systex | 762d8f4e4b40bacb88e43bc655b6b17334424436c1f1376e9d3039fac45b6c94

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 09:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260816-lx3e5avdpg
SHA256 762d8f4e4b40bacb88e43bc655b6b17334424436c1f1376e9d3039fac45b6c94
MD5 c68b17e9d046c02650101d84ead5c5f8
SHA1 f4971484f72fda8760034a93dc43da3186f520c5
SHA512 ac425da52298758592225616cab68f1ca14638871c789ce929f31d47eb5e4318df542dff3b7cb29f0f75039ee76cc62651b3c98e3d148002a0c14fb4cad60ed6
SSDEEP 3072:zflfAsiLHEaML4yrtKOsNi6cWgOEkbaFK:zflfAsiL4lIJ
TLSH
T1FC848C42F5C9D072E84118F0147BDB35467EB8780B356AD7FB921E586E922D1B83836F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 2 IoCs

pid	Process
4696	bztrpjhbzwrpmgeb.exe
1308	bztrpjhbzwrpmgeb.sys

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3584_765556657\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3584_765556657\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3584_765556657\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3584_1822394479\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3584_7941966\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3584_765556657\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3584_7941966\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3584_467532510\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3584_467532510\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjhbzwrpmgeb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4872	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313477448030732"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{A95B408B-15B5-4B9C-A778-499AEB643EE0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4696	bztrpjhbzwrpmgeb.exe
4696	bztrpjhbzwrpmgeb.exe
4696	bztrpjhbzwrpmgeb.exe
4696	bztrpjhbzwrpmgeb.exe
4696	bztrpjhbzwrpmgeb.exe
4696	bztrpjhbzwrpmgeb.exe
4696	bztrpjhbzwrpmgeb.exe
4696	bztrpjhbzwrpmgeb.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3584	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4696	4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4620 wrote to memory of 3424	4620	2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3424 wrote to memory of 3584	3424	iexplore.exe	91
PID 3584 wrote to memory of 4772	3584	msedge.exe	92
PID 3584 wrote to memory of 1132	3584	msedge.exe	94
PID 3584 wrote to memory of 4872	3584	msedge.exe	95
PID 3584 wrote to memory of 1132	3584	msedge.exe	94
PID 3584 wrote to memory of 1132	3584	msedge.exe	94
PID 3584 wrote to memory of 916	3584	msedge.exe	96
PID 3584 wrote to memory of 916	3584	msedge.exe	96
PID 3584 wrote to memory of 1064	3584	msedge.exe	97
PID 3584 wrote to memory of 1064	3584	msedge.exe	97
PID 3584 wrote to memory of 1064	3584	msedge.exe	97
PID 3584 wrote to memory of 520	3584	msedge.exe	98
PID 3584 wrote to memory of 520	3584	msedge.exe	98
PID 3584 wrote to memory of 520	3584	msedge.exe	98
PID 3584 wrote to memory of 6016	3584	msedge.exe	99
PID 3584 wrote to memory of 3532	3584	msedge.exe	100
PID 3584 wrote to memory of 6016	3584	msedge.exe	99
PID 3584 wrote to memory of 6016	3584	msedge.exe	99
PID 3584 wrote to memory of 3532	3584	msedge.exe	100
PID 3584 wrote to memory of 3532	3584	msedge.exe	100
PID 3584 wrote to memory of 2828	3584	msedge.exe	102
PID 3584 wrote to memory of 2828	3584	msedge.exe	102
PID 3584 wrote to memory of 2976	3584	msedge.exe	105
PID 3584 wrote to memory of 1196	3584	msedge.exe	106
PID 3584 wrote to memory of 2976	3584	msedge.exe	105
PID 3584 wrote to memory of 1196	3584	msedge.exe	106
PID 3584 wrote to memory of 4336	3584	msedge.exe	108
PID 3584 wrote to memory of 4432	3584	msedge.exe	109
PID 3584 wrote to memory of 4432	3584	msedge.exe	109
PID 3584 wrote to memory of 1660	3584	msedge.exe	110
PID 3584 wrote to memory of 1660	3584	msedge.exe	110
PID 3584 wrote to memory of 4124	3584	msedge.exe	114
PID 3584 wrote to memory of 6100	3584	msedge.exe	115
PID 3584 wrote to memory of 5924	3584	msedge.exe	116
PID 3584 wrote to memory of 4216	3584	msedge.exe	117
PID 3584 wrote to memory of 4216	3584	msedge.exe	117
PID 3584 wrote to memory of 4972	3584	msedge.exe	121
PID 3584 wrote to memory of 4972	3584	msedge.exe	121
PID 3584 wrote to memory of 3028	3584	msedge.exe	122
PID 3584 wrote to memory of 3028	3584	msedge.exe	122
PID 3584 wrote to memory of 5832	3584	msedge.exe	123
PID 3584 wrote to memory of 5832	3584	msedge.exe	123
PID 3584 wrote to memory of 5772	3584	msedge.exe	124
PID 3584 wrote to memory of 5492	3584	msedge.exe	125
PID 3584 wrote to memory of 5492	3584	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_c68b17e9d046c02650101d84ead5c5f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Temp\bztrpjhbzwrpmgeb.exe
  C:\Temp\bztrpjhbzwrpmgeb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc66e2c188,0x7ffc66e2c194,0x7ffc66e2c1a0
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,169838166676938095,16502571527323113089,262144 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,14463215318562159648,18070126749223934096,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
      4⤵
      System Time Discovery
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,15155671337871646149,12839381952049437840,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,14328035952497397110,17817350073210291817,2097152 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,13813819180708867251,384970143217967395,2097152 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,13021725763067893194,7137655657424601802,2097152 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,1120787577294316004,3997252984017578472,2097152 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,2746943404790617082,1909470354385490769,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,7395290300267543594,17037873190224323114,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9026131878072822147,7437089267154243857,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,343674154204663271,10062099329117461892,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,343674154204663271,10062099329117461892,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,9811181242391214641,8506486779928603640,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,10078688892722066938,1838998113819077931,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1448,i,6250450197597895242,14696947813226104696,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,4944977504363483827,11332882415417621025,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1464,i,15470209829427583830,12845236699743331110,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,8603371707475827796,5736132251808871314,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,13189120132155372792,12299805317832713346,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,4369438618333524497,4911250134587831063,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5368040726057827340,11294493740122268448,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6076,i,12637785755335205407,16276478940791382173,262144 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:10
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,7995086541181337946,5761396264014321554,524288 --field-trial-handle=2508,i,2267430100628424542,11913956976230427969,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4824

C:\Temp\bztrpjhbzwrpmgeb.sys
C:\Temp\bztrpjhbzwrpmgeb.sys
1⤵
- Executes dropped EXE
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bztrpjhbzwrpmgeb.exe

Path C:\Temp\bztrpjhbzwrpmgeb.exe
Size 376KB
SHA256 66ed81345b8665e55bc31f8b0ab4a2227c08e96e74b780e471e04bfea1c13647
MD5 a74978bfde7cec386a41525c8e6cfcb8
SHA1 55ecc8f9c0d4e0624d59389dd0cbb94616e5c126
SHA512 3342495b84b0b24bcad4de4709216bb40de65124959d4652f364bf99f8250062eb447e1104aefa82d52e6af0359194424b3395152cd632ccbf1627a1736c9adc
SSDEEP 3072:pflfAsiLHEaML4yrtKOsNi6cWgOEkbaFK:pflfAsiL4lIJ
TLSH
T179848C42F5C9D072E84118F0147BDB35467EB8780B356AD7FB921E586E922D1B83836F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrpjhbzwrpmgeb.sys

Path C:\Temp\bztrpjhbzwrpmgeb.sys
Size 293KB
SHA256 fb4840347f944dbfac5ca833affa1e530534470f93bb714934faa871dfbf05ee
MD5 b31eb6bddb01e049423b7e7213b7bf18
SHA1 780b5973bd446af91e50fbb0c0b96bc0caca6e8d
SHA512 b91c909317deddda09748b2718fb523234e038009e7908da9ce19aea68e75a781cfa7b3c83e2815ebf3abcbf5d296194d07276eaaee6df4135162942a44b6013
SSDEEP 1536:0NtKbKY9GCtdqDai6cYZgOEfwDAYnieWWIKH4R:4tKOsNi6cWgOEkbaFK
TLSH
T16C547C82E5CEA0B1E58508F0107F9B36467D6D780B396AD3F3825E58694A3E1BC3476F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4158f84232a9b7de856a039356374b7ffa494fbab87a82c76412f9438f378b36
MD5 f51e86eed33fd1f5af8862477dffcb49
SHA1 8803951193e817cecc9ffe121b7369b6059ac2ac
SHA512 ba460aa4d6ea9adec3df612eb2ce89e84515ca6462969704978df2fd0913a1b055b66aa5777630195481c9722c1673175ff54f7d26dc37afc32833c0b4333957
TLSH
T1F15165AD23640AF6DB25C4F390D0C4A532F645BB1E831BAA2040AD780586FD891FF8B3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598ec9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598ec9.TMP
Size 2KB
SHA256 8337f3b5b5cbc87ed9616e81689f77d3f9adb0b1aed7b914c571e1b130687d2c
MD5 00f50978934edd2ff0e4ff52e68c5209
SHA1 956ce09dddeece55ad09cbabd2b67f344b894f29
SHA512 461d75e8448db2b15ee1976ed9595e257ea17cf2094def181ada852438e6533d1b656c2bb15fa85d4dd5d88cdf79683f76c81f137eb5797211962d9349421b82
TLSH
T1125166AD23600AF6DB25C4F390D0C4A572F645FA1E831BAA20409D780586FD491FF9B3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49e8bc89-b482-4521-a0cf-a36c362d3f45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\49e8bc89-b482-4521-a0cf-a36c362d3f45.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 842f6e9812706c3ccefc1f70faec7c45d451d80a04960e2e7114b59e1138630c
MD5 7ff8ea41ce81848738fc33530c9c8c48
SHA1 5ab92636576457c23ce8474388d50b86374dd5be
SHA512 c61e5e5f05b7086fbcc6ef40f460922d38c28501867d8e23d957065efb5a5605391040e404ce45aa341aed0201e3dbd5078d44ba5351e61bbd54b0ce3e777b3c
TLSH
T17241ADF383F4956E8D015AF0AA147E1FCE1D0915432C7D5AC9E0AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e6879070945bb8a58678f2cb990e7462c5919037c8f96427a0052f8cd9ecb6fe
MD5 a9a79318202b592a9a9c0e3abe2370e1
SHA1 a52b5e5303b2a486fd40f53519da60b14539e445
SHA512 7c975b2f8a0672af170ee93df9cdc1ba9a766f472b45d899a33ac0a09aa864e1217a7eb6086e43ba4f8b7a666b45fa5f16ce75a6ad50cdaf4dac897ea9c978ec
SSDEEP 192:sxRHR1Cv/fFs5Z8aZ+pFEzoA8p96/g6+WNCj4/YowyCYvGZIgDF/J:sxRHOv/fFs5Z8M+jlQ/5F/4PT
TLSH
T19C42C8156D28A93B9CC7E25DBB65BF53D3F95032A0951E48EAFC8A1C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 24b36a9450d0b548a51b740876534d292e23a6ae327e56296cfc2d1245be6b92
MD5 3a176dffd8aa81765f872d35de5eff7c
SHA1 7a58428bc566e62a98ef2857ff90eb2001882824
SHA512 7f7eaee4b836a84a6aca33552aa7b13e72738c5a572b6974aff228037b3417f43f9e31da36b337b187eed6143ae77ebb41a42fadc749f56aba52c641cf7506b4
SSDEEP 192:sxRHR1Cv/fFs5ZqaZ+pFEzoA8p96/g6+WNCj4/YoAcCYvGZIgDHFJ:sxRHOv/fFs5ZqM+jlQ/5F/MPz
TLSH
T18342C8166D28A93B9CC7E25DBB65BF53D3F95032A0D51E48EAFC8A1C04EA6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 183b44a72a1d490bd054efa9ed9d2420df0df050db593c0d7781c515286e9b53
MD5 49275302fee81024a3fde0a818f125c5
SHA1 96be59b9202ca98f9d8fdc0c0c159ffc5f16b984
SHA512 5f3498b9a7d733017002033d619654d85890128d7001915d6af7c46236d8c1dab128b50e63f3c287ea2a9cbd81a80fd5bea2d9f1f9bc4d22537f8913dacba05a
SSDEEP 192:sxRgR1Cv/fFsOZqaZ+pFEzoA8p96/g6+WNCj4/YoAcCYvGZIgVFJ:sxRgOv/fFsOZqM+jlQ/5F/MPR
TLSH
T1EB42C8166D28A93B9CC7E25DBB65BF53D3F95032A0D51E48EAFC861C04EA6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 de9037a5ef3c3a98c90e9d69bc74de64776f483fb367c1d25ca36d277f8e7fad
MD5 584470df4435f01c113963260c6e54ff
SHA1 c74bd441619c8fa1cd9a79b6d73a58ce5cb090ed
SHA512 26a4613910e71c83ec2144845a222ce4b4f797ed8e2a95fc9d51b945ef02f01b12f87e4b30592a1bfee2116239c274fb10d64f778345676fc3500396f5fcc992
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVM2BVuwAro9ie04:j26HRUE7MRWgs2f02u1jaf2B4wLtn
TLSH
T159D2DB7B740DCABE4F804ADDEC197E9F6D6802CB9698CD8047FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a29d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a29d0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c6ede70e5c28bf72d16e0787c4b18c2054fb8ec2c6a348f830caace017841d56
MD5 2abac5fa8774078ee2b684aff8306b0b
SHA1 19e27792cbea9ccc0799b0e3f513f1de0b3b0d95
SHA512 ec4b11353c56ec7d87f66338d92768a771b7d4347aacfea805de985f9154a97c2a6b364385948dcc9c88d9aa3b1e80aa00a1ec9e4dc7899fb7b2e326409280b5
SSDEEP 768:5rv+4UNbdy3JaTD/TBOWhjikONXyer1IRCzni9UweVH1SK3:5bsbo30JSIqnjwEH1R
TLSH
T16613BF31A4A8EE338CE2B386B54777837FB82067C5850B94E9DA1F4E099759D230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ebd0b03f9ea5a894d795d3d37b46409cfd7843b444a67f92493c0a377b131a67
MD5 16dbdab7b19f301e18d7e6a1920159be
SHA1 3cfe2edac39d09603b53cc9a7f62f00fd8e93d06
SHA512 410b128318fdfccebc00fc41bdf339c67ddb965cc2b790592bd747f33eb7bc3d874b4cefabf1915e59c03dafa95230a47b6292959363bcd7fb8a9fe9a039fcb0
SSDEEP 768:sl3NaCD/TBOWhjikONXyer1IRCzni9UwPi9PftI:sl3ZJSIqnjwPstI
TLSH
T123F2BF70E4A49D238CE6F3C6B6462783AFF82077D5C54A94AADD9B0D099752E130F42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9c797ad3871c6f4c5bcc1080fd54ba5bd716ebeeec1c8cecf2e8f43778212abe
MD5 47f6d78039df714eef8cd84f920597e2
SHA1 f6d53791fa7d7cda68f633e6b86195715f4dc4b8
SHA512 d268005c8b7de3a0a66ce80f47b11c5558eca11f95e09989ca09204a9d1c53ec42e9a2546129867eb2cce5f95dd91cd816ade21342d1511886804ca42ecde8e6
SSDEEP 768:hrv+4UNbdz3DN/TBOWhDONXyer1IRCzniBU8eVH1SK7:hbsbV3J/SIqn/8EH1l
TLSH
T1BD03CF32A4A89E338CE2A3C6B54777437FB86057C6840B90D9DE2F4E069B59D230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b96a19c066fe8e56ce9f9f5d061221c97c284c33727bfd7c7250fecc429f8638
MD5 f23005fe8f16a7a461c0221d1d062951
SHA1 ae7772a7a1c1b88486d47317e47b931484631dba
SHA512 88ace7cf29cdb1fa283f5477014d9605b582c0facaafb0302f6e41be9b1a82961bb61460055fe78a87c1f4a88601dfeb5c1e0afa32308a87ff642ac2dbbf1fc6
SSDEEP 768:Arv+4UNbdz3bR/TBOWhjiaONXyer1IRCzniwUweVH1SK7:AbsbV3FNSIqnowEH1l
TLSH
T1D103B031A1A8DE338DE2A386B14777837FB82067C5850B90EDDA2F4D059759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 0f8e1127ac1de4a07f713d6a57156bb0ac668592de12064f002dd6ed3efe8072
MD5 ee559861cbfddf295f0f37309c0f7b73
SHA1 e9dc989cc3de91e9a8f3ca3976ca913938f8fbba
SHA512 b99de6efe33abf8ab8bcadfca059dac7c7b33cac4196a7eca5271aad41bd7c00765c062f9a3567f91466475a36360b49dfbe29eeb59a48b6da357521736542bc
SSDEEP 768:LEFQD3HwglazUxsOWhjifONXyer1IRCzni9UwPi9PftI:LnD39pSIqnjwPstI
TLSH
T1BB1339F194D79937D8AE9787A73D2E429EBCD063B4885590BBD95E0CCC8217FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

2ee55e70-2a63-4fb5-b2e8-042e034a68a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2ee55e70-2a63-4fb5-b2e8-042e034a68a0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3584_1110268984\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 98fd99dd28ad25f7d3f5c7f58dafd2e00d034c0f76e6ad8d3390510507c59c7d
MD5 c62bad5f73874290dbb7ae9645c0399f
SHA1 eb1910af9612716a33453ff0feb7a78abb246b5d
SHA512 d6dd7687da73e9a4214a0728dc4b6df2e6d8245b198aeefc92e7ccf8ddbc1d4497bf7d71fbaf480c8718a13a622d7bc765103936753ae1324d6c6f47d5e96676
TLSH
T1BA71041517F304D1D7FD043C40401C7C511134107D150C750311D4403414DFC1C7310D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1308-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download