orcus | hxxps://kirarat[.]neocities[.]org/

Analysis

max time kernel
100s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
03/04/2025, 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://kirarat.neocities.org/

Score

10^/10

orcus discovery rat spyware stealer

Malware Config

Extracted

Family

orcus

213.209.143.58:2095

Mutex

95c074471a264ae6acae057c3ed47a24

Attributes

autostart_method
TaskScheduler
enable_keylogger
true
install_path
%programfiles%\Nirsoft\sihost.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Realtek Audio Driver
watchdog_path
AppData\winsvrc.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcurs Rat Executable 1 IoCs

resource	yara_rule
behavioral1/memory/3872-651-0x0000000007040000-0x0000000007128000-memory.dmp	orcus

Executes dropped EXE 3 IoCs

pid	Process
3872	Kira.exe
1044	sihost.exe
5092	sihost.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Nirsoft\sihost.exe	Kira.exe
File opened for modification	C:\Program Files (x86)\Nirsoft\sihost.exe	Kira.exe
File created	C:\Program Files (x86)\Nirsoft\sihost.exe.config	Kira.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_357147470\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_1560041397\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_1560041397\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_357147470\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_380935513\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_380935513\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_380935513\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_1560041397\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kira.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133881711843081066"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2081498128-3109241912-2948996266-1000\{A5305844-D794-433E-8C28-AD9C9A0C6452}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Kira-main.rar:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4984	7zG.exe
Token: 35	4984	7zG.exe
Token: SeSecurityPrivilege	4984	7zG.exe
Token: SeSecurityPrivilege	4984	7zG.exe
Token: SeDebugPrivilege	1044	sihost.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
4984	7zG.exe
1044	sihost.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
1044	sihost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1044	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1768	888	msedge.exe	81
PID 888 wrote to memory of 1768	888	msedge.exe	81
PID 888 wrote to memory of 2388	888	msedge.exe	82
PID 888 wrote to memory of 2388	888	msedge.exe	82
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 4344	888	msedge.exe	83
PID 888 wrote to memory of 3516	888	msedge.exe	84
PID 888 wrote to memory of 3516	888	msedge.exe	84
PID 888 wrote to memory of 3516	888	msedge.exe	84
PID 888 wrote to memory of 3516	888	msedge.exe	84
PID 888 wrote to memory of 3516	888	msedge.exe	84
PID 888 wrote to memory of 3516	888	msedge.exe	84
PID 888 wrote to memory of 3516	888	msedge.exe	84
PID 888 wrote to memory of 3516	888	msedge.exe	84
PID 888 wrote to memory of 3516	888	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://kirarat.neocities.org/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ff9094ff208,0x7ff9094ff214,0x7ff9094ff220
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1724,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2284,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2296,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3468,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4016,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4076,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:9
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4092,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4148,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4256,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4264,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4224,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4024,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6040,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6084,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6260,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6340,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6116,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6720,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6876,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6740,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6364,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6520,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7028,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6548,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6668,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5204,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4464,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4972,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4232,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5920,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2040,i,7829873212044450292,6911738608810154781,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1468

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Kira-main\" -spe -an -ai#7zMap14316:80:7zEvent31713
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4984

C:\Users\Admin\Downloads\Kira-main\Kira-main\Kira.exe
"C:\Users\Admin\Downloads\Kira-main\Kira-main\Kira.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3872
- C:\Program Files (x86)\Nirsoft\sihost.exe
  "C:\Program Files (x86)\Nirsoft\sihost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1044

C:\Program Files (x86)\Nirsoft\sihost.exe
"C:\Program Files (x86)\Nirsoft\sihost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Nirsoft\sihost.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist

Filesize
105KB

MD5
6e82345aefe362b4c5071e7df6c07407

SHA1
44176a6b5c2722280699b8cc9a174d168fd4c161

SHA256
ee1ec48b6b166582c51a4141a84f48731ce18a62e4b7faeb9d60560c8f9c382a

SHA512
20c0f5862226a3eb17832e7c793f809f2333e0e0068dbe61b5865517fdd9f84bb5ca8d97bdb19a005a25b789ac75a09067350940f042fb5123cdb682ce2c98d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9bd0ac5b007ad73dc64fc096c2ad7c12

SHA1
2e81931337b2e69341a3f31946cb8b463d60d5c8

SHA256
57275605c03afcbaa07c202b492035c33d8d464990545e3f145ca58d73d9ba01

SHA512
6eb273c5d4e831b16dd00979151e4fafa17f896668ab6dbdd54aa5930ab9ef92f57fc7cb0b4bda34f40969bd8e7e1816fe511c429d281e54e3c17b43b7e4af1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d3339f3c7c06719b57f1fb5cd95ef414

SHA1
ec9d4328ef42a3ff1e667a021640f4d8cc7b36e3

SHA256
f1bc9ab87cbb0c609e6d15aff5267bd69c17065060230a7696832c461dafecea

SHA512
79c4b4f6256e588b3af9fa4808f9a298ccb78432debc24b8ecbbd43176aba93b71454ec8c57cca32c34e907ff399dce667240588c1ddbd2a6c319f4c7b1a68f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2d71c18b51036c902c4f6e3fcd7558f5

SHA1
72848433e53f1e1e9d22480291bf1ad9000f8a15

SHA256
7604816f92de249d90e354865d5779f2bb691e2e62799855b7abae43a34c382e

SHA512
e7faf0179c4a93159af88fa1739dd525ad67eb4166db0ab1be6554d3384f38a83c6d1c44e7675f211d6c0d7f655ba014a75ac43add4b3bbb0ebb3dc3a66bae3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe579da7.TMP

Filesize
3KB

MD5
202ee8a7f3704b6c4fa4c3f16ccaaf00

SHA1
2bcfdd418cfb3b6d1ca1de3999eb3049ca08cfc2

SHA256
3854e3e351559c0db6df13ee6752bce13392ff94fe573eb7813dd8b665d91d3d

SHA512
d68c474ab6f019f25fb6066d10117024a99866ca987f0b3a2a402f63f77338a93e3720380bf6b5fac9506227e91817bdc214823731b6d52502d6139cf9874a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d4d1ebba7ba78a8dcb44c7f07a3cab6c

SHA1
3088a74bca10efd65cbb740a337838b8c9a5cb32

SHA256
b82b609aacc7966ff45b0f28767c6c02ce211eb055b8abb5154fe7736f5aa3c2

SHA512
9b082ced13f2f52b62ca0116983162979d93a4ce9284c71a82ece7fd47b615bb53bd4d9a3c25f76b45f2744e3d53df3b6843da4b39d8b656ff2d73b734026093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
b1dffb75d13e26de34e8215562188628

SHA1
b0b912645b6b22660284783916502439178c6f9c

SHA256
3dfe244b9cd02b2488c153d54a96f235d7e305560dca82d6a280efd0fb43b216

SHA512
905a500a8761e2d7514b3e8b28af3515b40c265aa6c02278abe82dcf9af816c48e008bdc42dd1cd35bfd03ed114152250b419d8aea97f6d9c9ebc09ec23ce71e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
27bdfd4bcab168d71b506648d4634f3e

SHA1
65cb2a1d5248a406559bf36916cf788200de00de

SHA256
bbaebccc82345034b97092051435ceb344f48cdef75607423371780e2e572139

SHA512
d981131e7f05efcd7af6ff8835daf9aa56f125153d95969ec950d9f6c255c03f90cf1be72c343cf3faa714da53a8a97f7988867b44d0153d640b13edf21aa407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
ed27383bda79522cfda43fb1e5a7d929

SHA1
7cb782640a81b9bd0648e378a12e4917071b565e

SHA256
6abfceb46414033d4e743d6af04de1baf3da18a3658a9623a86fb0a3d7144b0f

SHA512
4178d485b01f95e8e3f3b3bbdbc3bfb0cc38b520394737bb9e2b1816efa5161fa1ef09b79b0322f27e9c2dd8cecfc8ac0a7c643fdded955025ea27a7fd74f6b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
c18827374014546ac4d926338bb7d161

SHA1
985f3d34fed53711a99a141c9838992ae5e94d31

SHA256
1a779564d52756af10a4cb084cef0e9c73d6addcfd267539a57751cafaab73c2

SHA512
2e78383df1c90c48ff1f96542c3f2b66c694b87deafc44b3c8eea2279347e411e83875b00e7cff4c36f759c5c350b96fa3d78819a2f9572f4aef03b658c471e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
876B

MD5
7d82fd6ef34729e66627cec3caf20b34

SHA1
b7611d5d7c9960f1605d94501a8410fef0ecccb9

SHA256
aa81a0c1daf82485fa573d55a408f8fb5c8b78ae1b4110320070aa4c2313e8ee

SHA512
960f1d11b33647c227c38aa412d1fe3eeaec1d79c58240f2fbb7689c5014c4ac9de82ea8d2fcfc46b72e4e354428e23172dda3c98738ae8969e8d5218ada216f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe5839a9.TMP

Filesize
467B

MD5
06608b93bc867e87e87c6b7e1ad6b2d6

SHA1
18f2c546e4acbe29339916454717b1219a149eca

SHA256
55d0df9e85f3b70937c07d081b0db3b27985f71331a687412e5422fb62189950

SHA512
56a3b8a89dab4119eb6fb2adcd1b3d95aa7391b811fdb95e332bbc9cdce0d345f195b9d2598a1a8f3d716bc61e3b6fc5ff8c42b7c4246f37fe14bd51d84e4d7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5838fd.TMP

Filesize
3KB

MD5
47430e0e9ad4838b6b88191b7966810f

SHA1
8933b4ce19e396751f93687305d3d378c48e2e0f

SHA256
98c1f419b9efe0d2a9f4350442d90916bd07593d9ecde4706030d1502cfb90d2

SHA512
e3a4e44240a11ce2173acfe66f6b52bdae8fc9c97dfdca441700ab47b5c73a46b71405da95a2cc08c34507fddf4349923c33da57da244e45b5019b9898e6b65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
4c20727bac46865b4466514da547fe7b

SHA1
3a29afb7c49a6b18015298c66add0ca0bdfb6f8e

SHA256
783903f5e85a5e8cc7a9e94d774ae255a2d7cc4ebb4a473d7a9179eee8e5ac81

SHA512
f5ca289a1c6fc5fdab6ccde507200a23145bf8e9076298ace7c52fb2ad5acd2faebc2cabfc4b09024497b11d6ce6014a849b52db9d5b750060a3bda8adcf4e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
469ff78105015db751cb333c42368c87

SHA1
ce8df45d31a23b3979862f983a7208ab8ac213b7

SHA256
d69c34965b5fe41fcadf185fc595c700e9a95fa55e9d96233eac5626e54bd045

SHA512
fdffd66fa9428716eff2fcb803c4ca79bfb97095e340a76665d5128704235bfb1835c8e5c4f57e71ba646e166e4d40cf82473f89a92b4ccd63ba99572c4cdb59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
efc4aa2736bb3ffe888042e6a8a2009c

SHA1
5a9ff2841ea5786233d414722a2a84c3a2d9674d

SHA256
88013a4d2aaffafb0ac97fb1f4a3fbeda759ae311e4b758665098308487afb08

SHA512
1597fe12e099ae233c3604c82394666ddb3e1a1a0b0b453019ed5d4e6ac52d89d7d90a476eee998cf1c0ae47cbebea6499bd9cd4ebd620955fc3adbcb5c9ef92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
a9a91bcc2df7e426b2fb1b2508f9b865

SHA1
7906c82a2aee5119dcae7687d48235041835fafd

SHA256
0580f4fd2eea01bbc57b0be3df0545b95d978e1a4578ca6f8550db1417c80dc8

SHA512
b08294016b97f404b71ae5e75daadf7175c0135a21aabc9f0546625ae5ab2c7a97a21ccdf29dd9d0cdef75bff6e89366743d14e475fcf8c1b64197617ad96df3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
5d71fcf668ff110b28d86d3ffebcefc5

SHA1
8578f815d998eccbf6553c9ef3ccf8f46e7708b6

SHA256
be0f5f307d9e3bcee453ea003f7dd430252037182ea7f1172e8c8d33a78cc9b5

SHA512
c23362f345ba99c7553b38e46d280d4d20056fba7fb34b101a0ba25c657012c0a1492a6b363867588fa9a5dfb839bc5e6caa1e9ee2160751a03c990209a92399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
da83e7ec01ddb2c64dc1e66be6b311ce

SHA1
0b300167e90b10f33ec59ed379fc1ef887fc2a51

SHA256
86b024f1772d1312e6ce96229a530b5bba002540650553b2db9943090ecf9290

SHA512
6f23af3b5df57033ce15af284c23c6b25ed6af57f54a09103f02ac8c2e28316457eaecd7e20a65b9db16cc220c308b23c1cefd4d2f1a1868eab25860d36ef9b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

Filesize
2KB

MD5
499d9e568b96e759959dc69635470211

SHA1
2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

SHA256
98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

SHA512
3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

Download Submit
C:\Users\Admin\AppData\Local\Temp\511c31b9-c402-474e-a502-668932aeb74a.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\da19ae9c-c8bc-49f6-9528-fc5dbde26db6.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir888_785387046\ee76fbe9-a9a7-4111-bbdd-943cf61683a2.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Downloads\Kira-main.rar.crdownload

Filesize
5.7MB

MD5
cfbb8e090cdcc8c488be5ccbe2a3e258

SHA1
d01ac7ce727e61ad848ae6e4158fde2181a89424

SHA256
78c64134ea8f261012e5e746b78becc2376a0a6ddc067f8bf17984bcd11fd3e7

SHA512
7ba825b6998fe60030062dac08c91781e0be9156e2051dba46da0b487a82308f5376207013e98c9101558b8e34309309184e17658a86269e2b69cca7bc22d489

Download Submit
C:\Users\Admin\Downloads\Kira-main.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Kira-main\Kira-main\Kira.exe

Filesize
3.3MB

MD5
35e41d1dc3e84b3eea60b9809199f3fa

SHA1
b8d2154bb56f0ad94effa5e8c57f4b51e345bf73

SHA256
dd3ee854f6f62c1c964b74dc71fce2da6d29bdf1b8320f5173b1bce54e7c3413

SHA512
a1cd7dc83a0304c46fdf0fe4855880f4d97a18fdef321674a4d00bade7afd8ea64530c55e1a9bd1e1ffce196ee7957f5227d42fdb9f33ecda8b8fae29d11c77a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_1560041397\manifest.json

Filesize
160B

MD5
c3911ceb35539db42e5654bdd60ac956

SHA1
71be0751e5fc583b119730dbceb2c723f2389f6c

SHA256
31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

SHA512
d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping888_357147470\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
memory/1044-764-0x00000000085A0000-0x00000000085B0000-memory.dmp

Filesize
64KB

Download
memory/1044-765-0x0000000008D80000-0x0000000008D8A000-memory.dmp

Filesize
40KB

Download
memory/1044-801-0x0000000009CD0000-0x0000000009DDA000-memory.dmp

Filesize
1.0MB

Download
memory/1044-782-0x0000000009BF0000-0x0000000009C3C000-memory.dmp

Filesize
304KB

Download
memory/1044-759-0x0000000008040000-0x000000000808E000-memory.dmp

Filesize
312KB

Download
memory/1044-760-0x0000000008340000-0x0000000008358000-memory.dmp

Filesize
96KB

Download
memory/1044-761-0x00000000084F0000-0x0000000008508000-memory.dmp

Filesize
96KB

Download
memory/1044-763-0x0000000008900000-0x0000000008AC2000-memory.dmp

Filesize
1.8MB

Download
memory/1044-781-0x0000000009BA0000-0x0000000009BDC000-memory.dmp

Filesize
240KB

Download
memory/1044-780-0x0000000009B80000-0x0000000009B92000-memory.dmp

Filesize
72KB

Download
memory/1044-778-0x00000000092D0000-0x0000000009336000-memory.dmp

Filesize
408KB

Download
memory/1044-779-0x0000000009560000-0x0000000009B78000-memory.dmp

Filesize
6.1MB

Download
memory/3872-656-0x00000000079F0000-0x0000000007A02000-memory.dmp

Filesize
72KB

Download
memory/3872-653-0x00000000071A0000-0x00000000071FC000-memory.dmp

Filesize
368KB

Download
memory/3872-654-0x0000000007200000-0x00000000077A6000-memory.dmp

Filesize
5.6MB

Download
memory/3872-652-0x0000000004BD0000-0x0000000004BDE000-memory.dmp

Filesize
56KB

Download
memory/3872-651-0x0000000007040000-0x0000000007128000-memory.dmp

Filesize
928KB

Download
memory/3872-655-0x0000000007820000-0x00000000078B2000-memory.dmp

Filesize
584KB

Download