stormkitty | hxxps://github[.]com/luis22d/ZeroTrace-Crypter/blob/main/ZeroTrace-Crypter/bin/Debug/ZeroTrace-Crypter[.]exe

Resubmissions

27-01-2025 20:56

250127-zq3zzavnfx 10

27-01-2025 20:53

250127-zn91hawjdq 10

27-01-2025 20:14

250127-yz7h3stpft 10

Analysis

max time kernel
85s
max time network
81s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
27-01-2025 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/luis22d/ZeroTrace-Crypter/blob/main/ZeroTrace-Crypter/bin/Debug/ZeroTrace-Crypter.exe

Score

10^/10

stormkitty discovery stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0028000000046361-504.dat	family_stormkitty
behavioral1/memory/4864-509-0x0000000000950000-0x0000000003554000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Executes dropped EXE 1 IoCs

pid	Process
4864	ZeroTrace Stealer.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e9a8229c-f6c9-4907-88a3-00485483f759.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250127205317.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZeroTrace Stealer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
1700	msedge.exe
1700	msedge.exe
2400	identity_helper.exe
2400	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
4864	ZeroTrace Stealer.exe
4864	ZeroTrace Stealer.exe
4864	ZeroTrace Stealer.exe
4864	ZeroTrace Stealer.exe
4864	ZeroTrace Stealer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4680	7zFM.exe
4864	ZeroTrace Stealer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2764	7zFM.exe
Token: 35	2764	7zFM.exe
Token: SeSecurityPrivilege	2764	7zFM.exe
Token: SeRestorePrivilege	4680	7zFM.exe
Token: 35	4680	7zFM.exe
Token: SeDebugPrivilege	4864	ZeroTrace Stealer.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
2764	7zFM.exe
2764	7zFM.exe
4680	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4864	ZeroTrace Stealer.exe
4864	ZeroTrace Stealer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 3036	1700	msedge.exe	82
PID 1700 wrote to memory of 3036	1700	msedge.exe	82
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 3492	1700	msedge.exe	84
PID 1700 wrote to memory of 2584	1700	msedge.exe	85
PID 1700 wrote to memory of 2584	1700	msedge.exe	85
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86
PID 1700 wrote to memory of 1688	1700	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/luis22d/ZeroTrace-Crypter/blob/main/ZeroTrace-Crypter/bin/Debug/ZeroTrace-Crypter.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff88e1b46f8,0x7ff88e1b4708,0x7ff88e1b4718
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff7531c5460,0x7ff7531c5470,0x7ff7531c5480
    3⤵
    PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1639168332979357346,9686815218073553147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3524

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ZeroTrace.Stealer.2.0.0.0.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2764

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\ZeroTrace Stealer 2.0.0.0\ZeroTrace Stealer.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4680

C:\Users\Admin\Desktop\ZeroTrace Stealer 2.0.0.0\ZeroTrace Stealer.exe
"C:\Users\Admin\Desktop\ZeroTrace Stealer 2.0.0.0\ZeroTrace Stealer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
254fc2a9d1a15f391d493bff79f66f08

SHA1
6165d5a9de512bb33a82d99d141a2562aa1aabfb

SHA256
2bf9282b87bdef746d298cff0734b9a82cd9c24656cb167b24a84c30fb6a1fd0

SHA512
484a1c99ee3c3d1ebf0af5ec9e73c9a2ca3cf8918f0ba2a4b543b75fa587ec6b432866b74bcd6b5cdd9372532c882da438d44653bd5bccdbc94ebc27852ff9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5408de1548eb3231accfb9f086f2b9db

SHA1
f2d8c7e9f3e26cd49ee0a7a4fecd70b2bf2b7e8a

SHA256
3052d0885e0ef0d71562958b851db519cfed36fd8e667b57a65374ee1a13a670

SHA512
783254d067de3ac40df618665be7f76a6a8acb7e63b875bffc3c0c73b68d138c8a98c437e6267a1eb33f04be976a14b081a528598b1e517cdd9ad2293501acc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
20KB

MD5
edff034579e7216cec4f17c4a25dc896

SHA1
ceb81b5abec4f8c57082a3ae7662a73edf40259f

SHA256
5da4c64f6c1ff595779a560e215cd2511e21823b4e35d88f3ba90270d9244882

SHA512
ab2dcd1628a0d0cadf82eebd123526979e8cf0a2a62f08f1169d4c03b567eca705bd05a36e5ffa4f6c3df393753b03e3daa18122955dde08fd8e5b248694e810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7c6c8925409da1cd274323d7c4bd0886

SHA1
4bbe7adeb95993a0815c0a9fdb39856b21cc5616

SHA256
1ef0e4a1c3920ba4f65a6791313f5bd48002f8d7ac21429c4a1508afe36b628e

SHA512
94a7d72c4b311338414aa2bd784f91c76ebc931313ca968f16b4498f610060c23bc23b6badb8ebd4a1ac41885eb00288e799c941021479e8cd46101952883694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b1de27219fd3fc40bc1f0278d175d777

SHA1
3faee866fdb27f7f8844c29c646b767d9fa997e6

SHA256
10f2cda6cac169b6a24075c27060407e79747cc43bf714264c2382545a5f71ca

SHA512
25bc71e6b02d6d99ed148449f391a546dd8fea33cf34ee917f85df48ad9a10e83dfac9c9b481860a8a64cf109ce1ef3e0742d33d5ac199588e4d430ac4dda9e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
30322550d9f9c54f345ea1c71f3b2e8f

SHA1
b5a3cff2995147279c2bbed7c03b2280ecb286e5

SHA256
4e7798d8476361378f8fbfb0442db63c7f6bf7e1830d50808bfdb8a58700d8f9

SHA512
261d1f5bc9c8a369f815eb846c252f54681f70862153bd49959411450870207b3ee240cc9016533c27401922527d561cc1ea7bb23708e4a257f071d010cf55ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe589d16.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9991be605042d1798f29e814138a8bab

SHA1
7338508531e177055e2d0e36889ef63ae220b3b0

SHA256
c1c6b5eb6ed154cde2f14d410b117dc896f77fb9985f76517349aeaf8323b041

SHA512
f8c8500fdd83fe8d7540b4fbd568eb5290546e25d818bd583963bc51f71b760e4d586dcec9384216be68a9f5b57575bbd8a37cfe518217787ec9434fdfd007dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca2acbd8a62e2fdb89b912784043e198

SHA1
a678a43a77ebd6f80ecf435746d7b2306061c6bd

SHA256
62fab5dab95fdf2de36a7f9f2d4f01348c867c107985eb0aff76495cb6319559

SHA512
60cee6afc06247ea68096b6a784d2b12d5b8503133313b1325302f9ed86bf20864232749404fe54e35fb20010cc7402f17495f10c6bcd8cbababf7a08dc0ab8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9aa92a7c618993880635391c3b76f793

SHA1
f45f739dd8ff7c50eed211cbea4a4599dfc388aa

SHA256
2d8b7167630cdec989c93b1c3d90b63dc3d63cd89f3e6e1df8386a53b264bdf8

SHA512
e877a49074c83759235bdf66223462f614c55aab452a3ed39e4a0e204e479009adae024c602c5e55f3607aac5031f742948e95c6b78faae2a68ef16ac95b7c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2b98f7f7e65d17978caa8eab69fa9ae

SHA1
4155beaef49ab59ee647ed9e9aa1afbe11b553be

SHA256
90a037d1083fde8f0ee1132d085570fed91a0ee565ce9694f045d4444f5022f6

SHA512
3d1b701c73525a17e1d9e1dbcfbd6cb76912294fe08963bca5164bade8e7094127269d16173551b12581331c9f1fa0c0a2a7610e1fa52d55b91f01024e59e995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
48febe0b0625901956573dfb2378e7ed

SHA1
c324173a8f8fd7a6a7398f6bb24dd2ee11d3cf24

SHA256
f0fae7ad33efdd05845d0d631ce8341ea4b6dfd4c45be844f0c117738df9c0d0

SHA512
fc38a0c64e67e3b5d43f787fe86f700e6f753d8e90bcebc446d4a8c631b9e4362a74fa862a5b2ffc74f3f5236d3ecf006b341042b5469d1cc24f2c325a607a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc3a0ca62cfef580ff9ebbb7afc92b9b

SHA1
fde9832ce521fcd53850d0701a543ef75b772e3b

SHA256
b0203fb7c3812937e92ac04ad6065a2129bc165a36a60a4d2fdb0accc4499464

SHA512
fc1f3a5bd2106d9b6ed5a678c2f4978550a0d7414172b0ce6954a835b0da01ac28c177955a48c2ef56ea3d517a6672474a9cab873aeccae3f22a45ccf2d070de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
815b2ba1150462a96072ae5ddb3d93ae

SHA1
bd425f448f700fb3b48d520ae5d8f221f478f898

SHA256
824c42952580d5f2090a7f06232c2184e224d3a6140f09c3e4af6877d3d5ec5f

SHA512
41d39f671ad0cd9525e3df344e42614a28e5a8da75b65d097b7637fb3570ff5d6435f8934b82dd4d4b3f6f162eefeaf5d613efa1d5c3afdb0a3837ffbe69ae32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49b1f59ab10a7bee25c0461cf677c743

SHA1
e5fc6b492d91e837cee4b9c3c57df511e2a78c3e

SHA256
ac60f102ddb7209573083a382ed9d1c2874a8a7025c1a130ad800fdb3ce66b40

SHA512
2275ce9e3134efa41159ea1df2f09758f4850512f506abfa6e8ef4762b78a429af25a1f0f15ae82b81d66c087c14e8e62b95b2b19ae331759933bf9916dd8450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e1a5.TMP

Filesize
1KB

MD5
582adf1acf7006ca50753d23fabd76e8

SHA1
e049d86afe4a5416071157e89172cd026dd23488

SHA256
6715e13ee6c2110efddcfd02914d3351ac5eaa52ee91a7f3c1afbe31851f78b0

SHA512
0fdb7dd78b0062a09e1bed6f349f0debf1c5c145d2838c44701b216d3625f66e9971c1da7a502ef076dc7ec2ede6c1c2305b34baa6fc8a01afd875a2fbb21bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5e1873a00683f0f8ef274a4c35b93979

SHA1
643a7a1d054796495b868b2a8d027fe79e6caacc

SHA256
fbd400b5adc8e84a45d9fa5a2e9d7c18a293026882eace2a9fc283f2c019a44b

SHA512
1108c2a86665f21a319a32be9b2b9c812c6ce732b87086bc4860271915d24280ab86a5b9454f713f62dfb0f736d1ea908aeb142b9c7e8b200f53ba782fb362fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ad5dd0a5b6d27008790ba12bdc8da8fb

SHA1
0e0c3a106e6a06f74e48f112b0578154a7e0e6de

SHA256
8f594a5742ca8ec45873ba2cfb82e303f06e27dab86f9e31215340e83c676042

SHA512
e91893be33b89a66c66ef0ef87c79ed41c271274b1066ba3a8f23c16d6bc650d34463fb761df62c7e99798d8904bd4e4c5043735b9d48cb5b163d6b96f662bdf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
cfdc0fef4ca4e550ef246e1badb03fd0

SHA1
27fe966f6553a148c9d70a30f92331b0f1f421a7

SHA256
ab24b62cb44580bd1088d7c306e6b582a93ac6e53760542435d4773b059902f4

SHA512
a8b49c49506fecdcf23287c3b606ebe450be7495df62bf954397cd0184005cd1aa32ba0ca9f7db8fbff211a9dea8b68edc743978df748102f517c7b80586d6b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5dedee891c9fd7ea3cecdd8b7e3724cd

SHA1
19b714dae7a96cb672fa440ac670aa30e730b94a

SHA256
2865e66f9f4cd6b87b7b22a5354be18b3f1e7648da5c0f9f57045bb735617c0c

SHA512
25ac0d3ae10a477228d1f2d3c8368fcdec5ad0edff0fae5e669e80da93048abff0a36f1cd4251ba9c268e6c92ebd9aa77c21fcf3466e4d18348304a90c833a0e

Download Submit
C:\Users\Admin\Desktop\ZeroTrace Stealer 2.0.0.0\ZeroTrace Stealer.exe

Filesize
44.0MB

MD5
e12a9756340e3deefa10418a32ba0f74

SHA1
e2410cdd75a5d7c9db63c97804b1e153e7e6e42c

SHA256
7de54534590bddd9a0076f8a45bf558e66df42b7c15fe7c367956c9fea92d8fe

SHA512
db863ce7a5b81317f12c24b7d310692c29e017e82af5b2a9de2c2fd4d6c95b7a68e5624f60be9233d57a77ce11e39f0e7a3b08403e787d20bef21f747b709b91

Download Submit
C:\Users\Admin\Desktop\ZeroTrace Stealer 2.0.0.0\ZeroTrace Stealer.exe.config

Filesize
1KB

MD5
d6580e30f9677b44b8533d65499d1273

SHA1
2a977e5f66f5017c4b25309650e830df46412ae0

SHA256
1b7568f2437f88ec3fb1e71bd73d9c293a8f7fcf6c96e84a7525cecf55d562e7

SHA512
7e71e9ee7e79f4bec97fc1e964b2fd9a96a60855f6020b4389861382457f7b7d570704be1e9cc894d4a644049fabd8cc1266976bce2d746b246a3cd583400945

Download Submit
C:\Users\Admin\Downloads\ZeroTrace.Stealer.2.0.0.0.rar

Filesize
42.5MB

MD5
b234f99182890d1e5f09d882f0211b93

SHA1
9d3f59acd590bc495735b5a4846d4361fcff7d5e

SHA256
e6688c79fd4af71894a3c8acad12b202be28aa01d76fc1e119f9806dec6857d1

SHA512
1b891cfafff1f4d190c4f7b91cc4d25370d914d6900674e95ba02ed63082e132c623baf49d13395a6cdb2778e3d16fb086d7e93e32185b19c6bad629351bff39

Download Submit
memory/4864-516-0x000000000A770000-0x000000000A88A000-memory.dmp

Filesize
1.1MB

Download
memory/4864-520-0x0000000008120000-0x0000000008220000-memory.dmp

Filesize
1024KB

Download
memory/4864-513-0x000000000A0B0000-0x000000000A142000-memory.dmp

Filesize
584KB

Download
memory/4864-514-0x000000000A150000-0x000000000A6C6000-memory.dmp

Filesize
5.5MB

Download
memory/4864-515-0x00000000125B0000-0x0000000012DAA000-memory.dmp

Filesize
8.0MB

Download
memory/4864-510-0x00000000085B0000-0x0000000008B56000-memory.dmp

Filesize
5.6MB

Download
memory/4864-519-0x000000000D220000-0x000000000E7B6000-memory.dmp

Filesize
21.6MB

Download
memory/4864-512-0x000000000F220000-0x00000000105B4000-memory.dmp

Filesize
19.6MB

Download
memory/4864-521-0x0000000009F90000-0x0000000009F9A000-memory.dmp

Filesize
40KB

Download
memory/4864-522-0x0000000011DE0000-0x000000001230C000-memory.dmp

Filesize
5.2MB

Download
memory/4864-523-0x00000000118B0000-0x00000000118D0000-memory.dmp

Filesize
128KB

Download
memory/4864-509-0x0000000000950000-0x0000000003554000-memory.dmp

Filesize
44.0MB

Download
memory/4864-511-0x000000000AB60000-0x000000000B21C000-memory.dmp

Filesize
6.7MB

Download
memory/4864-558-0x0000000008000000-0x0000000008060000-memory.dmp

Filesize
384KB

Download