hxxps://mega[.]nz/file/7Sx0kChA#SgBJoHNJ8vOamqb_mvQ-5LaLPR6ah4If3s6ikK3ryiI

Analysis

user interaction
yes
max time kernel
74s
max time network
79s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/7Sx0kChA#SgBJoHNJ8vOamqb_mvQ-5LaLPR6ah4If3s6ikK3ryiI
Sample260910-tg9hhat1fs

Score

9^/10

adware discovery execution persistence ransomware spyware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Loads dropped DLL 16 IoCs

pid	Process
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
3012	net.exe
2140	net1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4204	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3616	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335297872417669"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{98D82514-F92A-412A-8037-F0E1BCA1DEDD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "3"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Kirra_Lock_v1_0.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1652	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4444	Kirra_Lock.exe
4444	Kirra_Lock.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4360	explorer.exe
4360	explorer.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4208	2376	msedge.exe	81
PID 2376 wrote to memory of 3616	2376	msedge.exe	82
PID 2376 wrote to memory of 4832	2376	msedge.exe	83
PID 2376 wrote to memory of 4832	2376	msedge.exe	83
PID 2376 wrote to memory of 4832	2376	msedge.exe	83
PID 2376 wrote to memory of 3236	2376	msedge.exe	84
PID 2376 wrote to memory of 3236	2376	msedge.exe	84
PID 2376 wrote to memory of 1748	2376	msedge.exe	85
PID 2376 wrote to memory of 1748	2376	msedge.exe	85
PID 2376 wrote to memory of 1748	2376	msedge.exe	85
PID 2376 wrote to memory of 3524	2376	msedge.exe	86
PID 2376 wrote to memory of 3524	2376	msedge.exe	86
PID 2376 wrote to memory of 3524	2376	msedge.exe	86
PID 2376 wrote to memory of 4992	2376	msedge.exe	88
PID 2376 wrote to memory of 4648	2376	msedge.exe	89
PID 2376 wrote to memory of 4992	2376	msedge.exe	88
PID 2376 wrote to memory of 4992	2376	msedge.exe	88
PID 2376 wrote to memory of 4648	2376	msedge.exe	89
PID 2376 wrote to memory of 4648	2376	msedge.exe	89
PID 2376 wrote to memory of 3900	2376	msedge.exe	90
PID 2376 wrote to memory of 2488	2376	msedge.exe	91
PID 2376 wrote to memory of 3900	2376	msedge.exe	90
PID 2376 wrote to memory of 3900	2376	msedge.exe	90
PID 2376 wrote to memory of 2488	2376	msedge.exe	91
PID 2376 wrote to memory of 2488	2376	msedge.exe	91
PID 2376 wrote to memory of 4364	2376	msedge.exe	94
PID 2376 wrote to memory of 4380	2376	msedge.exe	95
PID 2376 wrote to memory of 4364	2376	msedge.exe	94
PID 2376 wrote to memory of 4380	2376	msedge.exe	95
PID 2376 wrote to memory of 852	2376	msedge.exe	96
PID 2376 wrote to memory of 852	2376	msedge.exe	96
PID 2376 wrote to memory of 588	2376	msedge.exe	97
PID 2376 wrote to memory of 1252	2376	msedge.exe	99
PID 588 wrote to memory of 1776	588	msedge.exe	100
PID 2376 wrote to memory of 3892	2376	msedge.exe	101
PID 2376 wrote to memory of 3892	2376	msedge.exe	101
PID 2376 wrote to memory of 4932	2376	msedge.exe	102
PID 2376 wrote to memory of 4504	2376	msedge.exe	103
PID 2376 wrote to memory of 4932	2376	msedge.exe	102
PID 2376 wrote to memory of 4504	2376	msedge.exe	103
PID 2376 wrote to memory of 4504	2376	msedge.exe	103
PID 2376 wrote to memory of 2632	2376	msedge.exe	104
PID 2376 wrote to memory of 4776	2376	msedge.exe	107
PID 2376 wrote to memory of 4824	2376	msedge.exe	108
PID 2376 wrote to memory of 4808	2376	msedge.exe	109
PID 540 wrote to memory of 4444	540	Kirra_Lock.exe	113
PID 4444 wrote to memory of 4440	4444	Kirra_Lock.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/7Sx0kChA#SgBJoHNJ8vOamqb_mvQ-5LaLPR6ah4If3s6ikK3ryiI
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffd18fbc188,0x7ffd18fbc194,0x7ffd18fbc1a0
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,12205272694339739648,11339651898836055031,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,6740207113913599458,14045868896753485237,262144 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,8571908528982109776,5408833900392579250,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:13
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6834322143093236272,16941964407220734057,2097152 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,4034633072743330465,11333248633030532429,2097152 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,2108085173126696660,16267578385671613951,2097152 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,6307677423964492008,14401963300603978466,2097152 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:9
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4244,i,12385095138151530242,15896788227100518432,2097152 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=1528 /prefetch:9
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4220,i,3358579767880050332,10872878749795520395,2097152 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,10426478673124976972,11375683143639366466,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,3378031060953588099,12205484942422604159,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,16583558470693341397,1234772530575835539,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,13344067500282705602,10630120363319882708,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1148
    3⤵
    PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,1678883298900922277,13522120901898285308,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,1678883298900922277,13522120901898285308,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,2160098876627433837,8965527117257872555,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:12
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,4439486857593372695,697030746406075436,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4540,i,17804824875435088706,15668891278971155571,2097152 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,1519736148194166564,13420961692988792074,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,10713076696305149495,5302358357809855130,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7240,i,1230353308647432201,5244486188432060110,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,6825403677386357822,15209993369736482832,524288 --field-trial-handle=2224,i,15917850122632360220,4872367354900958131,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:14
  2⤵
  PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:960

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Kirra_Lock_v1_0\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1652

C:\Users\Admin\Downloads\Kirra_Lock_v1_0\Kirra_Lock.exe
"C:\Users\Admin\Downloads\Kirra_Lock_v1_0\Kirra_Lock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\Downloads\Kirra_Lock_v1_0\Kirra_Lock.exe
  "C:\Users\Admin\Downloads\Kirra_Lock_v1_0\Kirra_Lock.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\explorer.exe
    explorer C:\Users
    3⤵
    PID:4440
- - C:\Windows\SYSTEM32\net.exe
    net user Kirra k1rrains1de /add
    3⤵
    - Creates a new local user account
    PID:3012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Kirra k1rrains1de /add
      4⤵
      Creates a new local user account
      PID:2140
- - C:\Windows\SYSTEM32\net.exe
    net localgroup Administrators Kirra /add
    3⤵
    PID:4488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators Kirra /add
      4⤵
      PID:3280
- - C:\Windows\SYSTEM32\net.exe
    net localgroup Administrators
    3⤵
    PID:952
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators
      4⤵
      PID:4580
- - C:\Windows\SYSTEM32\net.exe
    net localgroup Administrators Admin /delete
    3⤵
    PID:3920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators Admin /delete
      4⤵
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown /r /f /t 0
    3⤵
    - Executes a command shell one-liner
    PID:4204
  - - C:\Windows\system32\shutdown.exe
      shutdown /r /f /t 0
      4⤵
      PID:1436

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4360

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a36855 /state1:0x41c64e6d
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b825960e093c505ed8b2d25208a6a3ef4eb588fd7e3f0a739f6681adec4241fe
MD5 f001f4c7632aabbc8547c40a2a9665a2
SHA1 d3257e13c3132d0536b33ef02f337f9476b1c310
SHA512 c9c2806c7593f3b769405c2676589dac1a14d13f8c6d2e67e0b14995b01f4e41d04a60b8f556d218c2168180bcb2316746a622635dc3053b54c55fbde5cf4f2d
TLSH
T185D092217B5DB082EB0A0A3188639B342A6EC94A389BC21A7122400DAD66808E3C944B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7e8eb5468eb68b1fa0b3e8edf27875a861602d46ee8dab1404507968b5ada3e
MD5 2d8972f0ae8d9fa9f8e8538a8f938fee
SHA1 6ccf5c97711c8b13385d6b1393afe80ad9cd582f
SHA512 a424e6cd13920205aa69679903670a25afce321199150dd5953a021ed922f6c14bb7dd0afc9d31730ab95a1f1a16f03353e4af4e0aa17f1a98d8d79743f7bf9c
TLSH
T135D023205DACB5D1F626153C45334710369D85473957910BB111050D8C7644293D8C9B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 366c7253ede1f6e4b982bd67575d139ca6e9e976b32a9beb3bf7001d0cb9af04
MD5 73c12cbcdc404070299c0f5f84b120a7
SHA1 0c76740046a52b517099fbfa91edf67ead53d576
SHA512 1f4dc289fa85ca61c6ab3c61f11574426bd20ddbbf30e909bd08b7c29fa8f259ba015fb93f496f63345ca61ad700ead9b6803fa41de73eb33171cb0871b93aa4
TLSH
T14061A334C2FA48A7D379C531B6D016C434338699C9AFEFE9219488F79406F19CD91B1E
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 608eba626270a44744ec7ecfe51ea98c89c0b1649c951a1067ac797bd97f2361
MD5 4d247d9c46d1d8a7284b6f329ec55b74
SHA1 d76cfe729f91efa7ec30d80601b72527eb54f7a5
SHA512 abe28c1826383c6be3e57c3e4d7c3847a1406b2c49fc16ab8fbbe930c5bb6b265f675d7cee88c63f7345a1524a0d0b5592915d2b580dd2eda81ddeafe004fdab
SSDEEP 3:MsEllllkEthXllkl2zEklA1u:/M/xT02znA
TLSH
T1144404447FC04455C70010304011D3501770F71007337753345144135DD75404C00005
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 be82dbb2e86ad2c9735e88f3bd88216f634db1a795b0c21794711bb73d65e758
MD5 6f31e48b2b1694fd5b7b6219bdf1f755
SHA1 778b41e55df7e163e2c3480de0df2e554afe9097
SHA512 a18e2c73c3f6deb20e9df356202a4921ab9bf8b6cdd9f1f2f142de2a9be1097950b4ce273a189bdd527c215bfbbccc106cc854516cb444adc5b58401b68b7960
TLSH
T1FD31BEF783B185AEDE1152F09A04AE2BCE5C0512439C7D5A86E4AF17E3B3071E101A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c250b85620255bdce893f37212a76bdf567ffabc111f6c91a768415cd9e91fa4
MD5 37253cc21d26e662cc3180c96683c02d
SHA1 f64595c8ba2e24a5d3aabec5ac79df9ba9faf566
SHA512 232701dc9f14692746a80d0853e052e867950317f7de530fb981f227593a32f975c57e1924d87794f1bb09728fbaa870f9145e9d06b3af64c7f20423d15cb09a
SSDEEP 192:sxZp9RGgyM/jK1Ml8MbW/fIsnUqIMIdpgOI/W6+WNQ1a/Y0uBH+Br8o6IgrJ:sxZzcYDW/fIsnUqIVHI/b3/5uB9
TLSH
T1D252E712AA34697BCCDBD209B955BF53D6F94573D2904D44AAFCCA1C04E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 852e81bde9c7669fc0b25269d9f9e5277c66e144934954657ebf5fbd93cd373d
MD5 49b86bf342f018e8b56cecad45dffd74
SHA1 471061c931c744718e9518c4a5b80603d30fffa6
SHA512 089be3f8a00c8ade30a3eb5aa5ea906d6247212d715e7c3b56ce5d3713cf708e6c160f5233057701ca3e647078690305c8d7a55cc932db9789f23f62511d633d
SSDEEP 192:sxZp9RGgyM/jK1Ml8ZOW/fIs1WpVUUqIMIdpgOI/W6+WN6J1a/Y0uBnUBWQy6Ig/:sxZzcYrW/fIs1WvUUqIVHI/bT/5uC/
TLSH
T1EB62C612A934697BCCDBD209BA55BF53D6F9547392904E44AAFC8E1C00E7BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 59252997e8e09354cc5954c6d870fff6196ce83709bd2a91889087258a54fee8
MD5 eea28f0f716942309dfc26e8cbc89d81
SHA1 586972dd47138618333f8bf12abbcb5800dbd389
SHA512 9641c854d27489b81ecc3a382d9415b9ad1d0f247b8a096754d2008e46f843f41b32ba12b32c8e6471c4dd338370ecfcf77fd0ec84a024fea3702dfc721233fa
SSDEEP 192:sxZp9RGgyM/jK1Ml8MOW/fIscUqIMIdpgOI/W6+WNQ1a/Y0uBH+Br8o6Ig5jJ:sxZzcYGW/fIscUqIVHI/b3/5uBj
TLSH
T1B352D712AA346A77CCDBD209BA45BF53D5F94573D2904D44AAFC8A1C04E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 c32735079f20f6deb6ab2afe133503afd8c5fe78701f000e06454480694f5ba4
MD5 cd4d9c7d67ebdfc70fd29983c820d2ee
SHA1 072cb880116fa1882557862d0d7117b839bad5ac
SHA512 d932193dbb29647189cbc0f6dd7894fecc2b13d533f9632b059b4f0d7a02bb0aab8fa11fbdf3617c4cb42d519966fb9cfa617c3f196955ecc6366d43393f459e
SSDEEP 768:S1/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060ll9rozJ:S1/Lh8dF2/kWRmAcQ3wu1jaKKjLp0Dlk
TLSH
T1EFE23A3B690CCB7E4F840EACEC266F976ED801CB96584D5447FA894C03C73EA411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 90a8c6157e3882ee80a2e7208b6cf6882f7da2c94f1f21cca1faf41581b3223a
MD5 eec5fb0b82cb5f1fe0ea2f82d685e5fa
SHA1 bdbb49dc3cd32fbb2e416511219f9e94b6251df6
SHA512 47ef6236fabb353b7a2a4c2a23d3f297e966600ba08cc981d8d6815bdb19e9903706a2704c2809ec47e8e17adfa1e3956b66eb4a9970f0de967b6f91d6124bec
TLSH
T1F8A002101E499063D545077030A7A244735148A1050916018490D19A9DD6164914213D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b050.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b050.TMP
Size 48B
SHA256 ccaadee85ee04f43ecf6a055bbf2a982b108b5aab1f224ebebdc8302ec12d7dc
MD5 7c9301ee983742460805f53c082a473d
SHA1 727fbf6e382bfc9fcdee38efd5072f13777e28fb
SHA512 63bd2fabb9860496421fcee68af5f83be534f40938d85628e3ec86ed9fd7cc59ef149a5a1a0b963d6496ff836122d22e8d07ebfd5f38e9b7d17198cf5ad9bc07
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a11135043a9439c4b9eb8c8b19bca5b39eb0fdb21fe85887d91c9222789ce302
MD5 128973409d2ee006f26056d06f2b0012
SHA1 f3638fe5be5957c9db6dcacff6cad56ab07e6450
SHA512 d958a3df8e7864cf608151af1a1c3bba70ed52b0048f1ebbb99f0e7ba2fb57be12313285bd6e4a21a4b7fce4c95a45ac702dd2bd156b24b236de469e55a2b29d
SSDEEP 48:K08I/KFGsDNIVKeL6IvKTK8DyZWI/KHKcs:K08gKFGeNKKeL6oKTK6KWAKHKP
TLSH
T1C7A1E19670BA42133C7D295C97A587771A52B2A73068E96F3FB800B51E2BE114DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1cf64868d9241bd834638372b119fddb8b3cec424d06924007e7daf6ec49d033
MD5 124bc959bd87b6d288942584d0c29c94
SHA1 e2af987fe2f3f8537f9a672d5dd762c65d6d9c5d
SHA512 d2e967dd00ea6dcc37a1164738ce8b4b81b5646f7bfc9470610ac50be37ca2f2959dd75c9ae01dcaee00b7b9f675ef72b9764cecc655fa09ef06151a7c2531e0
SSDEEP 384:mZcIh8Nr2eFA40HdA/0FptZl83IXpCAxuvzxV+MhdprBBo+:0huFWm8br4oMA4184prbx
TLSH
T1AF827D7258386C776DE7E144F84636035EF481379BC8AF40D6ECAF1E419B395031AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 bcd3066fb6190d569a849e387c77b4ab48f845f29b9efe6cafd23a5705b44f85
MD5 1867f16b0ece8ef239efc65ec59b4f3a
SHA1 14a154cf1deb90e90926391042e137a0f80b2e00
SHA512 9f513f78c9f083b100890944c6942b2f66aa420942714ef3d283f3902d49f38e067ff7aa46ffe9fbc8c4b40603a7e72906113b163c3c18ef9ca8edbec483cfa2
SSDEEP 768:qGIFWB8br4oj1xX1K7k3q48Mr4p4184prbx:qGIoubr4cR1K7k3DLr4pb+bx
TLSH
T1ABB26B7D9C686C7E44AFB308AA4E36235CB8413BC6F8DA04D7E85F1EC176658F706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 06d974b99a82cb2f6025171f8528a0c38023152718039fc3dba0d19b96ff1772
MD5 05ac27509f14b698cbb7e454c5fec641
SHA1 ec71f54f3564e56d55370b8b4e1e77f8545f9267
SHA512 4a9b800f9d238df522ef6bb109a214244351971684ba0b4466e87e2a952e1a650b6045071ee9a02f24bfadf1d6bfd947ad6b0f843baa1e6c3ffd805776399a63
SSDEEP 192:qGNO6d9402QmiUyLvqTBF2oP1Zpjzor3R1Gw1tmU6:qGNO6740S4CTBFptZl8hWU6
TLSH
T13D02D836A8783CAB9EA3AE49B44727136ED5113FDA856B44DAE41F1C40DB38C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d727a55d88ad81e472f311ddf2a5f08d53fe595da93dcca383e21ae1bc75ba3d
MD5 2e7be1fb6b2993176c3b12dae3060c91
SHA1 6c630781cd8dcd86644e51b2674d9effd3630de0
SHA512 25a30622d6b1ba93a74b063a9e348f5b39f51ac57b9f2b8dff720cda70164824c60e77d08d151146fa72b66542966a4e31d2ca804f7d8e74d609a7acb83fef45
SSDEEP 192:AGNu6d940rQmiUysqdBF2oP1Zpjzor3RJIXkQIiDjqLU6:AGNu6740dsdBFptZl83IXppAU6
TLSH
T1D012FB3698787C6B5EE3A944B04736135DD5423BDB89AB40DAEC1F1C01DF29C534A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd425b65-b141-4cff-bdd7-ea50922b61c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dd425b65-b141-4cff-bdd7-ea50922b61c2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\VCRUNTIME140_1.dll
Size 36KB
SHA256 1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf
MD5 37c372da4b1adb96dc995ecb7e68e465
SHA1 6c1b6cb92ff76c40c77f86ea9a917a5f854397e2
SHA512 926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6
SSDEEP 384:5GnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbRuncS74G5WreKWn14gHc:rCm5yhUcwrHY/ntTxT6ovq7nt+dN
TLSH
T19FF24B9467788082E46B95B4C4E3AF27FB38F4615760938F0BA4825D2F637D0E63D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\_asyncio.pyd
Size 59KB
SHA256 a7aeee08236aad92515d40c2be7aa533fe434fb6b0653caf31f774b6985b1d6c
MD5 1af12919778b622468f00db5d8fdaed6
SHA1 0113426b751855e7e68c18186ee0ef3363f6bcd3
SHA512 ab9f5303de0e1e65a03c305f4ded674cbe6ac94dcca784dfd4689d09d97bc5bd8f1dff0fa0e782511350d63296987c77146457129f1356818b2a9d9b3cddb147
SSDEEP 768:ASRkG5NWdXNC3D2zzgoAeHEQjGWqJ8O/kjOOoljTGr1IG5nepYiSyvayhI:AbG5N0XGPPvQrzifl+r1IG5nep7SyyV
TLSH
T196536B8AD29081A4D967A0B4D8A30F46E771F5904B0053DFA178D29E3F6335247FFB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\_bz2.pyd
Size 78KB
SHA256 d7faf016ef85fdbb6636f74fc17afc245530b1676ec56fc2cc756fe41cd7bf5a
MD5 bcf0d58a4c415072dae95db0c5cc7db3
SHA1 8ce298b7729c3771391a0decd82ab4ae8028c057
SHA512 c54d76e50f49249c4e80fc6ce03a5fdec0a79d2ff0880c2fc57d43227a1388869e8f7c3f133ef8760441964da0bf3fc23ef8d3c3e72ce1659d40e8912cb3e9bc
SSDEEP 1536:hwz7h8B7BjhJCZePYgl/5S8Gh2Nv0DFIGtVQ7Sygj:hwz18BrJCJglhlGINv0RIGtVQej
TLSH
T11F838C52B7A059F5F05BA27995B04357E771FD0D03A0C3BFB298426B2F13B912D6832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\_ctypes.pyd
Size 116KB
SHA256 0bd4ed11f2fb097f235b62eb26a00c0cb16815bbf90ab29f191af823a9fed8cf
MD5 41a9708af86ae3ebc358e182f67b0fb2
SHA1 accab901e2746f7da03fab8301f81a737b6cc180
SHA512 835f9aa33fdfbb096c31f8ac9a50db9fac35918fc78bce03dae55ea917f738a41f01aee4234a5a91ffa5bdbbd8e529399205592eb0cae3224552c35c098b7843
SSDEEP 3072:RW66GKh4hqyIVQoavMSuthSfrS04ep9x31IGQPm5S:Y6QKtkSu3SfrSGFBS
TLSH
T1A0C35B1B2354009AEB67407CC5B35E07DB71B85A572083CF12A4C69E2F67BA36E3E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\_decimal.pyd
Size 244KB
SHA256 fe2bccb2e204a736ed86a8d16effeafe83b30b44f809349e172142665de8458a
MD5 d976c5f77a6370cf6f28a5714bf49ae3
SHA1 79273eb123a68ba5cb91ff37ee0a82cee880c2cc
SHA512 57df90f9faf31f81f245a39a14c0784a3face4f76f00430de8cff2e86b55fa3269cd595119fd093e03709debf0888618917cae5ea5e68f43a8e928861caa01c5
SSDEEP 6144:MJFPEV3nLF0eMMCtGzohEgCmUQjYK9qWMa3pLW1AtSrYB4BRWr8k:cPgXLF035tVZCRBQC06nWr8k
TLSH
T115346C66A3490CA4DE77807498974B57FBB278944360D3CF43A48AA63F537A323BD748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\ada92cb5d92a588d1b93__mypyc.cp310-win_amd64.pyd
Size 218KB
SHA256 df449f6b7397e3a83f84d08ff38efac2c45527944221d1d6f6e78228a05c8ce7
MD5 14b9c9770f379cf015e6cd6111dd2c57
SHA1 6d5ce83ad1aad5718f272ca33cc611a5d39d1f67
SHA512 4a55e8ae5be9a60f043f2a29cbae22643c11be8c3b4bf8ef127f6c3ac4d9df7cd7ebaa370c028211aab4b7da08c592a0adcaeb3aaf5db5cdb43f9f05e7fe247e
SSDEEP 6144:xDGl2V+9r+I27dYTsxkP8VXaVlaz8fnt4HtFmiGJVMI0cwZKMY:xDGUV+9GdCJd
TLSH
T189242A3A62480025ED774279CC639123EAB3B152073156CF09D0CA756F57BEABBBDB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 650555a4c89bfa77054e453ea61f2fe9f095f15a13629f964b903ec7fc07dd12
MD5 07aa9916d3383d7e040a88665a6df67f
SHA1 549c5cd800dc3b51ffb552333777d92cddfb299d
SHA512 d4c70acb84004d27cfe5db22dddccd90217f95d6d2425bbe4359f318056817b669c98907e2679111c49ccf0321011a60cac88c7156566e825b1ea9b1a12e2189
SSDEEP 192:18VIW+NhW0T71ojDBQABJtXqnajL1dHx3tKPDG0L:18OW+NhWZDBRJxlXBtg/
TLSH
T17C322AC24BB84043E8AB6D7063E8EA477E3C67D61520411616AAF1E92C873D6EF14B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-core-file-l2-1-0.dll
Size 11KB
SHA256 2f7553fc7b0e511813ef7639cab9b2466348eeb78ffc534a12e2e271af8e7ce8
MD5 966f1686b72929b452c7c0999791d42f
SHA1 20961fd566d789b5657f65595c3a39622c569a22
SHA512 b427eea99d197889e4a4b8801a45baebd20824983f38794ef0e81723c9592c28d75f39744691f650e220208e5f072d61470add4fc99221383e0a89369de5ab93
SSDEEP 192:CVXW+NhWdT71ojDBQABJAdXqnajL1dHx3tKPDGGb/:CVXW+NhWmDBRJQlXBtg1/
TLSH
T1E1322BC28BB8A043F9AB6CB053ACE6477D3D63C3146041561599F5E92C873D2DF24BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-core-localization-l1-2-0.dll
Size 13KB
SHA256 91c4f107fe8e8c902728e131672bd6953d94964b7a0f1edcc004ae5f471a2a42
MD5 3c40a9d1ae0b5e72b2f90761a0fd49cf
SHA1 567282eedcb721a7137dde2f135704a50f3cd883
SHA512 d8f69f1c6ea2837e56c98a2591dbd3a336c40e2ad0af45550406cd00c70fbbc3d7c7594509bef4418aa45e0faf0cb7ce739e6e986ab505b4cd32ce595c236243
SSDEEP 384:1+OMw3zdp3bwjGjue9/0jCRrndbFW+NhW2DBRJIll7P6gc62:1+OMwBprwjGjue9/0jCRrndbVNr1PIf2
TLSH
T1A1520886D6E4D24BF85DE8717167E9433C3CA3890821885607E7EB6978E338AE75076C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-core-processthreads-l1-1-1.dll
Size 11KB
SHA256 093b7168f6b64c655464d9bbf51bbc29456772ff747763c112ed206e023c69cf
MD5 25cd5a26ea59e6f4c082b8945b16fc3a
SHA1 851ea9bfebbbc901edc98f928d59fb03d15a0037
SHA512 dc001828c40e4a85791644d100eea7132951b2644b59f7f147f17feac515d405313289d5aafbf147ffb1913ce855a501ae79acf832c32ed08d348352c80e9cf3
SSDEEP 192:1FDfIeOW+NhWkCT71ojDBQABJwcVYrqnaj9RlaHV:1FDfIeOW+NhWkzDBRJw5rlBR4H
TLSH
T1BD4219C15ABC5083F8D76D7032D9F6033D3EE7C61830842616A9E2A92DD7386EB04B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 ca9f1319ba004b82b4445f8bbee2ef67b74be6c39fe4e043f14b12c42a62f705
MD5 6b9e8a0da794b28096305c1a081b5a97
SHA1 880271c1424e8b6e003e7339adab6a4211b6001b
SHA512 1198638501a22b6519da634b8698e5a08d167b69a15cea7ceed53a06266b261792560eb3f04be82e47e234a45c53c8754e6f1663af2c6903a8cbce6d9ae28b59
SSDEEP 192:1ntZ3DW+NhWVDT71ojDBQABJw6qnajLQvTP+8jgiKma:1ntZ3DW+NhWWDBRJw6lvQyUgiKma
TLSH
T150422AC68BA89543F956AD7003E5F9837C3D67C51860486506AAF2AA3CD73D6DB00F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 f5f5e3cfa9237bb04bd485f28cecd07892212335648d32e9e3e1b248784baeb6
MD5 cf403b7b90696ab2ded707ffdea27112
SHA1 8d25084c7d24143cf95303bfa0654a42d9cb0ca2
SHA512 0004a31e0982fc4007c7fdaf0d06b6d3a19dc35ca00feeb8f161b62695b063bb07fb409c0926a1f95a4698ca57c22f773d9a431eee586633b075366de0cbacca
SSDEEP 192:1inW+NhWbT71ojDBQABJzOqnajLQvTP+8jgiAF:1inW+NhWoDBRJqlvQyUgiAF
TLSH
T104321AC28BB84043EC9A6E7013A8E9877D3C77D61830855A059BF59E3C877D6EB10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 9165248996814b72f6a334750e65994b39f971267ffc95f759e529356fa3125c
MD5 ed14b64c94f543974b7fdc592fa0594b
SHA1 dc66ca3de44c021d89ebd5160c447aaedc565514
SHA512 5d20bedcfb8d2f603b3f27d874a9e0e3a7ca7df4809aab52b02af630c0037b37923536cc93c78c9deb014df28e378d16d67e99688f8b656e3e7bfd1e2e914dcc
SSDEEP 192:EFW+NhW76T71ojDBQABJdZqnajxcRGlP6ZqDPD:EFW+NhW77DBRJdZll7P6gzD
TLSH
T1AA42098357EC5903E5976E30A3F9EAC3BE3917C629202465455AF5A93CC73DAEF0062C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 4aea1cedd976ef15a47a3433f3a2e176b1c5e495a54497dba27247b35a1b8449
MD5 1908861649e67cdc20c563c234a89914
SHA1 471ae3b9a3b40e63c880362892865ecf8bd80f67
SHA512 dec24d5c3f31c90cbec3810290506309a1db5677022c600d3bdd2e92b73078dc6353023f2aeefa408aceac7c9f7ed5a2ff07a399b446e177ff93e5fa1b3f9353
SSDEEP 192:alUcyiW+NhWZT71ojDBQABJctYDqnajsl/cKfX:oDyiW+NhWCDBRJcyDlPKf
TLSH
T12062D64366E43F26E99F177221FED7D72A38574214A003B4C207E58C3882796BDA7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 6a3fd4b050f19ec5c53c15544b1f1b1540ac84f6061c0ec353983eb891330fda
MD5 af851dfd0d9fecb76ff2b403f3c30f5b
SHA1 30f79fb4d4c91af847963c46882d095d1f42efbe
SHA512 04509b02115ec9b5bc4ee2f90e49e799ccf85884fe1f11f762f0614a96764b8f2b08f96895c467c5b11f20273183096b2bcceb0b769df9d65b56c378cb32b0f5
SSDEEP 192:+SW+NhWHT71ojDBQABJ/YkXqnajL1dHx3tKPDGbO:1W+NhWUDBRJ/YElXBtgEO
TLSH
T170422AC24BB85143E99B6D7052B8EB877E3CA7D66810012619AAF5993CC73C5EF11B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 2def5140c289b89c9a27a2112a2cc01ad1a902944c597d6204bed4efbc09ff7a
MD5 0f143310fade4de116070a3917a79c18
SHA1 b9a092e885c73cb6d33c9e17d429ede950cf3a26
SHA512 f87104272aa2326641e46450a0333626567ab3fa85a89b81f7a7c0b1f90a47a70ea189ce3f6bf5db6bb5cccda6d190fb2276edeb44334245b210e7faca05fc60
SSDEEP 192:1M81nWlC0i5C84W+NhWCT71ojDBQABJibqnajMHxxBNT067L:1M81nWm5CfW+NhWzDBRJalI667L
TLSH
T16352198747E42D12EAA71F7221FCEBD73F3E6B8108524666801BE19839C63C17F1595E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 c4e195d297d163a49514847ef166da614499404d28bc9419e3e6a28a8e03e9b6
MD5 f97e7878a2b372291b1269d80327bbf6
SHA1 cee6f776fe0aa5a6d4854058f20f675253f48998
SHA512 475898e60ffc291362fda45ab710b9ddaf1cf5e82f66dfcc04998ded583c54692ecfcac6cc4fe21b32bdd0e4dce8ac32fd9aecca2b0b60f129415180350d7825
SSDEEP 192:lCY17aFBRgBW+NhWlT71ojDBQABJh+qnajMHxxBNT0677B:VPBW+NhW+DBRJh+lI667F
TLSH
T1524219C68ABC5943D9A36F7072E8EA8B3E3E67D128208557415BF19A3D433C1AF1062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 fe51064e0728d553d0f3e96967671f7e6ae4ebd35d821679292014dd4c3bb8e3
MD5 761ddd8669a661d57d9cf9c335949c06
SHA1 251bbcad15771d80492f1deb001491a7abb6c563
SHA512 5ad590a5f81532f8bf21fb4f62bc248e71bbf657dfb1720b2d9f1628033afe39426a1c27a89d9a06e50849bd0ed2242afa93e4cf2bc83f03a922b8204f0f4f2a
SSDEEP 192:1T9qW+NhWQxT71ojDBQABJbcFqnajLQvTP+8jgiG2W:1T9qW+NhWQqDBRJbQlvQyUgiG2W
TLSH
T1FD421A864AE81443E5926EB046F8FB877D3E77C2182548660557F9A93C833DDAF40B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 2e1664e05c238d529393162f23640a51def436279184d2e2c16cfbf92ab736c1
MD5 56556659c691dd043dbe24b0a195d64c
SHA1 117b9a201d1e8bb9e5fadeae808141d3fa41fb60
SHA512 a8d4c4a24e126c62b387120bae0edd5cbce6d33b026590ff7470d72eb171ffe62b8b2b01e745079c9a06cf1eb78a166707514715e17bbd512981792a1d2127e0
SSDEEP 384:WZVacWM4Oe59Ckb1hgmLEW+NhWvDBRJTell7P6g2:WZVJWMq59Bb1j0NS1Pae
TLSH
T1AC92D5474AD8FF67C18F17B711F08BCE6A381AA644E1B6B5C91BA0C934623C47E43A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 892e89afe2c43dd5b274abe461cb650932e8cf8ded640bc7e8e2456d08800a59
MD5 653cb5df3cec6a4a0e402b33d8aa5c08
SHA1 feb8baf43eaabbaeea4291c5620cd7626aa76fe0
SHA512 e3e673ff7b20ff7389be3299722af73a79ef8ced4a59d6b8948c6b11374703fcae16818af64338e413db3fd53d25d1d153f2d987bef6135a365481aed0c3c228
SSDEEP 1536:DW2wDe5c4bFR2JyhcvxXWpD7d3334BkZn+P+NoPKu:DW2wDe5c4bFR2JyhcvxXWpD7d3334Bka
TLSH
T1B553E5DB49E63F21E18FF7B76BFB17C91B253A0408806274EAC7556B34853A9BC43A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 52cc325a4c2158b687c95f9702f4be2e3ec41c80207e50f252f5620ba1784649
MD5 6631c212f79350458589a5281374b38b
SHA1 88be6865aac123ffbdafec32a6fba34a26428875
SHA512 e53d7bfa2639efccdb66d37957972fd1f8eb2beea3a81145588ed622501ee50261e05a06611ee7126564b11a5301b109f295d062f1a2dc1e44a2847000fd7298
SSDEEP 192:1/aitIqjd7cW+NhWfT71ojDBQABJoeONqnajsl/cKfX:1SitIBW+NhWcDBRJSlPKP
TLSH
T1A342F8C78BB81957E6675E3041F8D7877F3B93C658108135886BF19E3D82396AF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 8150a238851d7da74bc8f6f13262a8d6568373dc509f67544ab6a62398f20c4f
MD5 bbae7b5436d6d1b0fc967ff67e35415f
SHA1 f67bc165cefb119ad767b6bec27a1102c0fd2bac
SHA512 4201a8edfe303057545d04de683bbdf0acb68cf4d2e894192f899a70398df18299432c0f6caee72d917a986882bbc0585035a9b934d4579f67a1c98cc894dee2
SSDEEP 192:erMUnaPrpJhhf4AN5/KiaW+NhWRT71ojDBQABJ6qnaj9RlaHIxX:N42r7oW+NhWKDBRJ6lBR4HIx
TLSH
T10C72F98756FC3F63E9872F3322F9D7C71A366382152045798897E0C93882385FE5721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 de44561e4587c588bc140502fd6cd52e5955abeec63d415be38a6d03f35f808f
MD5 53e9526af1fdce39f799bfe9217397a8
SHA1 f4a7fbd2d9384873f708f1eeaeb041a3fbe2c144
SHA512 8167ee463506fe0e9d145cc4e0dc8a86f1837ae87bc9efe61632fb39ef996303e2f2a889b6b02ff4a201faf73f3e76e52b1b9af0263c6fcfdac9e6ea32b0859f
SSDEEP 192:1/rjrvIDmMSNuWYFxEpahysW+NhW8T71ojDBQABJ+qnaj9RlaHD:1j3vAmiFVhpW+NhWRDBRJ+lBR4HD
TLSH
T18882D68785EC3F02E28B8B732AFAFBDB1735438224107579C507E4943ACA3997E07559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 038b93e611704cc5b9f70a91ebf06e9db62ef40180ec536d9e5ab68eb4bb1333
MD5 eccf5973b80d771a79643732017cea9a
SHA1 e7a28aa17e81965ca2d43f906ed5ab51ac34ee7c
SHA512 b95f5efc083716cb9daba160b8fa7b94f80d93ab5de65a9fb0356c7fb32c0d45fe8d5d551e625a4d6d8e96b314bae2d38df58b457b6ced17a95d11f6f2f5370e
SSDEEP 384:jsx0C5yguNvZ5VQgx3SbwA7yMVIkFGlrW+NhWqDBRJD1HlI6674:m5yguNvZ5VQgx3SbwA71IkFKN71Pc66s
TLSH
T13382B34346F83F51CA8F5BB359FADBC72A384F5225401375C467A5CC38427A2BE6BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 957177c4fe21ae182dfe3a2a13a1ff020f143048fc14499ae9856e523605083e
MD5 090dd0bb2bddee3eaae5b6ff15fae209
SHA1 ddc5ac01227970a4925a08f29ba65eb10344edb1
SHA512 2e0b8567231e320b2e52af3b86047cfab16824e2db1d1bb17bafe7a1c6c5f0bf62d76656206a3d7ef1d3849b479bf5e09db1f0f4e4cd0aa2df09838d35c877f3
SSDEEP 192:VuO/z7kzFDqpW+NhWTLT71ojDBQABJNqnajxcRGlP6Zq14:VPEzgW+NhWTYDBRJNll7P6gC
TLSH
T1C75218838AD4BA07E9EB1B7112FDD7DB7B3813C11A9020768257D4983683385FF16A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 e7ef5d714fc21dd1aa9db0c4eefe634463eefbd5aa4454a568bfc52e04fddf18
MD5 cc337898e64d9078cb697ac19f995c7f
SHA1 2ebcfa0cdf865fe40cbaf4ffce6d3903aea47e3c
SHA512 6960fa9617514ca223b9abda9a3a6c69cf05474b3c5fec2be6c6d5f65580c7a18e129b6d207f21eb136b0737481107e09c20b0398826284ce5f9a65a3cf8a1ca
SSDEEP 192:aBfHQduPW+NhWMT71ojDBQABJX+4qnaj9RlaH:aBfFW+NhWhDBRJX3lBR4H
TLSH
T126422AC60AA86943E69B2F7063E8E7837E3DA7C214308625056BF1993C477D2FF1162D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\base_library.zip
Size 858KB
SHA256 4a88224224ac11b73d462a4a60d851ebe3d313996e52d53ccd2832252a0a3651
MD5 d1a2e67b4efaa63b2c307835aa774043
SHA1 142834986973611a1f898bd9a0a74d9853ab4be2
SHA512 da041a26e14b91608c56dc55433235751fd62a7fcd05416d0643c051a98f4f18aaba1c9439eb4abc88159526d12cd8402b6d5d9e09712318e91a15c34964475e
SSDEEP 12288:fIJ6uBOVghgtMN4dnXFfJEfVwOfYsA4a2Y1ftlWS0Sti:OOVghmMNmfJEfVwOfYsLa2U1Ri
TLSH
T12E153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\libcrypto-1_1.dll
Size 3.3MB
SHA256 17d0f4c13c213d261427ee186545b13ef0c67a99fe7ad12cd4d7c9ec83034ac8
MD5 63c756d74c729d6d24da2b8ef596a391
SHA1 7610bb1cbf7a7fdb2246be55d8601af5f1e28a00
SHA512 d9cf045bb1b6379dd44f49405cb34acf8570aed88b684d0ab83af571d43a0d8df46d43460d3229098bd767dd6e0ef1d8d48bc90b9040a43b5469cef7177416a2
SSDEEP 49152:DTKuk2HvIU6iwpOjPWBdwQN+5X2uyWsrV4+OGyu1BYGx6KCIrA9NPe0Cs5Z1CPwE:Pg+Hb5Wt+2BoBIcU0CsD1CPwDv3uFfJZ
TLSH
T1AAF58D5AA3AC0184E9FAC17CC9574727E7B1B45A93B09BCF08B681780F17BD6263DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\libssl-1_1.dll
Size 681KB
SHA256 a594fc6fa4851b3095279f6dc668272ee975e7e03b850da4945f49578abe48cb
MD5 86556da811797c5e168135360acac6f2
SHA1 42d868fc25c490db60030ef77fba768374e7fe03
SHA512 4ba4d6bfff563a3f9c139393da05321db160f5ae8340e17b82f46bcaf30cbcc828b2fc4a4f86080e4826f0048355118ef21a533def5e4c9d2496b98951344690
SSDEEP 12288:tgH+zxL52Y1Ag5EbSJyin89m8GXfbmednWAeO6GKaf525eWP8U2lvzI:DD1Ag5h/L5mO6GVf52se8U2lvzI
TLSH
T18AE43A95ABB51499E5E6C17C8A534A33E3B6F4141330AFCF0661893E0F17BC92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\pyexpat.pyd
Size 187KB
SHA256 ac1dfb6cdeeadbc386dbd1afdda4d25ba5b9b43a47c97302830d95e2a7f2d056
MD5 f3630fa0ca9cb85bfc865d00ef71f0aa
SHA1 f176fdb823417abeb54daed210cf0ba3b6e02769
SHA512 b8472a69000108d462940f4d2b5a611e00d630df1f8d6041be4f7b05a9fd9f8e8aa5de5fe880323569ac1b6857a09b7b9d27b3268d2a83a81007d94a8b8da0ff
SSDEEP 3072:7UV1H8t//ZpdhxqMO2lr9JuB9OSH4ZCXRfWiTayyTvfvaycv0XOgeEnnRPcsR+2U:yVG/Ddh5r9JuB0SDfV9yTvfvx+Zj
TLSH
T159146B5771A6C0EAE8938038D6D78B0BDAB1B8A5439097CF12D4EB7D4F277523E28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\python3.DLL
Size 60KB
SHA256 70596aea8c5ca8f3bf88e46a0606522413b50208ec9fcc6b706f7a064cf83b79
MD5 c38e9571f33898eb9f3da53dc29b512f
SHA1 5be348c829b6dfa008d0dd239414ad388e5d7ace
SHA512 1704be273e3485013282c269fc974558683204639fccfb46e6eb640c64a0769a21572a07ee62fe1d5eb1eed4d1419f2293d6e4fd8193caafe128c6d66bd48f6e
SSDEEP 768:4st8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJ1:Ttwewnvtjnsfw9PdIGQ0P7Sy1R
TLSH
T181535D529B64FCA2DAF6A5FC38D199CD642B12CC932984DCB57993D30E1A310A127F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\python310.dll
Size 4.2MB
SHA256 b7a7f3707beab109b66de3e340e3022dd83c3a18f444feb9e982c29cf23c29b8
MD5 c6c37b848273e2509a7b25abe8bf2410
SHA1 b27cfbd31336da1e9b1f90e8f649a27154411d03
SHA512 222ad791304963a4b8c1c6055e02c0c4c47fce2bb404bd4f89c022ff9706e29ca6fa36c72350fbf296c8a0e3e48e3756f969c003dd1eb056cd026efe0b7eba40
SSDEEP 49152:wplyWz2QcN6iPdzYjz0AMs9Kt2KnX0OCpFLoFnAcECdNCsugztL0DD9fIysVHkDx:sximj29G5H+ywH+MWqlgdMW
TLSH
T16B267C22A36401A4D9B79477C527864BCBF1FC452F24D34A41A4BAD92F73BA307EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\select.pyd
Size 25KB
SHA256 1f56df23a36132f1e5be4484582c73081516bee67c25ef79beee01180c04c7f0
MD5 431464c4813ed60fbf15a8bf77b0e0ce
SHA1 9825f6a8898e38c7a7ddc6f0d4b017449fb54794
SHA512 53175384699a7bb3b93467065992753b73d8f3a09e95e301a1a0386c6a1224fa9ed8fa42c99c1ffbcfa6377b6129e3db96e23750e7f23b4130af77d14ac504a0
SSDEEP 384:NUTqPjk/7e12hwheCPHqqYBsVRXPdIG7GxIYiSy1pCQFC67hEQ:iTgUC2hwh7HqbYVPdIG7GmYiSyvD7hF
TLSH
T1C0C27F86AB605C82E463C531A5E28F06ED35B6A18760C3DF3329C15D2F12B82777E765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\ucrtbase.dll
Size 1020KB
SHA256 7a446abe717be7aec33fa31f5864c293e408d4b48cd5defa13212a207a9e5e87
MD5 5ce1730d8c2b332c2285902bc53ac5c4
SHA1 28da42431ac9f358fcdde9c81b9554e773b1a3f4
SHA512 33327e4751d5a1b496cd88a4f8c76b79d63baaf15e3e3843e09e9dc32b8acd86fef8e09fabc4498d64354a79d63e0364d3909fdd6933f75e548a07489b9ca4f6
SSDEEP 24576:ZsKxVJ/pRRK0Y/9f5rl4NbpjONcncvE4mxvSZX0yp49H:OKxDPHQ5rlQBvhV
TLSH
T11F25AF64FA5D0EA9D57BE13DC51B560FD972380247608ACF03E64BB92E2BBD91637320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000021c2\unicodedata.pyd
Size 1.1MB
SHA256 1ac171f51cc87f268617b4a635b2331d5991d987d32bb206dd4e38033449c052
MD5 d1182ba27939104010b6313c466d49ff
SHA1 7870134f41ba5333294c927dbd77d3f740ac87e7
SHA512 ef26a2c8b0094792e10ceabbf4d11724a9368d96f888240581a15d7a551754c1484f6b2ed1b963a73b686495c7952d9cb940021028d4f230b0b47d0794607d0f
SSDEEP 12288:ArlBMmuZ63NNQCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uOVg:mlBuqZV0m81MMREtV6Vo4uYOVg
TLSH
T15B355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kirra_Lock_v1_0.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Kirra_Lock_v1_0.zip:Zone.Identifier
Size 52B
SHA256 161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67
MD5 dfcb8dc1e74a5f6f8845bcdf1e3dee6c
SHA1 ba515dc430c8634db4900a72e99d76135145d154
SHA512 c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d
TLSH
T1A190025B044444440A9571C495DC9658A41F79994D4512C4EC8044D69D840AC51E452A
MD5 SHA1 SHA512 TLSH

Submit Download