hxxps://cdn[.]discordapp[.]com/attachments/1537587450308722912/1541303267739435039/txzy_pasted_paid_temp_leak[.]rar?ex=6a910e87&is=6a8fbd07&hm=857fc76bc237c03c0f22ecef0f49611c32fdd845c9d0f480fa4a1b4c191be1f0&

Analysis

user interaction
yes
max time kernel
75s
max time network
72s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/08/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1537587450308722912/1541303267739435039/txzy_pasted_paid_temp_leak.rar?ex=6a910e87&is=6a8fbd07&hm=857fc76bc237c03c0f22ecef0f49611c32fdd845c9d0f480fa4a1b4c191be1f0&
Sample260827-jds18sen2x

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PkKsQGLPpqFr\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\PkKsQGLPpqFr"	rtcore.exe

Executes dropped EXE 2 IoCs

pid	Process
4088	rtcore.exe
2148	rtcore.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1484	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322896254345138"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{0523B3D3-60F2-47DF-8C7D-5BA59BEC1472}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\txzy pasted paid temp leak.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4088	rtcore.exe
4088	rtcore.exe
2148	rtcore.exe
2148	rtcore.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2148	rtcore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2512	7zG.exe
Token: 35	2512	7zG.exe
Token: SeSecurityPrivilege	2512	7zG.exe
Token: SeSecurityPrivilege	2512	7zG.exe
Token: SeDebugPrivilege	2148	rtcore.exe
Token: SeLoadDriverPrivilege	2148	rtcore.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
2512	7zG.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 5176	5212	msedge.exe	81
PID 5212 wrote to memory of 1484	5212	msedge.exe	82
PID 5212 wrote to memory of 5460	5212	msedge.exe	83
PID 5212 wrote to memory of 5460	5212	msedge.exe	83
PID 5212 wrote to memory of 5460	5212	msedge.exe	83
PID 5212 wrote to memory of 4896	5212	msedge.exe	84
PID 5212 wrote to memory of 4896	5212	msedge.exe	84
PID 5212 wrote to memory of 5496	5212	msedge.exe	87
PID 5212 wrote to memory of 5496	5212	msedge.exe	87
PID 5212 wrote to memory of 5496	5212	msedge.exe	87
PID 5212 wrote to memory of 5832	5212	msedge.exe	86
PID 5212 wrote to memory of 5832	5212	msedge.exe	86
PID 5212 wrote to memory of 5832	5212	msedge.exe	86
PID 5212 wrote to memory of 2512	5212	msedge.exe	89
PID 5212 wrote to memory of 1612	5212	msedge.exe	90
PID 5212 wrote to memory of 1172	5212	msedge.exe	91
PID 5212 wrote to memory of 2512	5212	msedge.exe	89
PID 5212 wrote to memory of 2512	5212	msedge.exe	89
PID 5212 wrote to memory of 432	5212	msedge.exe	92
PID 5212 wrote to memory of 1612	5212	msedge.exe	90
PID 5212 wrote to memory of 1612	5212	msedge.exe	90
PID 5212 wrote to memory of 1172	5212	msedge.exe	91
PID 5212 wrote to memory of 1172	5212	msedge.exe	91
PID 5212 wrote to memory of 432	5212	msedge.exe	92
PID 5212 wrote to memory of 432	5212	msedge.exe	92
PID 5212 wrote to memory of 4832	5212	msedge.exe	93
PID 5212 wrote to memory of 1220	5212	msedge.exe	94
PID 5212 wrote to memory of 4832	5212	msedge.exe	93
PID 5212 wrote to memory of 1220	5212	msedge.exe	94
PID 5212 wrote to memory of 2892	5212	msedge.exe	95
PID 5212 wrote to memory of 1152	5212	msedge.exe	96
PID 5212 wrote to memory of 2892	5212	msedge.exe	95
PID 5212 wrote to memory of 1152	5212	msedge.exe	96
PID 5212 wrote to memory of 1152	5212	msedge.exe	96
PID 5212 wrote to memory of 4332	5212	msedge.exe	97
PID 5212 wrote to memory of 1676	5212	msedge.exe	100
PID 5212 wrote to memory of 4992	5212	msedge.exe	101
PID 4992 wrote to memory of 660	4992	msedge.exe	102
PID 5212 wrote to memory of 5860	5212	msedge.exe	107
PID 5212 wrote to memory of 1760	5212	msedge.exe	108
PID 5212 wrote to memory of 6048	5212	msedge.exe	109
PID 5212 wrote to memory of 3296	5212	msedge.exe	113
PID 5212 wrote to memory of 3296	5212	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1537587450308722912/1541303267739435039/txzy_pasted_paid_temp_leak.rar?ex=6a910e87&is=6a8fbd07&hm=857fc76bc237c03c0f22ecef0f49611c32fdd845c9d0f480fa4a1b4c191be1f0&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffeef27c188,0x7ffeef27c194,0x7ffeef27c1a0
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,9469619587607110238,11855105383500851876,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,8199632292006482135,13362997943501850184,262144 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,4123050689259382712,16881948891102859523,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,4694314129993636864,11099982673128161031,2097152 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,949481478698258269,13719940499423319375,2097152 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,11153912176900383618,9921333817137988139,2097152 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,17858908368094680516,8074829022603863682,2097152 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4228,i,17755431435823436548,11550000234561265212,2097152 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,12641021789054758313,3957969036580771909,2097152 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,16376873389629863837,3827360112953920246,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,5933215135314627466,7725114693205134457,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,8610765875788840792,2834697472967050048,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5828,i,12076422897526920562,65390361051957126,2097152 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,14662737993393784312,5607440719936789466,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,14878237215885477815,10055006095360577467,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,14878237215885477815,10055006095360577467,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,9232884727332089774,11778272770867314916,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,7580191824900793061,3218884092572784322,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1576,i,11709255005116204116,14158507453945820133,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,14251467238732922038,16123938122733223675,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,17635467279039485878,3515847039606911275,524288 --field-trial-handle=2184,i,6719222895201628638,14818186434297515743,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4596

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\txzy pasted paid temp leak\" -spe -an -ai#7zMap11073:114:7zEvent22260
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2512

C:\Users\Admin\Downloads\txzy pasted paid temp leak\x64\Release\rtcore.exe
"C:\Users\Admin\Downloads\txzy pasted paid temp leak\x64\Release\rtcore.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4088

C:\Users\Admin\Downloads\txzy pasted paid temp leak\x64\Release\rtcore.exe
"C:\Users\Admin\Downloads\txzy pasted paid temp leak\x64\Release\rtcore.exe" "C:\Users\Admin\Downloads\txzy pasted paid temp leak\x64\Release\temp_spoofer.sys"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 82e8bab473c19a5a78332b31ec4e78905694824c8333aa82d595fcadf61c8a23
MD5 da9f3743cc8a11d49675f13ddf191c1a
SHA1 e08771211cce1c36267a9a625873849756c7c08b
SHA512 89c86c6fa6288731579af89eab084977506c205b4f48d12b1fdbb90b1f72ae770edb1b63f9a81b8548ede82815275dc8bcf71371bc811b65a4d37636b6a18dcf
TLSH
T1DA71A4E8070294B3F39D52F390D10A8FB47581B9D9B32D565D90B8B6322DB64D9F8E14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dada.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dada.TMP
Size 3KB
SHA256 8ef61284afd7eb490884ada177aa6ded64db29427837b746bf0fbbe25146945f
MD5 0060eb0f0125c33c5803a85f6cfb00ff
SHA1 5fd20a43d1cd110c40a8ef79a2a957084b5118ae
SHA512 e66329ca8fa325ef074f7677b22257e6825a334e975b0b242f774d74504a171562ed6c02ca90d93ac83d73272a2c6097dce3c306b099f615d00e562292f7d298
TLSH
T1E771B4E8070294B3F39D13F3A0D10A8FB47581B9D9B32D561D90B8B6322DB64C9F8E04
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b9a9fdb41c319dff0b7bedf9fb135d27b243149a3f03320ccb66b28ba6b5248d
MD5 9faf06e28474128022d40d4ee2d416ef
SHA1 1ce830341f4918393ff3aa74407ae5125121483f
SHA512 8e990cf0979bfaf9b6f9cae95d6c39c772cb47720904172f8641a99de7d63a8c2ac019903bef54bd89155e54440f98960dca2aa02eaaeeb312c3c120ae663855
TLSH
T1AE21ACB3C7D5C56EC90616F0AB246E1BCE1D051442183C1AC9D4EF6BE7E3472E10194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 c6df371e77722b190bac90da14ed14383105f50a9f7e32c8dfed3614eb2b024d
MD5 5bd471bf8f7e489b495417cbce444a1e
SHA1 f5d875537427122c167129714b7322f8e56eba65
SHA512 1ae25bac3d0da4f5a63222d104e657b3e5ff75596b59a7550187fdb6ae79545efdfdf8b1c053753adf6a27e5577617ba15561ac88c327e7f9206185389f204d5
SSDEEP 768:7y/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VjwroNm:7y/zh8dF2PkWRmEcQXwu1jaKWjLp2tVU
TLSH
T116E20A2F284CCB7E4F844E9CEC266F976ED801CB66684D5447FA894C03C76DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 bed99a28799e8cfbde9eb83ca4b23ba3096ab6110fa468e217fd6791d2b8547d
MD5 c4538613a37c2a84efb937b489764bb3
SHA1 b5d5bf75cf5a4ea437494e95ddff7f6079d53dce
SHA512 ebc6b42f4502e05ef3522dccbbad88f625d005f330561b297d1378052316c3a3d177388551b950a53c706e85b1fd92299d98c47821b77cf74eb30edd9dee5112
SSDEEP 48:KEWIHKv3XIdK8kIPy5KI/K760jy8UrQ0SK62sKh9Iv02KiT6+2O8mxJu332DXhR:KEWgKv3XeK8kCaKwK76S+1uK2cK
TLSH
T1E3B12F9271FA57113C3D290CA29097575A4273E73068E92B7BA904B10E2FF216EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4d66a37-eb14-4061-9f45-f7549c97c765.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4d66a37-eb14-4061-9f45-f7549c97c765.tmp
Size 12KB
SHA256 50e4276a75a319aa947bba112d1391d86ea6a9267721bed6101b178d2c94701a
MD5 d0b00ce7a069ddf1c7ff6144163a2c22
SHA1 7c0b8f41c031228de9e0f7ca34b7906101bc6816
SHA512 27d5be089112607ba6d99c752ad632ea4e025026ef4dbe25ed6118ce96fc8036fa4b7c18e5972cb268d9d5833734e5bc5adf75351585d64cbf4e05839ca536be
SSDEEP 192:sxZ7RpyM/jK1Ml8Moo/fCsRIRdIdpM/W6+WNGY0a3q5DIgrJ:sxZ7FQo/fCsRIReM/bG5J9
TLSH
T1A742F8056B34A977CCDBD209FA45BF53D6F9547392900E44A9FCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd6789e0-2c3c-4861-9e1c-993f9fb0faa2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fd6789e0-2c3c-4861-9e1c-993f9fb0faa2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 dac46ceb60bbdeeb308da251d7f8fdf0ba5497763a1164c0ebcd7dc218cb3717
MD5 3d9449ae3a5c3d769be1b2b134bba0b7
SHA1 0ac6e8115c1db78dded151ad17220a9098e013a3
SHA512 f1fa9a06a0b9219b9279c1f4230dfd6da861e4170efd28862c42b81ddd52dabff42e9af55852e7f30bd7791fb261fd3b22cfd7e6f962fd72bcf41912cd0e5fab
SSDEEP 384:giFwZcI/8NH8TUNTUlIlTib2ruB5uansuOauCi+LBNj5bGoO:7FO/mwgc6zOsuOauCiWN5id
TLSH
T1AEA26C734CA8DD7B6EA6A785F94A33038FB840B7D5C5AB90D5CDAE0D019B1AC134BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4e4d8702bab65328d6ec0da42184eb3340f4bb24cf873767453800d9366208c4
MD5 c477d0c75c0de8151ea81005a6ba9c83
SHA1 69eabda2cab8f24192818e27ad4a557ab40c7637
SHA512 5663dbb0ef76fb73529c122c812db6beb17ae4c4a64cccbccaadbbfdc5bd77b960d29d220e1a170ec829f8f12caf279d964cbd94709a0cb3e6e402ff8264d43e
SSDEEP 384:IZcIF8N9cib2ruW5uansuOauCi+LBNj5bGoO:2FK6kOsuOauCiWN5id
TLSH
T1D8827D725C78AC775DA6A245F98637034FB890B7D2C96F80C4DDAF0E05DF5AC131A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5957348cf09b3e3316bcf32af505c4a44693c5bc6e0ceac8eb3ed02c30a8383c
MD5 e18690daee4e52f01dc577c4602eb697
SHA1 5fdded142a09e3fb1d404656d34f9a61ceb462cb
SHA512 444771b4abf42d30d6471a45d452e3bded20408a54b5c54caa877f26adcbe21d7559436fe8f6cf0a121d9fa89ec52b5b606c5e051ca80a3e4d4422fd17275b2e
SSDEEP 384:CZcIe8N9Aib2ruB5uansuOauhi+LBNj5bGoO:wea6zOsuOauhiWN5id
TLSH
T1BE827D725C78AC775DA6A185F98637038FB88077D6C96F80C4DDAF0E059F5AC131A83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 82701c33adbfadb20641524fc681e1c6114e5a6e76d6bcbfb5f01d86e2b804e1
MD5 41b779344c4d0c0927dea6f89a9f773c
SHA1 6c535bd5646567ccef457fe52fa63888acda921f
SHA512 8df8aa4fe0dce96b8d6936ea196bbf7d81658a465095011360a4688eea652d9fb465a368a204b4f368745b8cbc4a649e3b9633637183d7b7fe9fed93b5ecae73
SSDEEP 192:BGNpx6P2UOcQmiUyBIUJqGv0uOAwSyOU6:BGNv6eXsOIqqGsuO+JU6
TLSH
T13B02E8396D686CBB8FA2AE45B88737179FD8107BE9952F80D9E41E1C00D7A5C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2b2faa211a85fbf8a2cf4ddc561f6adaec067099295b47bcde40abb3840377b3
MD5 620d62725e2e4eb7f4943a7cf2022b8d
SHA1 bed982e31ab5241010903f8e06aa4d8b8ee779c8
SHA512 af9b930d77859541f892c10e0312f7cb20cfbc47551c8e9e51e3d8f9305305574444ee1a221219f577e72a2e6253147f25d34fbd4a1fe8b07903b771c5759a35
SSDEEP 384:oZcIe8N9Tib2ruB5uansuOauhi+LBNj5bGoO:We36zOsuOauhiWN5id
TLSH
T100827D725C78AC775DA6A185F98637038FB88077D6C96F80C4DDAF0E059F5AC131A83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ba8e3240eb61a90900e8956a9d8c838e4c9cc6dfc3fbe532726b4c9d18b1283
MD5 0e4171e8f5d42dc7f4dceaa89941ff6a
SHA1 cf7d3fd10816a374bfbc048b4ab4eff09e09959d
SHA512 8412b40fad24975f55f5f53fe9079ba7ffb83453d0d1ea81d5e53281c4fd3bf40da8f5153c1ab9604287ab1242c6a2dfe6e5ed52794870001f46f69ee58f9555
SSDEEP 192:qGNg6P2UGQmiUycEJGGv0uOaui0Bzq5U6:qGNg6el1aGGsuOauniU6
TLSH
T14A121B366CA8AC770ED26580F8C732138FE85067DA8A2F80D5DC2E1D01EF95C234B866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

461c42c5-464e-48bd-a0b0-871006208b40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\461c42c5-464e-48bd-a0b0-871006208b40.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

txzy pasted paid temp leak.rar.crdownload

Path C:\Users\Admin\Downloads\txzy pasted paid temp leak.rar.crdownload
Size 889KB
SHA256 ee811541b78da2bb8e60b6ec771e609cff7387fa39e1e469568a517f3724b6fe
MD5 34fde3335a173e48613aab5f2d78c8e6
SHA1 0fa90adc8b3596b80e8a18c3e12c18a2e69ce769
SHA512 4a6b7f90028b5dfb6cd750d5af9ecee8e3a236ac5fe53d6f9ab544ec294c8cedb909556037ff71ebafed053e6d6d335b506b770a521e9806ec0a197b7fe511bc
SSDEEP 24576:LYkPjVxuVAFotagp265YsXEGgSY79q7fM0O:L7PjS3ag865lXEGTP7tO
TLSH
T1FB153348FF7608DD1240C3938C05A2C18EA910999DDDAC4FC6B5977DA2C6B45ACFA39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

txzy pasted paid temp leak.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\txzy pasted paid temp leak.rar:Zone.Identifier
Size 238B
SHA256 9639d4c1ebff32955940b26018cc740333360a9aa3520adb962061796140129d
MD5 ee6bac7f1986a25cc3ec719a0bdd749a
SHA1 965f541cc44b819414bdecd5b4ee76ae3f8ca97f
SHA512 77d9775bceca23201dd67a70359ece27e08116cd0ca527ebef815861a28a45d052a4db49b40b4e1ff1ed4247356606d6e77295ef8754372d59e798de690ac9e5
TLSH
T1CAD09776E00540594F4BB6ECEAE314D2000DAB488E02A203C000A112AE504BE8B7CC0A
MD5 SHA1 SHA512 TLSH

Submit Download

rtcore.exe

Path C:\Users\Admin\Downloads\txzy pasted paid temp leak\x64\Release\rtcore.exe
Size 143KB
SHA256 41d79a8b6a99fc6b84020bd6780d734ecb790be5cb79623382e1a8e7afcb89e2
MD5 d11113e78cddd920f5c494707183a739
SHA1 7273079a142e5dccff6dcbe18a3261fa2b74c2cf
SHA512 8109f97a5d3dd8151b84c881fa23f4ad37616775bdd859860ca1ce686142e909ced72b30a4a3ae91877b3536a3ee176d1ff5d927c233cab12b7fb5829085038c
SSDEEP 1536:szRuyAaUcQej+TGnrhcqA6ZjVX7U1+4GAjFU0k4FKSLIuiYhsuiD0isn:sHN+TGqKZVX7BAjFU0k4MIsu
TLSH
T17FE33C16A7A51069E2B6DAB8CEA24502FB727C414B75D7CF074049B90F32BD07F3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download