systex | e6aa944fe5fde149b2ec36fe89dbcd61ddf01fa2def0e921b3f6f8981626ef23

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260819-cyssmsxsdx
SHA256 e6aa944fe5fde149b2ec36fe89dbcd61ddf01fa2def0e921b3f6f8981626ef23
MD5 8af67c62d56a88e166bd842384ecc2c1
SHA1 b63f4927e3e92449796e448062a06536dba8f685
SHA512 4628f6cd572419f95a6dc4f9a660a6271b7c788bcb902d8d268cd71fa1194e171c4b72f1afcf442a7e32fba9952fa9532693dd0b396d7390e7b14dbfd4afbc05
SSDEEP 3072:AflfAsiLHEaML4yrtKOsNi6cWgOEkbaFK:AflfAsiL4lIJ
TLSH
T1F8748C42F5C9D072E84118F0187BDB35467EB8780B356AD7FB921E586E922D1B83836F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 2 IoCs

pid	Process
2752	zxrpjhbzurpjhbzu.exe
1016	zxrpjhbzurpjhbzu.sys

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_235599170\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_2063740285\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_2063740285\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_811422360\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_945334583\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_235599170\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_811422360\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_811422360\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_811422360\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhbzurpjhbzu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5276	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315801776487565"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{E48FB525-A8D4-4A7C-BDF8-20D7C21869EE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2752	zxrpjhbzurpjhbzu.exe
2752	zxrpjhbzurpjhbzu.exe
2752	zxrpjhbzurpjhbzu.exe
2752	zxrpjhbzurpjhbzu.exe
2752	zxrpjhbzurpjhbzu.exe
2752	zxrpjhbzurpjhbzu.exe
2752	zxrpjhbzurpjhbzu.exe
2752	zxrpjhbzurpjhbzu.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4680	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 2752	4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4256 wrote to memory of 5044	4256	2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5044 wrote to memory of 4680	5044	iexplore.exe	91
PID 4680 wrote to memory of 3364	4680	msedge.exe	92
PID 4680 wrote to memory of 5276	4680	msedge.exe	93
PID 4680 wrote to memory of 3112	4680	msedge.exe	94
PID 4680 wrote to memory of 3112	4680	msedge.exe	94
PID 4680 wrote to memory of 3112	4680	msedge.exe	94
PID 4680 wrote to memory of 5764	4680	msedge.exe	95
PID 4680 wrote to memory of 5764	4680	msedge.exe	95
PID 4680 wrote to memory of 3960	4680	msedge.exe	97
PID 4680 wrote to memory of 3960	4680	msedge.exe	97
PID 4680 wrote to memory of 924	4680	msedge.exe	98
PID 4680 wrote to memory of 3960	4680	msedge.exe	97
PID 4680 wrote to memory of 924	4680	msedge.exe	98
PID 4680 wrote to memory of 924	4680	msedge.exe	98
PID 4680 wrote to memory of 1872	4680	msedge.exe	99
PID 4680 wrote to memory of 1872	4680	msedge.exe	99
PID 4680 wrote to memory of 1872	4680	msedge.exe	99
PID 4680 wrote to memory of 3984	4680	msedge.exe	100
PID 4680 wrote to memory of 3984	4680	msedge.exe	100
PID 4680 wrote to memory of 3984	4680	msedge.exe	100
PID 4680 wrote to memory of 1688	4680	msedge.exe	101
PID 4680 wrote to memory of 1688	4680	msedge.exe	101
PID 4680 wrote to memory of 5196	4680	msedge.exe	105
PID 4680 wrote to memory of 576	4680	msedge.exe	106
PID 4680 wrote to memory of 5196	4680	msedge.exe	105
PID 4680 wrote to memory of 576	4680	msedge.exe	106
PID 4680 wrote to memory of 4080	4680	msedge.exe	108
PID 4680 wrote to memory of 4860	4680	msedge.exe	109
PID 4680 wrote to memory of 4860	4680	msedge.exe	109
PID 4680 wrote to memory of 4488	4680	msedge.exe	110
PID 4680 wrote to memory of 4488	4680	msedge.exe	110
PID 4680 wrote to memory of 5464	4680	msedge.exe	114
PID 4680 wrote to memory of 1084	4680	msedge.exe	115
PID 4680 wrote to memory of 1404	4680	msedge.exe	116
PID 4680 wrote to memory of 1980	4680	msedge.exe	117
PID 4680 wrote to memory of 1980	4680	msedge.exe	117
PID 4680 wrote to memory of 5348	4680	msedge.exe	121
PID 4680 wrote to memory of 5348	4680	msedge.exe	121
PID 4680 wrote to memory of 5972	4680	msedge.exe	122
PID 4680 wrote to memory of 5972	4680	msedge.exe	122
PID 4680 wrote to memory of 1084	4680	msedge.exe	123
PID 4680 wrote to memory of 1084	4680	msedge.exe	123
PID 4680 wrote to memory of 4180	4680	msedge.exe	124
PID 4680 wrote to memory of 3032	4680	msedge.exe	125
PID 4680 wrote to memory of 3032	4680	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_8af67c62d56a88e166bd842384ecc2c1_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Temp\zxrpjhbzurpjhbzu.exe
  C:\Temp\zxrpjhbzurpjhbzu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffdb110c188,0x7ffdb110c194,0x7ffdb110c1a0
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7991657951997380880,6935810681557369908,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:11
      4⤵
      System Time Discovery
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,2463399548089060827,6858085985607167784,262144 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:2
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,7864274150049318588,10566170070284514338,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:13
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,11002957237119383905,3992642128498365152,2097152 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,10556503309173962746,13769913106382628171,2097152 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,13542563097726418513,5096911784013854792,2097152 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4396,i,429094403338778566,1914436684688598108,2097152 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,1348216026032167505,4924857827689355470,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,14538854293061819735,13912976824723505521,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,1876805796208644670,11676850823766890849,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,1931033227074648804,7856724179310187585,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,1931033227074648804,7856724179310187585,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,12918642832046110723,142903837644600637,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,4020365676040850615,6102001661955873545,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,8381181752775860987,11580596136855502623,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,5060462684600285456,878490477469709074,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,6647973551524643406,5623916936820062377,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,2079354750210980624,14687372487081702633,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,2393575899610565929,6654438535532855489,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,11697196181380233960,16359824795748219199,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,14359704026540149690,17718932084997188552,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3740,i,16443168681622874429,17195980161655983478,262144 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:10
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7137425914235428263,263636090585650893,524288 --field-trial-handle=2624,i,15876759206190001201,18144309963752419787,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:14
      4⤵
      PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2308

C:\Temp\zxrpjhbzurpjhbzu.sys
C:\Temp\zxrpjhbzurpjhbzu.sys
1⤵
- Executes dropped EXE
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zxrpjhbzurpjhbzu.exe

Path C:\Temp\zxrpjhbzurpjhbzu.exe
Size 361KB
SHA256 830dbca75f28b37a81f8e8752457bf2268895270791709e56a9698cdd613e370
MD5 61fcfb7665e34a90e4ea054487dd7370
SHA1 e719cbab45d057c7f3026ff2b24710412b70bc9a
SHA512 c77a61120631bd5fdafbfab77304e980b22dc15e8a80b293eb67bd56b33ec6473d7e1ca0e9f5f53cfe55de35ca7c90adfa4ab1c05005272b6fcc48c526a54538
SSDEEP 3072:sflfAsiLHEaML4yrtKOsNi6cWgOEkbaFK:sflfAsiL4lIJ
TLSH
T165748C42F5C9D0B2E84118F0147BDB35467DB8780B396AD7FB921E586E922D1B83836F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhbzurpjhbzu.sys

Path C:\Temp\zxrpjhbzurpjhbzu.sys
Size 293KB
SHA256 671f7278157ab0210e314225009a03433a5e16e2ba4aad5c644f157a10c04189
MD5 5a3145b805cec3d08f3e27c712dac5da
SHA1 fcbddddc341b3565f2ab1b481a955f507622cf40
SHA512 be974f9cffc1b0bc4dc0664c44b8568b0fd271363e435dfa2f88fff9bf37d8b1693f8f46479d6cbeb01eb6cad73c1e4a7c8b2afae8e037e93534f405989faf8c
SSDEEP 1536:mNtKbKY9GCtdqDai6cYZgOEfwDAYnieWWIKH4R:2tKOsNi6cWgOEkbaFK
TLSH
T171547C82E5CEA0B1E58508F0107F9B36467D6D780B396AD3F3825E58694A3E1BC3476F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

0582cdc7-2ce7-4400-a95e-bba62b0d25b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0582cdc7-2ce7-4400-a95e-bba62b0d25b8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 22cfff5b785397d3b0c541d12fe870d9f7b0e9e1943c270232683ffb605039a3
MD5 da883aac4724df201eb5d17d54cc36f1
SHA1 1ff55334055f379ae23e730d09b3e949791be4a6
SHA512 df88343e80df6706e870f13e04a446980ada4d353e318b36459beb4e1764b0bf9eab8987744dac137ddacd42f486b5b0237990a0977188be6e528079aee8d2a2
TLSH
T15B51FA90936739A1D7A9C5F1B9D15F683AFC84661D0F3A28595CAF343486F1F61E00E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597b22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597b22.TMP
Size 3KB
SHA256 19de38d3cc192876265a205c57dc6f45f5c60a6c7e8c2f16cd6743c4e64038ac
MD5 bf23e696f4bb9ef1f8e3b5b19ab9ca14
SHA1 409f9c0ac3b3f431078d61bb30d0813bd27c95c0
SHA512 30c9d9d0f0b9199caff00cbdc22d666cb06c442da9ea449a6685d1c06bcf5fdf7478d924cde9741adab0fe19881fa86f3aeb77d635281d33f04e4202c6e62de6
TLSH
T17D51E990936739A1D7A9C5F1A9E05F683AFC84661D0F3A29455CAF343886F1E61E00E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8231ed93b5c02bf38642a0c7a87b2312acefb8179a6f74179e37e9a0c735eefb
MD5 21701776eb03fb5a8cf2bec522d9f370
SHA1 9564a3883123ce376f84f85ef214619a5c5b894d
SHA512 0e90d740a15be5915f9f1cc6c404ba5a087955c3fe93e41c15bfce0bdbcb657cd49fc19eb4bf003cfad9b9740638b9e1c054f66ea150fb455786f905f2b2c355
TLSH
T1E7417DF783F4856E890196F0AA18AE1FCE2D0915432C7D5A89E4AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f15b39aa71eec900866dfab35fdf3543bcb18831b035c697d06e41d3a313f8e7
MD5 76853abc8cc4b1d38833a60d11f02ec6
SHA1 34aac024668862d00e2bf19da8a866c68c86a605
SHA512 dfd5264e6ecd0d6656495305422a1f822e8a6c8dde8d201608674fd900e88af239867f16c9bd5b1dbd1066d1efe302f7ad2dde988669c0b3a19869ea5aaec061
SSDEEP 192:sxRcRbCQ/fesT2iqZGnzoA8p9j/g6+WNCfr/Ynf9UnhvGvrgIgVmJ:sxRckQ/fesT2i8GOV/5q/S9AhQ
TLSH
T10442B6166D68A93B4DCBE21DBA55BF53D3F95032A0D51E48EAFC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b52c32df33a728bebca589b4a8c77e1da39e264e7490575529f7d60b2db4deae
MD5 53597a6b1cca7708167968a36286f75e
SHA1 d5e1152be853f8f2993912b88ec6f4a6ca8a5d87
SHA512 703ed7f86f2a25175f30dd0503a41af4c1b908d55969d1d31b3e7f6adf4ee16592abfbc8a20b025ae49a85bdd888bd04ce637349ed8d0801cd9f10d8a1dda335
SSDEEP 192:sxRnRbCQ/fesd2WqZGnzoA8p9j/g6+WNCfr/Ynf9KUDhvGvrgIgD3mJ:sxRnkQ/fesd2W8GOV/5q/S9lh+
TLSH
T16942B716AD68A93B5DC7E21DBA55BF53E3F95032A0D51E48ABFC8A1C04E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e43f615881f63cb45eb701ae934c1a8d92ae0d993c11e2791e4bb638a21871d0
MD5 e21ca29a2d9848ab759cd18d5a05d2cf
SHA1 f0caebe80cbbb100f8f25fabfbfc98d0fcbfc835
SHA512 c9d9ce6f5a4a07d8f78da0501fdeb0a4b7fe6778bacb346e024cd391f558410254102e391a0b5ee5ef3e4d1324c77f9cc00d26d20d6f3879502541e1c6dabea9
SSDEEP 192:sxRnRbCQ/fesd2iqZGnzoA8p9j/g6+WNCfr/Ynf9UnhvGvrgIgDNmJ:sxRnkQ/fesd2i8GOV/5q/S9Ah0
TLSH
T1C042B616AD68A93B4DCBE21DBA55BF53D3F95032A0D51E48EAFC8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d948fee52156478cd0da4544bfa71aa51ac0db141c4658671bfea4efff85d9cb
MD5 ee7e149e2b961d315bea07d86ad3d26c
SHA1 0f8ecbdad8c5c14197fc99f979f15118b6dd22e9
SHA512 694668cc7f3b2d8b075255a83e9b3c86552352a7e6b6350d58a7705f47e4ab26e29b213e198c9ddd78b4de8291de51b83dd1331cdaf59ccf528fe199cbebbcc1
SSDEEP 768:wb8dMg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0C3mu46BrohI7Y:wb8dMsE7r6Wgouf6Mu1javC3mV66iY
TLSH
T118D2DA7B740DCB7E4F800ADDEC19BE9F6DA802CB96D8CD4447FA951C02C6BEA51160DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 18927e73ebc79493675969449c4bb4ce70f2bf2c64490f18a286e718a4b59ff6
MD5 59db4bcecf01536d487b3249906bbfdc
SHA1 db3aaa7408b5711befd419e153b7ffbebdac9d6a
SHA512 7620ea136d0153dbb95d21e4d325031e8cce67b13c3c2b798725bc0fc1f3bc2ec44f7dc73b7ee7603d7a1f72e5c59721604e14ef85a7dfb852165ca159777168
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHwBUAyeSIWWLbgIIK4Ng6Icoob6vZaKag4:CeTieYgQxAl+eODgc1W+9M+XHwBUAyek
TLSH
T1E5917000347A12987C7F690CC0BED91AD68274A33259F56B7BA841A71F67E425CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e60618a9-5fde-4b76-857b-751f51427e9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e60618a9-5fde-4b76-857b-751f51427e9b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 b9b9d68307a883a81e22351ade2adab697205e3bcef9811578e7b7c25f250c7e
MD5 173663d254ef4075ddbe155d89886b7d
SHA1 0d614cf7b222fcd2a57ad7abea8f9bedf4462ebb
SHA512 b57135fedf0a419c9e52a75461655a37910e0d1552190fb3e243df010249dbdd7d98aae3ae83200fde004443d9d8096c971e6639578b4dfd1e351024a2cdf361
SSDEEP 768:oFQs3iwg3j/SZQ5O0tGNzc4ReyIsPRfDle:Ls3iDGtc44bsZfpe
TLSH
T1521317F598E78936E8AD5783A73D2E42ADFDC067B1885884B7D94E0CCC461BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f3b7a8f80552c824eca842a06e810d7407bd18c9263a324d5965dd215f1179ec
MD5 7f71d9017216d5922ed89f98e0ec3c08
SHA1 a43c6794a8d27b5a0ecdc3198382880cab8edd1b
SHA512 2a964dc40c31dee81ee7dc11496b3dfe7dfb3e5bda6b5e963b45d1aeb308b38c3c6f0bffad7856500f1721e64e58c9951a57688de362f8aed1ad90bfcfe62310
SSDEEP 768:6rv+4UNbds3DoDZIO0toNzc4ReyIsXEeVH1S5D:6bsbS3Fotc44bs0EH1Y
TLSH
T1F503DF32AC788A77ACF66785B54776537EF8512BC2881E84C5DE5F0C4A8B1ED130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 93a982b4a7d2e3e87ae56e34b87d90318f3a371902e7012c456204e589a6f6d2
MD5 d94d2456acaef6e9b0317f304bd149b9
SHA1 8e155059fd1d6e66d8e01a396216d48cb4875107
SHA512 4dd7aac0d0e3882253337a689e5ad835ef6fc9274f624504cdb82b0cec4802d31ee74b58ad32c2d4ea48004e22ac97412b85214804d7aac8c94495a2dd418ecf
SSDEEP 384:nIZcIv38NvVMkawWpjFJDZNfNoXOVSUUEqig3jxETRzcoXfK86sfxEZxxsIj4lB2:2v3fjpbDZIO0tuNzc4ReyIsPRfDle
TLSH
T199F2BF71AC358C63ACE9A385FA463792BEF55037C1C82E98D9DE9F1C09472DD1B1B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b98ecd08bdedc5872a04bb7210c1bdb0610e5cc83d819f593c80bee496ffec79
MD5 7de9179469ffc0a9fd18b3ad66b39008
SHA1 72a940005b930c14c0f8c2c2e6f3e68fb2c80147
SHA512 a68ceb917b3b4eaa15a12211945487769a5c0a3d59f47d24cfd4c09ce57eca684d53c1322e251b44822bac7fd1d4b4ab1a87cf52c0079ed13c99267b48bc1086
SSDEEP 384:nXZcIv38NvSMkawopjFJDZNfNoXOVSUUEqig3jxETRzcoXfK86sfxEZxxsIj4lB2:fv36jHbDZIO0tuNzc4ReyIsPRfDle
TLSH
T101F2BF71AC358C63ACE9A385FA463792BEF55037C1C82E98D9DE9F1C09472DD1B1B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 10d018a9e5145e2626482a046ebf4878285c39be84e85c3d60fa8d2800db68ae
MD5 dc1e2eb52a55ae9d27695f2558f14440
SHA1 060d2cde66edef5f648b1763547e4fe7adc40048
SHA512 2800b05130e82b0bfc2e2faf966bbce2619bcb48a00e4f3c67f3e415daac8e9b09cc32ac42bf4b162320c49939231f403e9cafcd7292bea5fff8bbe80ba17184
SSDEEP 768:Zrv+4UNbds3XRDZIO0tfNzc4ReyIs2ReVH1S5D:ZbsbS3Uftc44bseEH1Y
TLSH
T18203CF32A839CD37ACE66785F44776937EF8216B81840E94C9DA9F0C4A4B1DD170F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

25cd31b6-4e5f-4c96-8c67-7024c357451d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\25cd31b6-4e5f-4c96-8c67-7024c357451d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4680_2111489780\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8c3f5bcb85347051b80f2e640830d3a41401bf71af0a3a44d88fbf749c9da6d7
MD5 cbd5fc6ebe3f55de361fd6f68c8506e3
SHA1 a6b6d4e395787afc959c0e3f7794c1f4f0c09954
SHA512 214bdc2fbda24a3090b3e744daf534abbba08794a44f21f38088bbd5c9f769ea9b5cbbc5067e543a46d1c423b8b051a827141e29192ac43a08aad7b285c83c89
TLSH
T1AF71043F0C3034C0D03100310454504C104554403C3411FF4305C7150C045FD7103D07
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1016-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download