c212c7e9edb11dd021cee5f0ff4aada3d04aa952b13b21044dd6973e612f0f4c39a6c9a7d54b21d81cf4a5a285b0ff23d4390dfb388ebbac0a753
TLSH
T124D0A76B50884F9D99C043818BDA8843A5E827B5BA641518E84EAC99F5564CD0632820
MD5 SHA1 SHA512 TLSH

Submit Download

Projects.json.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json.~tmp
Size 240B
SHA256 90bdcff3bdf43c244398dbe8fc14d4dce6702a7575cb44c35fbf5494eca09af5
MD5 8b9283ed3ccec3b36ec2e0fb78f54c1c
SHA1 fda96c38954bec457d96bc1341e8906aa6aee8c1
SHA512 ec0a31b76bcbc486b87ea6d7b9f8dd1eec5be1b4be2d1459dd03e20e066aeb4f74f30b4622beaa51335a3ded15eb6cdabcd26adf4347dd87b2aa817e616cd373
TLSH
T129D0A76B80D86EED91E413448ABD8C4AB5FC27B4A724282CEC4D6C599AB2488323A460
MD5 SHA1 SHA512 TLSH

Submit Download

Canvas_0.bin

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\WorkingFolder\Canvas_0.bin
Size 387B
SHA256 04879008e8e65a1f5509f8fe750e782af4bf43282b786e5ee2bddd27b38ae6cc
MD5 6c7671db64dd3ab15898de495b3356d1
SHA1 e17461d4d7678730a97bb34b8495c2a48afb54a4
SHA512 4f2b064db0829f3376be0b5382bd0d6cdd4023e10cfcac0df5efdcad4b66f0815dc91f0cd7b8a2c0c1ea2774fa6f24218f9f520cb9a0791077cf74195b0fb9c3
TLSH
T1EEE09BD2BF44D425C9BB5E3E41B241629439DC47114365C57F1140255D55F085646795
MD5 SHA1 SHA512 TLSH

Submit Download

Canvas_1.bin

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\WorkingFolder\Canvas_1.bin
Size 387B
SHA256 2449a2c2bbdbe8a34ddc5cbd582a3881ddcc22159704b89fe52fc0c23060f22e
MD5 3dfe89ab65c6c1158ffa56e9d83d4daf
SHA1 4ff4d3318b4472a7c670c91fca75a7e74030ce3e
SHA512 82a81dfd89d334370810e6a5fcf68a1a7351b087d2c2fd63efa1e92b163e3e704e29a8ac7831df3b76079f510a565e0426fb9b321fcd7af052af100fd1bb8847
TLSH
T1BFE09BD2BF44D425C9FB5E3B417245639439DC47124361C57F1140355D55F085646795
MD5 SHA1 SHA512 TLSH

Submit Download

EngineConfigId.bin

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\WorkingFolder\EngineConfigId.bin
Size 88B
SHA256 54332c4c577158182d35f4c8dcf1aca73ff880b053f03b8e6e85e2bab8c40938
MD5 2cb0d4339341e6189cd737b364cdcd82
SHA1 52cb91f3d2f92c50d60630507182bb442f4ad6bd
SHA512 282d0047db4c0b8a4bff0935f8308cbdbc83dbe4aaf5cf77d193a697d77e4ad8ebe7d157ff89cfa65f6bcf445ce421e29d245082b2783e5df8ca9000c2e97002
TLSH
T125B002B90DBC10759535D1B7474545529500452075048D2656C75595470755664C7C5C
MD5 SHA1 SHA512 TLSH

Submit Download

cloudCommunitySettings.json.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json.~tmp
Size 2KB
SHA256 52bfb22aa2d7b0ce083d312fb8fa8dcda3063207186f99fc259aebd9064cbedc
MD5 f4e4a03ebd0ab3a953c56a300d61d223
SHA1 97a9acf22c3bdd6989d7c120c21077c4d5a9a80e
SHA512 12aa71eea45720a4d7d057da0b662635671e4cd165ad2e0d30a3d2a43950b47dd60c26c1bbbe049418f815850e571b8d93e4c8b8cbbd686abc3cf7926ba719c2
TLSH
T12F519CEB0003BD5826FF95057133F52FF48FE096548856DB98C1E8BFE6A9064B29A028
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 109B
SHA256 c56ef49e8c366136793c34cfc4c846d787907b2a9abfc99af54948a83d0529c8
MD5 061b810f386999c17977a1b6cc848a18
SHA1 c7140bb319eab27c933f694a2873dfe41fb49953
SHA512 7d4cfdda9bd65f5f49599d33fd1d4150081ec8363c9a0ece50ca629c0908930d25e880dbe4f1a334ba633f2462cf3bf245c70b7aad183d4b6c10e28cded999b2
TLSH
T1A3B01210C04ED337DAC8449371BC024F1075E418C8C57A9097A5B48401E0C5FB3CEAB8
MD5 SHA1 SHA512 TLSH

Submit Download

vlcrc.6084

Path C:\Users\Admin\AppData\Roaming\vlc\vlcrc.6084
Size 94KB
SHA256 ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e
MD5 7b37c4f352a44c8246bf685258f75045
SHA1 817dacb245334f10de0297e69c98b4c9470f083e
SHA512 1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02
SSDEEP 1536:XJDiGWjxYmJPHzV1vC334+DmV3LrCE2y5h8LwgLgG6H:XJGGWjxYmP1a339D0XCE95aLwKgR
TLSH
T1B393A4C46C6020940897884735D5F180B91A712A9EFF1AFAD1FEFC5923848DAC5B9DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb08b9cd-0a86-4dc5-8f94-fd20af769cfb.tmp

Path C:\Users\Admin\Downloads\fb08b9cd-0a86-4dc5-8f94-fd20af769cfb.tmp
Size 13KB
SHA256 22c218236483b43f581d6ebb6d3694d7320a63b50468e781b8a84d7d50e58808
MD5 b3fc359d7b7fb262732bc4963f4e775b
SHA1 289b03ae824523d685e87f3ccf3d5b7e3cc20b30
SHA512 9093dd9e99662ee3a8cf39303e40a65102200f3771308d3b9861e181a8cb51f0ece761d965a8dd5ab061d0ba0e13e5f7366eb0adbfd889057b354b1ccf81ead9
SSDEEP 192:uwfgJu4zPF4SsUI/oz31vJY5dQ3IGOmEMYnp0+3yxRMA5TBmyCuLelJShU8+2bNC:uwoc4R4CIul6dWIGOUeW+iHRJL3hNF+9
TLSH
T1D952D0BCA59C5379D30F0AF9EEB3D204D46B48E74C6AC73349601960395F1EB127A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSS.log

Path C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log
Size 64KB
SHA256 a6eb4d4e2b11e41b8607763dc4044637a3915f5a2cadb2405197d7282dd83c48
MD5 2e9e7bce84a2bc4cbb39c60fbd7491be
SHA1 076f8d56daa658ac50d010c4b5bc59408f4efbde
SHA512 98a04f778100cae6b6398baf51918bcfba238e6e195750aaee18fb32d2260d61c326ba611c9583a85b154dbb1eb2909826b6726974e93be6ac4066e80b2c7ee9
SSDEEP 6:fWID//YhYDhP5c23qC59hYDhP5c23qC5FotUilO+B:fnY6Ph6CX6Ph6CwVlOW
TLSH
T145535E07921605B2CD369D3D994A7B305739F50531994355408A50A9DE852156FB1CF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1340-339-0x0000018F4F220000-0x0000018F4F2FE000-memory.dmp

Download

memory/4992-226-0x00000228BE7B0000-0x00000228BE7C0000-memory.dmp

Download

memory/4992-248-0x00000228CF560000-0x00000228CF561000-memory.dmp

Download

memory/4992-245-0x00000228CF560000-0x00000228CF561000-memory.dmp

Download

memory/4992-244-0x00000228CF550000-0x00000228CF551000-memory.dmp

Download

memory/4992-243-0x00000228CF550000-0x00000228CF551000-memory.dmp

Download

memory/4992-240-0x00000228CF4C0000-0x00000228CF4C1000-memory.dmp

Download

memory/4992-242-0x00000228CF4C0000-0x00000228CF4C1000-memory.dmp

Download

memory/4992-238-0x00000228CF440000-0x00000228CF441000-memory.dmp

Download

memory/4992-230-0x00000228BF160000-0x00000228BF170000-memory.dmp

Download

memory/5892-413-0x000001C2A0D10000-0x000001C2A0DEE000-memory.dmp

Download

memory/6084-529-0x0000016B953D0000-0x0000016B953E1000-memory.dmp

Download

memory/6084-524-0x00007FFF5F9B0000-0x00007FFF5F9D5000-memory.dmp

Download

memory/6084-507-0x00007FFF640D0000-0x00007FFF640E4000-memory.dmp

Download

memory/6084-509-0x00007FFF63DB0000-0x00007FFF63E82000-memory.dmp

Download

memory/6084-510-0x00007FFF5FDF0000-0x00007FFF60086000-memory.dmp

Download

memory/6084-508-0x00007FFF63E90000-0x00007FFF63EA1000-memory.dmp

Download

memory/6084-506-0x00007FFF60090000-0x00007FFF60420000-memory.dmp

Download

memory/6084-505-0x00007FFF640F0000-0x00007FFF6411B000-memory.dmp

Download

memory/6084-504-0x00007FFF72B50000-0x00007FFF72B72000-memory.dmp

Download

memory/6084-503-0x00007FFF733D0000-0x00007FFF733E9000-memory.dmp

Download

memory/6084-501-0x00007FFF60420000-0x00007FFF606D6000-memory.dmp

Download

memory/6084-511-0x00007FFF60A40000-0x00007FFF60B28000-memory.dmp

Download

memory/6084-515-0x00007FFF63A10000-0x00007FFF63A28000-memory.dmp

Download

memory/6084-500-0x00007FFF73A10000-0x00007FFF73A44000-memory.dmp

Download

memory/6084-530-0x00007FFF545C0000-0x00007FFF54805000-memory.dmp

Download

memory/6084-528-0x0000016B953B0000-0x0000016B953C4000-memory.dmp

Download

memory/6084-527-0x00007FFF5F8C0000-0x00007FFF5F8D2000-memory.dmp

Download

memory/6084-526-0x00007FFF5F8E0000-0x00007FFF5F8FB000-memory.dmp

Download

memory/6084-525-0x00007FFF5F900000-0x00007FFF5F9AB000-memory.dmp

Download

memory/6084-502-0x00007FFF79AF0000-0x00007FFF79B01000-memory.dmp

Download

memory/6084-523-0x00007FFF5F9E0000-0x00007FFF5FA2F000-memory.dmp

Download

memory/6084-522-0x00007FFF5FA30000-0x00007FFF5FAC8000-memory.dmp

Download

memory/6084-521-0x00007FFF5FAD0000-0x00007FFF5FCDB000-memory.dmp

Download

memory/6084-520-0x00007FFF5FCE0000-0x00007FFF5FCF1000-memory.dmp

Download

memory/6084-518-0x00007FFF639C0000-0x00007FFF639DA000-memory.dmp

Download

memory/6084-513-0x00007FFF63D60000-0x00007FFF63DA1000-memory.dmp

Download

memory/6084-512-0x00007FFF5FD00000-0x00007FFF5FDE3000-memory.dmp

Download

memory/6084-519-0x00007FFF62BE0000-0x00007FFF62BF1000-memory.dmp

Download

memory/6084-517-0x00007FFF60A10000-0x00007FFF60A3D000-memory.dmp

Download

memory/6084-516-0x00007FFF639E0000-0x00007FFF63A06000-memory.dmp

Download

memory/6084-514-0x00007FFF63D30000-0x00007FFF63D5F000-memory.dmp

Download

memory/6084-533-0x00007FFF60420000-0x00007FFF606D6000-memory.dmp

Download

memory/6084-600-0x00007FFF60420000-0x00007FFF606D6000-memory.dmp

Download

memory/6084-499-0x00007FF7D6750000-0x00007FF7D6848000-memory.dmp

Download

memory/6084-673-0x00007FF7D6750000-0x00007FF7D6848000-memory.dmp

Download

memory/6084-674-0x00007FFF73A10000-0x00007FFF73A44000-memory.dmp

Download

memory/6084-675-0x00007FFF60420000-0x00007FFF606D6000-memory.dmp

Download