03582e7f7717b96acf5f09435099074b0ed6b0ad479f237c6e930d318f047b5e

Analysis

max time kernel
29s
max time network
30s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/10/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spurdo crack by @lumera_win (tg) .exe
Size 55.5MB
Sample261026-xmc82avy2n
SHA256 03582e7f7717b96acf5f09435099074b0ed6b0ad479f237c6e930d318f047b5e
MD5 f451daf63dd2dd9904e196b8d5771bd5
SHA1 0c08208df3883058df1b11777f8d2ae92bf3b201
SHA512 6d90592dd75ab0476887fae9a8ce040708d8c15ed445555522929be3ba743d5a9e040572848be8968baacfbbf228b6f4c20dda1333837c32d74c15fc398deadc
SSDEEP 1572864:RD62O+PnHhBqoFEsaK1tjnzxyk7PeFHui9K5xarw2ttqeq:96T+PnHhcoFEsbrdIuGKirUe
TLSH
T151D733DDF64AA221C01ED6E679FF627D3830BF90DC926C5AFFE19D032581A143A78164
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	spurdo crack by @lumera_win (tg) .exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5976	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{DD349053-2F5A-44AD-83BB-D276C0904334}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1812	spurdo crack by @lumera_win (tg) .exe
1812	spurdo crack by @lumera_win (tg) .exe
1812	spurdo crack by @lumera_win (tg) .exe
1812	spurdo crack by @lumera_win (tg) .exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2912	1812	spurdo crack by @lumera_win (tg) .exe	82
PID 2912 wrote to memory of 1128	2912	msedge.exe	83
PID 2912 wrote to memory of 5976	2912	msedge.exe	84
PID 2912 wrote to memory of 3728	2912	msedge.exe	85
PID 2912 wrote to memory of 3728	2912	msedge.exe	85
PID 2912 wrote to memory of 3728	2912	msedge.exe	85
PID 2912 wrote to memory of 3464	2912	msedge.exe	86
PID 2912 wrote to memory of 3464	2912	msedge.exe	86
PID 2912 wrote to memory of 5520	2912	msedge.exe	87
PID 2912 wrote to memory of 5400	2912	msedge.exe	88
PID 2912 wrote to memory of 5520	2912	msedge.exe	87
PID 2912 wrote to memory of 5520	2912	msedge.exe	87
PID 2912 wrote to memory of 5400	2912	msedge.exe	88
PID 2912 wrote to memory of 5400	2912	msedge.exe	88
PID 2912 wrote to memory of 5724	2912	msedge.exe	91
PID 2912 wrote to memory of 5724	2912	msedge.exe	91
PID 2912 wrote to memory of 5724	2912	msedge.exe	91
PID 2912 wrote to memory of 3856	2912	msedge.exe	92
PID 2912 wrote to memory of 3856	2912	msedge.exe	92
PID 2912 wrote to memory of 3968	2912	msedge.exe	93
PID 2912 wrote to memory of 3968	2912	msedge.exe	93
PID 2912 wrote to memory of 4896	2912	msedge.exe	94
PID 4896 wrote to memory of 4832	4896	msedge.exe	95
PID 2912 wrote to memory of 3224	2912	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\spurdo crack by @lumera_win (tg) .exe
"C:\Users\Admin\AppData\Local\Temp\spurdo crack by @lumera_win (tg) .exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/lumera_win
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffd7bcdc188,0x7ffd7bcdc194,0x7ffd7bcdc1a0
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,2103759269838004255,1770720239691702187,524288 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,5716579099621245808,8552923863551479557,262144 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,14470858653971895113,6340131053116392638,524288 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3316,i,7251607247926603485,15883339081000574156,2097152 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3324,i,8430649835659037077,9062319351672522130,2097152 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5000,i,17440764197887783447,12325776577338732528,2097152 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12110463292351610302,2235726772870872610,524288 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,11836619385526960135,17998466831586631214,524288 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,13059653917825793395,15294942433348194246,524288 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,8443357087148938641,4744483450512916161,524288 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,8443357087148938641,4744483450512916161,524288 --field-trial-handle=2648,i,1846753615302310605,9996240617128181002,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Geist-Medium.ttf.new

Path C:\Spurdo\assets\fonts\Geist-Medium.ttf.new
Size 76KB
SHA256 335f681900d781c9be2f2cca11969174d7b85ed373a89c316fdb9a98c20ab8e9
MD5 3e3add4a622094346f14ed2e203f56a8
SHA1 faebc62bcec081e652a1e54e3f46331749a1bb78
SHA512 4bdab1bd1b17cd18e84594d2af660dbe912325757e5e9b6c2b761005f4f8b373e67f09bcb643e385a403b28a59723244ca0c5c6fcee35fbfd0954c88732c55ce
SSDEEP 1536:yn162CHpE0cuGB8r644y9V2SSIPi+FoXGxR5FLHpomJZK/MawP:y1LCJE0Hw8pESSIqovFtZhawP
TLSH
T1E9733A53BB428B05EE072E7E8671D3A0A779BC39AE29D30FF9C12A69FC871584D11354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Geist-Regular.ttf.new

Path C:\Spurdo\assets\fonts\Geist-Regular.ttf.new
Size 76KB
SHA256 2ad37212f14cf44f76ae04d2eb23461472c0a2a91eaf5e46a2579a6743a367a8
MD5 ecc9e05ed90c3ea002ff21a81164815a
SHA1 cc383978a5fa714617c8aa4d30578cc9a5bfd853
SHA512 b2a35ba1850cd47bb7f9ce4638876560c3bd0c62c7d26e51363e19ad84aa5807cec31a609e5fad3a3dc058b7119e47e05296cd33b2da752d184a79896dc087f8
SSDEEP 1536:S2CHAy0cuGB8rn44444444xMYuSrD+UCrKtLKRVSMpmcUZu8TBmEy/B+A:zCgy0Hw8dMPSrD+UCLVSMpmRTQEYB+A
TLSH
T152734A17FB535715DA432E7D8A72C3A49B74FE29AE2DD70FF8417A62E88B1690C41308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Geist-SemiBold.ttf.new

Path C:\Spurdo\assets\fonts\Geist-SemiBold.ttf.new
Size 76KB
SHA256 11b980aa9cb939288617aab0d1afa842f9000427194b5f419dc1667bdbcd68a0
MD5 d61af3611dd7e4fd9dd08f99e64ec943
SHA1 247f5bf3871ba4891843f7483bef37848b4bcce9
SHA512 9b439fc4561a03a5e7696e8312d93df5078254c03d29c323e19686cae35bcec82c06425ecd0effdfbb98d8f153f9f7aadc8d2edc3350b275c1524de3ccdb4d00
SSDEEP 1536:PL2CHCP0cuGB8rW44PZ0SrBEq3WBnjUXNFlxrox+XDd+:PKCs0Hw8M6SrBEq3W5jOVxroxcs
TLSH
T159733A17BB569305DD026E7D86B6C7A053BCBC2DBE29D30FF8927E69FC872985801244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GeistMono-Medium.ttf.new

Path C:\Spurdo\assets\fonts\GeistMono-Medium.ttf.new
Size 76KB
SHA256 c3abe0505993f3b3747ed05fffd124d110b46f96fd8b17ac69b77ad09302b970
MD5 28ef5d7e63e899b6a1329964148cb9a2
SHA1 d8bfa6203bb5360f4d5508e85320672cfdad5081
SHA512 714c7a106628a0586b1239b7adbe45933d16dd75c5fe1137f4e34c1c9ea823f87f0063017d8144337d2149d721d0b365f9430d1e1fcacf29bd00f68df17445c1
SSDEEP 1536:AbtI84VGB8Z8n/hVOz5QC8m3i22IZEqhRqa1zs6KO4xq:ALaw8GW8Mi22IZlLqa61O4xq
TLSH
T1C4731802FB135715F9120FB8527673B09364EF2B6B2BD71F9885A568AC875DC4A2C2CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GeistMono-Regular.ttf.new

Path C:\Spurdo\assets\fonts\GeistMono-Regular.ttf.new
Size 76KB
SHA256 a55c1b51cda4afeab9e471e7947b85a20f7c8831d7e6b1470c1b7fbdc0f0f15e
MD5 f84c9b172609157d69b10f78d5a27a94
SHA1 e38cca41bae7734a992897c770fe4757b706739e
SHA512 093ef00ea8bc827bebc19433b1a33668e92f525db66056a2524ed76682a689d2a31f01858a18af42c822febd2438471caca269854be9a7589479b294d9b2ea3a
SSDEEP 1536:rXh0z5VGB8Z85OmhPLqpVVga0jbYpZD4ZtoNuPh07oyqIm:rRM3w8GPOVVz0fYpB4wNu670R
TLSH
T162732A13EB125316F9420F79527377B09768EF2F3B2B971B8898B549AC872DD491C1C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tabler-icons.ttf.new

Path C:\Spurdo\assets\fonts\tabler-icons.ttf.new
Size 2.7MB
SHA256 bdd463aae8fc706301de6de489ac8429b3ccfbdee8cdf30dc18d647910ff5025
MD5 cc81d3954bfd5b8ad2d7f39ee482ca70
SHA1 81e2002943136bfddce77d8917ef6bdcefb6c000
SHA512 3cdc73b1ba9866eb15d3bc74c2497e1d6c820d5a5fd8052b035d69fd756bb1cf7b70addc3bbfc7d765f07ad254377686e5ce37910584852f9c89b11f932512c3
SSDEEP 49152:BdVBlTWZmnTjz/xyyGTmeN6gyJTffK6TDOS8g6fmkRAAq2SwrLV88rTyo/PyTQRc:Zx0TA
TLSH
T171D519CA5726C8DEB1B7A5AB4C90E04AC3D2E97C7117FC526BCD2367B5036D861F420A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat.new

Path C:\Spurdo\assets\libs\icudtl.dat.new
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13f5a67e-7edb-4b49-a681-ec7fc673866e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13f5a67e-7edb-4b49-a681-ec7fc673866e.tmp
Size 27KB
SHA256 3dcdaf74103929b78391d4feaf36a9b907d554cf4073b34e15c7f27a4608b29c
MD5 2071ac8131e97c87497e9a1164decd7a
SHA1 4c6e6a120a1b6d66aac710fe10b58181bdd272ce
SHA512 adb717f8ae2e5e11052bf1ac93dbb70c4bbfc51205be372d920e3eb08db6d351183c28ebc2aa32dae5ec7edb3204c4841dda47a7e4ffbbb71ab29e8da4130af6
SSDEEP 384:ndiFlQkUSv738NN8TUNTUlIRRwqKOebzWfg90f6HL0b7R7oVexX2INgL/7Iz8IIu:UF/73qwgsiex9q64bCVAX56Lu
TLSH
T1CAC23935ECA5DDA7ECEB8A95A38D7647DEE00163C99C8AD4E5C51D2C00C71DE270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

386b076f-6bb8-44a3-9a05-3205e5a56054.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\386b076f-6bb8-44a3-9a05-3205e5a56054.tmp
Size 26KB
SHA256 b20a3fb5e1cf302939417bf8f36523408c4b17de4ca52af459b11f24ca02bc92
MD5 e20bcb28148010cd12d47416561b9e5e
SHA1 5cb817dcb8e9fcbcf23a713db327a4918153d709
SHA512 302c98d84fbc86c3739efa5ff753faa6746c794425c0b4c208b76757df87c4db28ef70f641e6ca60f6be94b7311ed89daf2ab53978ca47fde5e6ffac506e8386
SSDEEP 384:ngiFiZcI638Nh8TUNTUlIxBwqV1vbzWfg90f6HL0b7R7oCexXsa+VYNLgL/7IzqW:7FQ636wgwWnx9q64bCCAXhg1W
TLSH
T186C25B35EC94CDABECEB8FD6A78A7606DDF01163888C9AD4D5D94D1D00871AE170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

935ffb16-8cbe-4a1b-b286-dc297e42bcbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\935ffb16-8cbe-4a1b-b286-dc297e42bcbb.tmp
Size 25KB
SHA256 2675fd3e98ead991938518e2b061efbc6317b7941e8195878becef7aa0bce8a1
MD5 037a53399da859215d6fec80a71e6c3c
SHA1 9925c54d88cfc25f0eccb5be05a63137a3efe6e0
SHA512 52b70d0695ef59bc589bca00994a4e7030a3dc8724f643d1b588e13bf0d91ac73e8b4d4a84a26998961224f2c9f00f9531b779a585cb8e07ee225a4709486499
SSDEEP 384:n/iFiZcI638Nr8TUNTUlIxBwqBFcgbzWfg90f6HL0b7R7wsa+VYNLgL/7Izqol:KFQ63wwgwOcEx9q64bdwhg1W
TLSH
T1BEC23A35EC94C9BBE8EB8FD6AB8AB616DEF00163849C96D4D9D85D1D008719E130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb58490731045c4d4ef8ae90fd5b5394608566e0de59eb2fcf0ecafd0e27c1e4
MD5 a1449147626cc89b1f49004bd7e5d7ce
SHA1 e848ee4aaefc37442c33cbecb41170227e80799f
SHA512 09a97d82a24abaaf732d89be9ab3b4434bd39ecb04c04633d236c4752119bff4b381aa75666a5cca804d38dfd7487cee9fe3800fd60f91ad3cfffc59a6e0ec34
TLSH
T1B5D02B1BBEAD02A0E11331390637420031C4E140480310188490033228C268104E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9a92cbd849eecadff108aa705c8bffeefa88b48debb99ebb0a61da60d1ea55d
MD5 3eab7477df5ca8aedeabf1695c6ec99e
SHA1 47e45efb75000cd4d9e036210864e45f420f2323
SHA512 0465738c688cb93e5238241731fb0a05395e81c567aa2fffc33a9f478454ed7814c50cbc62e962000f8c572df3a8f4d2780caaf1956dec8d990b4097d0125ee8
TLSH
T11ED02B1FBAAD12A0E12331390637420030C4E540480310188450032228C268100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

10141fe7-6cac-491b-83fd-f30662e4e638.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10141fe7-6cac-491b-83fd-f30662e4e638.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4430b758-bb22-42a0-a0d4-1958aeb8307c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4430b758-bb22-42a0-a0d4-1958aeb8307c.tmp
Size 12KB
SHA256 6538241d7f75317906addbd703c0fed84dd64531bd57b05c99353ada79b08c8d
MD5 ce200b32e04427fef70f221ccd79371f
SHA1 4a794505b36a5252c3b1075e306289ed9a709a99
SHA512 e4f4cf197cb25241e67ac0963cd5b06a1635bcf3fc6f245298dd5452e4e5beccf4e7f619d9c99611f8a9406ac758fbb8a4f6d824257f8b95bb3e49b9b6492326
SSDEEP 192:sxZQR7cT/fgsFqblctzodpw6/W6+WNcDo/Y0YwerbM+DIg5x49J:sxZQyT/fgsFolcm//b3/5RCMUD4H
TLSH
T10242F955AD28683B8CDBE218BB59BF53E3F9503295901E48E6FC8E2C05E76DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67e6e8e1-b9d9-4da3-bb7b-bd6911e26b3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67e6e8e1-b9d9-4da3-bb7b-bd6911e26b3e.tmp
Size 12KB
SHA256 bbc02050d9b0b8415f57b4fe6d53c3a2dd4bc2f3d9d54d196c6d2e695508a1a8
MD5 3d85b666d126ca60040c1ed97e2bda5e
SHA1 b1cfecff90553bdd2544e70fc09e2ab7426a70dc
SHA512 6925f1d50c66b307be532556b1f7d894be48f8555ee7d858a7ebd5ffc6a07b1d8cdded80f656dd210fd8f462bd8547c24b24caaeb061361c96fbea85996a6a58
SSDEEP 192:sxZQR7cT/fgsEqblctzodpw6/W6+WNcDo/Y0YwerbM+DIgj49J:sxZQyT/fgsEolcm//b3/5RCMUj4H
TLSH
T1B442FA15AD28683B8CDBE219BB557F53E3F9503295901E48E6FC8E2C05E76DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 579b577ab80b0bbaa1cbf44aa54941c5a4c06cb32c0a46c26b1264d74402fd3c
MD5 c25e2bafc4422eeab18607dae1244d74
SHA1 769ac247cacebed09c43d84645767bcb6907a145
SHA512 cf59de94b3e97d72da97d4154d05e1311746788d9df77e6bb19a43acde830827485a93c41c632b5137207e3f19d36f62044ebbee3948785b3615a1d156279e37
TLSH
T1A1613E849B7010A2D7A874B8A2F41C873634919E34AF1D52ECBFC5BB8CEB320B1D4093
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 585090824c8005f8c46802905f757519e2d2f4ce7745aa6524e6b0b267c30876
MD5 68da1feed03afc0141ff68bce2ea0007
SHA1 edefa04669dc6c47dedfabe8206d8b2bec14635e
SHA512 ec623be956f3373a00de2ca7a6e8ef14b41f03f5f736a3e7b61079790558960ae9fa153ae9d26045a7823eb43b08ecd57af1117866cee9fa98e9e0cf93e34ebe
TLSH
T1406120849B7010A2D7A874B891F41C873634949E34AF1D52ECBFC5BB9CEB355B1D4097
MD5 SHA1 SHA512 TLSH

Submit Download

e0495f42-3fc5-486b-b54f-71bc7e11184e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e0495f42-3fc5-486b-b54f-71bc7e11184e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

b1c46519-b004-4612-8763-a54b063a709c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1c46519-b004-4612-8763-a54b063a709c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c22fa709-8c5c-464a-838b-0ab51e2beea0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c22fa709-8c5c-464a-838b-0ab51e2beea0.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eab62b0a444810352e8f46b11819b924eb591332f5ac739658346e1c73bce61f
MD5 df6686f5a0fcf755fe5d8aeffdb784b9
SHA1 3dd42001fe155b11424aef67320c0045b34770db
SHA512 8430de9bd7d42b38f3fa63ab1a39c07fc177751a6116e341508a9e4564287d89c3ad4418825c9c0ac2e593a24699e9b89c79fa22d2b3dfe2538e808cc9e302ba
SSDEEP 96:K8cAKF62iU4K5CeWgKXqfCusKjKUUgK9a+2vOKY4nwAKtSWGVCKGQ9XKKwcO21WL:ir/+SvIrlfrljh9DdgslV9rn2J3+
TLSH
T137B2551571BA12453CBE290C81B5972F128235B33119EA2B7FFD44A68E6BE085DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a073d762-4ca4-480b-9839-958dee2aaca1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a073d762-4ca4-480b-9839-958dee2aaca1.tmp
Size 414B
SHA256 63b88fc2118f073c0333f3f8c876ae261b5253b2a1834e8497e49ae82d3f2548
MD5 0f29a4c901796aea1a8f6ee9325fecba
SHA1 05a089f937622af44a3288b35d4f8de0ac90f6a9
SHA512 9cf36fe0eace4d9b9044e7ddc4ad2ab3b4b03d95b07103a4ceacf085329f578cf0c2dfa0db4c1406a2c1a716b6337ec7a2a7870289b0ee4c0a24c8d44fca554c
TLSH
T14BE02BBAC821EC371DFC9B29A0500785E751636B2F40850F3A3D921D8FB162A02DEC1C
MD5 SHA1 SHA512 TLSH

Submit Download

e5ea1e36-4a80-4051-a0e7-b97303c58202.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5ea1e36-4a80-4051-a0e7-b97303c58202.tmp
Size 33KB
SHA256 752754b63a304936c95078ee93fd098a5252c90f9c62f3c6fcb427a00ec3320d
MD5 5d3598c9d23f1d9a0d04ecab1ee8d28a
SHA1 d9cb268dcd1beea00225fb1efaad04ba8a596be1
SHA512 a27241ff207182251e25e635bd3979c21ad002b22a310eace2fcf3ef5206f881262308992b73b646369d7c8e9c09b4a89fc3c5bfc349c0f99b64f47af241dcba
SSDEEP 768:SPcas8Tw2Hw7pLuLbXfWRmLJQt18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3qNjOLln:SPcas8Tw2H8EbXfWRmLJQt1u1jaKqNjC
TLSH
T15CF20A3B780CCA7E4FC04A9DDD16BE8B6DA8028B9698CD4447F9885C02C76EB55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3cd8676-f2a5-46bf-a0e3-8e7078dafaa2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3cd8676-f2a5-46bf-a0e3-8e7078dafaa2.tmp
Size 25KB
SHA256 a70a0b6aa035e163b15e14645e1c9a061cd9cc6f4719d9afe3065bd35bf6ea15
MD5 6bd87ba78f383f3d148cdfd9f87e0a64
SHA1 6a552ae70552c38f5406527123dd480569dd6b15
SHA512 3751d7763b0b8dd4ab84961deb0497ee97b31681b8863059684156fd95e937f3e94ac1cfa9b544b6ff2ca84283358efade10700d5c994ae6bcb11866b93d8029
SSDEEP 384:ndiFEZcIM38NN8TUNTUlIR9wqKOebzWfg90f6HL0b7R7o5exXrMg19gL/7IzfoR:UFiM3qwgsiex9q64bC5AXrMgbC
TLSH
T17CC24A35DCA4CDB7ECEF8A99A7897642DEF01163888C9AD4E5D94D1D00872AE170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

say.cfg.new

Path C:\Users\Admin\AppData\Local\Spurdo\portable\web\assets\p1\0dp6BJ6msF2a\say.cfg.new
Size 64B
SHA256 2a222308951eb1caf7d184c7c1fb9ea01998b7ef1c522a1f4ae980ec9010734c
MD5 7bdb5cbd48e8ad69215b776fc08f548a
SHA1 a9658b2768fb505b38fe6abe1e75068a78dd0fb5
SHA512 906c0a7121078330e37e2bd6f27271888d3c75220b88687d1b3ebd92a6e94fafe1607e00bbeafd7f6c9506b15ed7a9d7bb5b8d5cab29fa4fe64f286b05e1ab04
TLSH
T192A0220A0C00000083030303E08300200F280022F023CE02028E02032082E00283A088
MD5 SHA1 SHA512 TLSH

Submit Download

disabled.cfg.new

Path C:\Users\Admin\AppData\Local\Spurdo\portable\web\assets\p1\R2cNMx9jlWsW\disabled.cfg.new
Size 58B
SHA256 133c4051d96fa2a99b54d451e0a0ffdfc363aa0c21a0a681b260e60864d9befb
MD5 c7f5961a4e9eb7a30286fb7ce2790155
SHA1 67ff5dac0337a9fc776799e3f979b81a416b1ed1
SHA512 cddcc109f098cefc22e42fda2395b78a87c4b09148a020a2a566eb7017d6943f02bcdd4f4c02a948a2305c2fb465b51fc01925b6ad9d31a551b238069a6318a0
TLSH
T11DA00237D01A00D4851F0D57B695C3C9810915214A17784B6640D5C52619014877011B
MD5 SHA1 SHA512 TLSH

Submit Download

default_avatar.png.new

Path C:\Users\Admin\AppData\Local\Spurdo\portable\web\assets\p1\aoZrU48PXog8\default_avatar.png.new
Size 23KB
SHA256 b530c9d2e8a9a05f475ee52bc54859b4d08faeac3f5c90bbb196f4c040396731
MD5 1e14e2054d1f7d56f2827cebf4c8e4ff
SHA1 2ccb8afdb34c4a21d7cf18a0182891359d9a14d3
SHA512 1a438d0fff86840335dbfccf9a59bdd14413d2ba92d9c10d4d3516524a0c2dd6e0d9d5a1cca2337165a41bac5a41153c0f00b463911cd16e248a321f5c4f067b
SSDEEP 384:NueAUEDug6plVLZ9b43+0iFZwW6W9O9jamxsoVASDAhiOgPAwdld:QeANaVLZZ+LiwW65jtsOhshTg46ld
TLSH
T17EB2CFB51F88825ED4295D3A027A1B3779B0AFCEF16504A266FBCEE0BC554F8C428758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

enabled.cfg.new

Path C:\Users\Admin\AppData\Local\Spurdo\portable\web\assets\p1\mSI7JiQTuXHW\enabled.cfg.new
Size 1KB
SHA256 9cfbd3e29e0602a6a5c01637b5fa29340d71347534f83f8e8c1f2d946bfa98b9
MD5 359ab0e629d1b1c89d83b40dbbd4e425
SHA1 904d9904d03e268fbe6e0d1d1ccc9faf2f283ddd
SHA512 99192c083773f927bd616ae9be4ff6fe7d42f39ed9ab84e57f715cd376c97bd42fe50b4a25f58445bc243b78e54c04ed9212e1bb53ec843d56fe9c68e0482509
TLSH
T16C316D38993F2678410DF5C3F3825E422F6A5A193B3B5EE829695A3D07453FCD781099
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1812-6-0x00007FFD98DA0000-0x00007FFD98DA2000-memory.dmp

Download

memory/1812-2-0x00007FFD9B4D0000-0x00007FFD9B4D2000-memory.dmp

Download

memory/1812-3-0x00007FFD9ABE0000-0x00007FFD9ABE2000-memory.dmp

Download

memory/1812-4-0x00007FFD9ABF0000-0x00007FFD9ABF2000-memory.dmp

Download

memory/1812-5-0x00007FFD98D90000-0x00007FFD98D92000-memory.dmp

Download

memory/1812-360-0x0000023D29600000-0x0000023D296AF000-memory.dmp

Download

memory/1812-471-0x0000023D294F0000-0x0000023D2956F000-memory.dmp

Download

memory/1812-472-0x0000023D29600000-0x0000023D296AF000-memory.dmp

Download

memory/1812-1-0x00007FFD9B4C0000-0x00007FFD9B4C2000-memory.dmp

Download

memory/1812-7-0x00007FF656510000-0x00007FF657510000-memory.dmp

Download

memory/1812-0-0x00007FFD9B4B0000-0x00007FFD9B4B2000-memory.dmp

Download

memory/1812-359-0x0000023D294F0000-0x0000023D2956F000-memory.dmp

Download