stormkitty | hxxps://github[.]com/luis22d/ZeroTrace-Stealer/releases/tag/zerotrace3[.]0[.]0[.]0

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2025 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/luis22d/ZeroTrace-Stealer/releases/tag/zerotrace3.0.0.0

Score

10^/10

stormkitty discovery stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ca8-281.dat	family_stormkitty
behavioral1/memory/3188-284-0x0000000000CE0000-0x0000000003830000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Executes dropped EXE 1 IoCs

pid	Process
3188	ZeroTrace Stealer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZeroTrace Stealer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
576	identity_helper.exe
576	identity_helper.exe
4904	msedge.exe
4904	msedge.exe
3188	ZeroTrace Stealer.exe
3188	ZeroTrace Stealer.exe
3188	ZeroTrace Stealer.exe
3188	ZeroTrace Stealer.exe
3188	ZeroTrace Stealer.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3188	ZeroTrace Stealer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4884	7zG.exe
Token: 35	4884	7zG.exe
Token: SeSecurityPrivilege	4884	7zG.exe
Token: SeSecurityPrivilege	4884	7zG.exe
Token: SeDebugPrivilege	3188	ZeroTrace Stealer.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
4884	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3188	ZeroTrace Stealer.exe
3188	ZeroTrace Stealer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2924	2944	msedge.exe	84
PID 2944 wrote to memory of 2924	2944	msedge.exe	84
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 5084	2944	msedge.exe	85
PID 2944 wrote to memory of 228	2944	msedge.exe	86
PID 2944 wrote to memory of 228	2944	msedge.exe	86
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87
PID 2944 wrote to memory of 4380	2944	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/luis22d/ZeroTrace-Stealer/releases/tag/zerotrace3.0.0.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff796b46f8,0x7fff796b4708,0x7fff796b4718
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1675966572284430759,11620191182681174453,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3760

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\" -spe -an -ai#7zMap22308:112:7zEvent24452
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4884

C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\ZeroTrace Stealer.exe
"C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\ZeroTrace Stealer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9bfb45e464f029b27cd825568bc06765

SHA1
a4962b4fd45004732f071e16977522709ab0ce60

SHA256
ceb8f1b0aaa1ba575c3704e73fd77edf932d68c8be902b33f1ba3b1d130cd139

SHA512
f87cce8bb5489b56027f5a285b948b639a1c7b0f213a111f057235177e5bffc537627c82586736704e398a0185cf2ad8ba8cdee788531fb753a2d08f16e906c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae2a8f2ebc841509f7b978edf590d3cd

SHA1
91358152e27c0165334913228005540756c35bd3

SHA256
631550765e3db02be0709748c0634a2cfdab711cea94f5890854d0c1dfbcb214

SHA512
e52180dd175f1e6ff72d76400085869387cd70da33919de219a04dc26871e8421e93b22e7c59125c19c6ee54a8a8f742d796ac68ea9077c9dab5f03b80967d11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
393315186a775c1d5b676dfee57011c3

SHA1
15fdda8d7978a06390b90a468db06ebc18b3c334

SHA256
e1a9751d5e9026b0213992fdea04658b899c3135d52f38f24affa09dc88c93ef

SHA512
c366dc2cef0817fd0aa2d1ca70e6ab7bf514e3c73a82a330de6e99397b8b27d97ef2c0166c1be1b6f45e803be0a8ac083339428b64563a6cc46fbea105fa455d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
85acfb2aa5555d4a2bcf3b931970f1ac

SHA1
b9ce2a134ef93a1cbdcbc65f4d76cd3fddc625f8

SHA256
fa1aad0fa60fd4786fc656ca1aea7a37acfc29777e164044a060bec033e1077f

SHA512
f63daad4115d8a7df3006352983aea15d5a9e376d09d1423178bff5ce51d5cb6ec69cebfcd62726778fa361cc497f4480f8be276a0ed55c6419fe8cd1e29acde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7337456c608e46fc0f80e676690223f

SHA1
876e7737108176682c096a70a19b908ac06a78a9

SHA256
92b016d24cfecb10038cdcc276733e44eeb3e5a97941982a7ec4b34eb6552d90

SHA512
015749c57f9eef33bb982f850be5487f995b9c4290243989b43641efc93a529042177bf2d179b753769e1a258fad366a641988ca9905852ec49db45f40e5c58f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80020334e8918b85514773be1ea919a4

SHA1
00d1dc076ad06b2b51fce616eab7240f6c4a5897

SHA256
2fb81f921ef789ac8abf421b5f91b4cf5d586f9d0fa90643f77a468d034186ef

SHA512
09da6d29f851beee13e3d20a7fa738bb0d5584944bcd35c0dd5e923f840f30df7190b0a62a3eee10e73b542c1d30626480c5d8843df03dc76aa0fd5e8a3da05a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75e54b1d54251fc8adc014bbc961b24c

SHA1
24446220792c82c733be7186cc2f833834343c26

SHA256
bb353e747e91fa701d3512aa4b059a8385939d0522af580023c14855b708c9be

SHA512
e59bb4f2e1a5dd448c8d6144566bd6f0ab44bda5933b64f313239e4f763c68b53207c1c013f9ef09070dceee08aed24098bf66c23e06b8c7369ec47e4d255fec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a00c4ed39466d96b3a94f9df12877391

SHA1
7a268c4643ce2c85d915eed04994e09b9b6a770a

SHA256
d5eb7e128539dab291c7fdec35944f2348e7d15c64239983981e955860fea24a

SHA512
3e00c44aefecd16cf4d2c03487208fbcf9768b50c9cc3d48aeb631c8b27448829f05ce10d98f1e59b3d3d6e047797cfcb0e2b7c8b047de8dbef209a9c268ee4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580366.TMP

Filesize
1KB

MD5
0fa685d3257e0ae301b48e9c2aeefd7b

SHA1
31bc38e5d4815dd48fe5af1ade99e3502ed2cee6

SHA256
74638b8d20e4229a76a5b1dfdd744767bf9da14b25f73fafa6a61258c8996427

SHA512
a50c534a2aa5e2f48f2b63b835204013f2ee8c4d8244438d113845549849f2fdc441758cb8b4843b5f7faad1267e70f862a974333782eb6142a3e12892516d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aa1e5ba46b6cc5eb97b861b6a80e3ea7

SHA1
1822baef08dc40a62ec94a412eb6c7991460b3c9

SHA256
cf513de524843ecc3a74918c8b0f0461ea9459aea18c8bc0524bb730ba71af2f

SHA512
0ffb78c0bcfd162c9807cfd0bf6f808331aaa3ba5c47e940a8449d5a9535cc1e4e0b10b29e0b0f8376fb0c5b87c1499c2b724b914f1c50455a8c5c2ce11d123e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cebe2ab31ee43893e4f7c423c9b6917c

SHA1
2d30fa75573d9d8306e2294586924aafcde1093b

SHA256
ff9775d9001bf2da9329a416127c47c692dedfc71cd92ea1a227e232d404d869

SHA512
c95b25617b62f985d6eb917496735b68d3d6ae5fb494dab4e6da96b07821704811ca8cc0c9a1efbd568dc23e423cdcc211eb43577f61dc486d08bf6e30705ff6

Download Submit
C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0.rar

Filesize
43.1MB

MD5
038ce7d123192a66eaa0665546953096

SHA1
4b86ce5260f675bae04ee537c9b0291055c93dfe

SHA256
d0eaf37ea3abe951a153679030365dcbb8645975c78d076f1fe37d48b692fa3d

SHA512
d570f8d85424eae34f2c63cb2a5c26942476cf00fbb69669933a23bcd25cda495eb2723b2b2af8e1a48469230b14d8bb2901d03f2a168184b21d5121f56b2bd8

Download Submit
C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\ZeroTrace Stealer.exe

Filesize
43.3MB

MD5
9296b5203bf25a88838ffa143b78572b

SHA1
adfc70e2e726c1903265d4326c65324cf66e23f4

SHA256
4bd7af6fd6483bb9f6e0c1881d80f6b48b4903ad61e3933c769d6921e28fc546

SHA512
4794f6b4dce9190e5fdbf78f30be41531362a75768621f92db636a6e003c400478efc6bdfeab678a8ba30a486310598025c8b8077f9668c004394bdf2ffa7147

Download Submit
C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\ZeroTrace Stealer.exe.config

Filesize
1KB

MD5
d6580e30f9677b44b8533d65499d1273

SHA1
2a977e5f66f5017c4b25309650e830df46412ae0

SHA256
1b7568f2437f88ec3fb1e71bd73d9c293a8f7fcf6c96e84a7525cecf55d562e7

SHA512
7e71e9ee7e79f4bec97fc1e964b2fd9a96a60855f6020b4389861382457f7b7d570704be1e9cc894d4a644049fabd8cc1266976bce2d746b246a3cd583400945

Download Submit
memory/3188-289-0x000000000A290000-0x000000000A806000-memory.dmp

Filesize
5.5MB

Download
memory/3188-291-0x0000000008390000-0x00000000084AA000-memory.dmp

Filesize
1.1MB

Download
memory/3188-286-0x000000000AD50000-0x000000000B40C000-memory.dmp

Filesize
6.7MB

Download
memory/3188-287-0x000000000F410000-0x00000000107A4000-memory.dmp

Filesize
19.6MB

Download
memory/3188-288-0x000000000A1F0000-0x000000000A282000-memory.dmp

Filesize
584KB

Download
memory/3188-284-0x0000000000CE0000-0x0000000003830000-memory.dmp

Filesize
43.3MB

Download
memory/3188-290-0x00000000127A0000-0x0000000012F9A000-memory.dmp

Filesize
8.0MB

Download
memory/3188-285-0x00000000087A0000-0x0000000008D44000-memory.dmp

Filesize
5.6MB

Download
memory/3188-292-0x000000000D410000-0x000000000E9A6000-memory.dmp

Filesize
21.6MB

Download
memory/3188-293-0x0000000008550000-0x0000000008650000-memory.dmp

Filesize
1024KB

Download
memory/3188-294-0x000000000AD20000-0x000000000AD2A000-memory.dmp

Filesize
40KB

Download
memory/3188-295-0x00000000115D0000-0x0000000011AFC000-memory.dmp

Filesize
5.2MB

Download
memory/3188-296-0x0000000011160000-0x0000000011180000-memory.dmp

Filesize
128KB

Download
memory/3188-311-0x0000000003E70000-0x0000000003ED0000-memory.dmp

Filesize
384KB

Download