systex | 19aa6f213c4791a80afb201b8570cfc2d664d257e2fa0fd423b33e0a8832dc9e

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260910-jfabxazelh
SHA256 19aa6f213c4791a80afb201b8570cfc2d664d257e2fa0fd423b33e0a8832dc9e
MD5 0dc898cede90a2e68b49cab9593f9653
SHA1 8175c24861a536b7ecd28782544e14524a4ff14a
SHA512 b97eee4d8afc2c9fe499d36460d6ebf3f1627502d263f8b9a54f7f82a8fa1effa73fde471e718b6aba116bb20e7116477aae1da4dca52939808b1288190b055b
SSDEEP 3072:OflfAsiLHEaML4yrtKOsNi6cWgOEkbaFK:OflfAsiL4lIJ
TLSH
T108748C42F5C9D072E84118F0147BDB35467DB8780B356AD7FB921E686E922D1B83836F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 2 IoCs

pid	Process
3280	gbywqomgeywtolgd.exe
5552	gbywqomgeywtolgd.sys

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1444_326796753\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1444_326796753\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1444_326796753\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1444_282799125\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1444_138874415\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1444_1802159959\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1444_138874415\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1444_1802159959\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1444_326796753\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywqomgeywtolgd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334993811353530"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{2D4F5BE5-029A-4398-B8C0-177A7C1E6243}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3280	gbywqomgeywtolgd.exe
3280	gbywqomgeywtolgd.exe
3280	gbywqomgeywtolgd.exe
3280	gbywqomgeywtolgd.exe
3280	gbywqomgeywtolgd.exe
3280	gbywqomgeywtolgd.exe
3280	gbywqomgeywtolgd.exe
3280	gbywqomgeywtolgd.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3280	3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3032 wrote to memory of 1604	3032	2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1604 wrote to memory of 1444	1604	iexplore.exe	91
PID 1444 wrote to memory of 4964	1444	msedge.exe	92
PID 1444 wrote to memory of 1956	1444	msedge.exe	93
PID 1444 wrote to memory of 5852	1444	msedge.exe	95
PID 1444 wrote to memory of 1956	1444	msedge.exe	93
PID 1444 wrote to memory of 1956	1444	msedge.exe	93
PID 1444 wrote to memory of 6048	1444	msedge.exe	96
PID 1444 wrote to memory of 6048	1444	msedge.exe	96
PID 1444 wrote to memory of 3448	1444	msedge.exe	97
PID 1444 wrote to memory of 2012	1444	msedge.exe	98
PID 1444 wrote to memory of 3448	1444	msedge.exe	97
PID 1444 wrote to memory of 3448	1444	msedge.exe	97
PID 1444 wrote to memory of 2012	1444	msedge.exe	98
PID 1444 wrote to memory of 2012	1444	msedge.exe	98
PID 1444 wrote to memory of 5744	1444	msedge.exe	99
PID 1444 wrote to memory of 4088	1444	msedge.exe	100
PID 1444 wrote to memory of 5744	1444	msedge.exe	99
PID 1444 wrote to memory of 5744	1444	msedge.exe	99
PID 1444 wrote to memory of 4088	1444	msedge.exe	100
PID 1444 wrote to memory of 4088	1444	msedge.exe	100
PID 1444 wrote to memory of 4640	1444	msedge.exe	102
PID 1444 wrote to memory of 4640	1444	msedge.exe	102
PID 1444 wrote to memory of 3316	1444	msedge.exe	105
PID 1444 wrote to memory of 4580	1444	msedge.exe	106
PID 1444 wrote to memory of 3316	1444	msedge.exe	105
PID 1444 wrote to memory of 4580	1444	msedge.exe	106
PID 1444 wrote to memory of 3080	1444	msedge.exe	108
PID 1444 wrote to memory of 4656	1444	msedge.exe	109
PID 1444 wrote to memory of 4656	1444	msedge.exe	109
PID 1444 wrote to memory of 2640	1444	msedge.exe	110
PID 1444 wrote to memory of 2640	1444	msedge.exe	110
PID 1444 wrote to memory of 1944	1444	msedge.exe	114
PID 1444 wrote to memory of 5732	1444	msedge.exe	115
PID 1444 wrote to memory of 2756	1444	msedge.exe	116
PID 1444 wrote to memory of 2400	1444	msedge.exe	117
PID 1444 wrote to memory of 2400	1444	msedge.exe	117
PID 1444 wrote to memory of 4864	1444	msedge.exe	121
PID 1444 wrote to memory of 4864	1444	msedge.exe	121
PID 1444 wrote to memory of 480	1444	msedge.exe	122
PID 1444 wrote to memory of 480	1444	msedge.exe	122
PID 1444 wrote to memory of 2056	1444	msedge.exe	123
PID 1444 wrote to memory of 2056	1444	msedge.exe	123
PID 1444 wrote to memory of 4104	1444	msedge.exe	124
PID 1444 wrote to memory of 1448	1444	msedge.exe	125
PID 1444 wrote to memory of 1448	1444	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_0dc898cede90a2e68b49cab9593f9653_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Temp\gbywqomgeywtolgd.exe
  C:\Temp\gbywqomgeywtolgd.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffadf55c188,0x7ffadf55c194,0x7ffadf55c1a0
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,6777527026251766828,13801386699749837638,262144 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,13254153316823475601,18054785602358249217,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
      4⤵
      System Time Discovery
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,17194205480570157606,13076183231615098599,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,8116176230227658578,9389020591371019328,2097152 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,15197403832251459095,11936268502398096374,2097152 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8403574623980046733,5785295585183962295,2097152 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,9417853395277248732,3201016806744044883,2097152 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,1062460878058407530,3158008683794086552,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,5333951023794579905,16374166527824678358,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,5599151229415115887,9435028941020256259,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,8668599686601504085,17411688228157017595,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,8668599686601504085,17411688228157017595,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,10024995125287464873,16871414788502589277,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,9988413000471044221,10962529745210269563,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,10210229027622496959,11782650731229563128,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,10696415274371055655,6881408292311662378,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,5606099513374894191,10913752630829765999,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,17008716774255661879,1539648174321507877,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,1996987285228084824,8677332350112828165,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,13609259053091054113,4216236973370757696,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,11806868729920039058,3849270775229279403,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6816,i,6910056971090651031,8373489520618319004,262144 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:10
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,12069236447353668674,2938561314083132690,524288 --field-trial-handle=2464,i,15908739156042304655,14796821599159139428,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:992

C:\Temp\gbywqomgeywtolgd.sys
C:\Temp\gbywqomgeywtolgd.sys
1⤵
- Executes dropped EXE
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gbywqomgeywtolgd.exe

Path C:\Temp\gbywqomgeywtolgd.exe
Size 361KB
SHA256 ac40a4ddb0cfba12a312913769d3537aa1c37a0685a2e1619de279f637548ad4
MD5 1ac9016c8ca81f560a38c2aa8175cc75
SHA1 74125d73d18a9603849781a8ba7e8301fa41c4ed
SHA512 e7cd4e3127bc97eabd683503af8ee429264e7fe5c4aba1c74f6b17383893b4704b7692cbf308e25c67c4d19ffcaab21ecb4271e736144fde3d6870e7356da37a
SSDEEP 3072:TflfAsiLHEaML4yrtKOsNi6cWgOEkbaFK:TflfAsiL4lIJ
TLSH
T107748C42F5C9D0B2E84118F0147BDB35467DB8780B356AD7FB921E686E922D1B83836F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbywqomgeywtolgd.sys

Path C:\Temp\gbywqomgeywtolgd.sys
Size 293KB
SHA256 4d1bfa73a7f8758587f03e163dee09c22b0bb4708815274d863ae7d69264a8b4
MD5 baef451befd766e8d4f8a45b24cf65e1
SHA1 d4944ae6968bd237d99e086442db24bc7599ceed
SHA512 2efbd42526b033de8c0a36de633b65e17721ee7786e00605ff275ed57fd8579c1801bd892bf22517919468d12d5943af5adfa3ad385d6174d96f7ff94df623f0
SSDEEP 1536:9NtKbKY9GCtdqDai6cYZgOEfwDAYnieWWIKH4R:ntKOsNi6cWgOEkbaFK
TLSH
T1CF547C82E5CEA0B1E58508F0107F9B36467D6D780B396AD3F3825E58694A3E1BC3476F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0d6fbac6abfaaaffd3ea1e375a5bdfb1295ed500deae975739f17228ed02fcfe
MD5 66087d4fb25bcc340ab8ae73ff2f43bf
SHA1 6fcc73ac453b5cb9312f5aabd1e570bf3f17b93e
SHA512 0eed559073e1277822563a0fa11c7f694cdba6b26c9a3430af9a7817cce1b78cf2c13dc7efcb06255f09439c623250024821c073e72cba592d5f76fad1b48be6
TLSH
T1AD5163D4872FDBD2E72456BE25E148CA36709E572A07AB3013BA52B65CC2F4E34F0214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c450.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c450.TMP
Size 2KB
SHA256 ddf167a5f4f0753697c8762dd6d683f78d73f1a6f018736ff6e629ea216d3f84
MD5 955d9ba3ea10f8a7239e4d3392634f3a
SHA1 6fd205f349b386a70ca9dd9122823f5005cc4b86
SHA512 bfef9d98364de65eeb71f683ed080b11c05d7af4b3355aa33d45cb277453a15d01b0cfe48e7d5a261c7359dcc9ff6fbced336476a30c167e2066bf677f399e95
TLSH
T1FB5164D4872FDBD2E72457BE25E148CA36709E5729076B3113BA52B65CC2F0D34F0214
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f0454782-e1ce-41d0-a767-334eeac8de25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0454782-e1ce-41d0-a767-334eeac8de25.tmp
Size 1KB
SHA256 1327ea765da93c3bdfaa99652d4a3115f5775fbe29e51de5f72d6b89d53e4638
MD5 fdbcd14a617bd6bc6e347cb740d37a2c
SHA1 47cf91c6213c139832c0ef2bef9d6d7b4a70d15e
SHA512 2c312da628e90ced78023380a69e45785fae529fabc8a7954eb8e102facc5470e436240411358b5a0a99f2d5e76ea1bbfc5c8c744058c86b3aa25f608d3228a0
TLSH
T189418EF383F4956E890196F0AA146E1BCF2D0515432C7D9AC5E4EE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0de4e9ad205d334c207a54441936a0ef6828ce4cf6bcacf2b6819c134a7f8e00
MD5 aa0ede0a593e00505399c9d14f444ad7
SHA1 8322a812071a2a8745560b3cc31332f7b820c76d
SHA512 87f61fbf9baa2335f754744a7f3fe264257598be29e268a5f9a690114c4bf4d8b22a2741e83c5548601cd7f3fcac09247dec9b35d74a701b8252a85bc6028e3b
SSDEEP 192:sxRGRgCk/fZ+sYiZ19wUORGzoA8p92/g6+WNC64/YZ7Rqjs9GgIgVPJ:sxRGhk/fcsYk3wj7U/5E/sfH
TLSH
T19A42A6166928A93B9CCBD60DFB55BF53E6F95072A5D01E48EAFC8A1C04E66CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2e5a938802ab9b582c1ca663a13a125f180e236c0e617fdbfb37f63e279d5788
MD5 b1b59603fed44df5c0cfb947e00ed6e2
SHA1 43ba66f8d8922bb75d09739092a0c08b7cf564cd
SHA512 4fb99fa99e2ff6e1106c69c5d591efa284758e9508bcb3204e3984259fca6a1c7e4504d3186a8a75883bb2d827d85037f995d6b69b22b113b89d4abbf6636bd4
SSDEEP 192:sxRFRgCk/fZ+smiZ19wUORGzoA8p92/g6+WNC64/YZ7Rjls9GgIgD+PJ:sxRFhk/fcsmk3wj7U/5E/pfy
TLSH
T1C542B8166928A93B9CCBD71DFB55BF53E2F9507295D01E48AAFC8A1C04E76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7686a9a98faf0c9780cd0e40e5b4e3c02c2a73ceb086603ad4a54a173287bdac
MD5 ce23eed1882cd6fcf8814ad69cf54def
SHA1 520011afa55a0e76ba0a69cbeaeebc39756f89cc
SHA512 f5fa1e298d5cacb081aa441943b3a9a68b24947beae904027d64613c151d870fe97be5553b16a70960b010e778e68654f9fe1f1ff284b1e75a39707cfe627f1e
SSDEEP 192:sxRFRgCk/fZ+sjiZ19wUORGzoA8p92/g6+WNC64/YZ7Rqjs9GgIgDMPJ:sxRFhk/fcsjk3wj7U/5E/sfI
TLSH
T18D42C6166D28A93B8CCBD70DFB55BF53E2F81072A5D01E48AAFC8A1C04E76CD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2f32df311b87d05c06a7bdab63860c71e82b0bdc6d1128ad53139a05e2d9fef4
MD5 2a40a883efad7251d9e7e8910d47b6fc
SHA1 3ed24de67b2ad9795fdfbe1c57f88d012daaade5
SHA512 55678495f7c748fd8d93cd1a56a9f665ff28391d9dd9842e1db9cd3d168bc39e67a5ec05b3ad010207168d2bc0f52f845d06c79255a240752bcf4865209757ea
SSDEEP 768:ky2SSS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIh0uSV4Orov+N:ky2SSqE7evWgd5f/bu1jafh0uU4FmN
TLSH
T101D2D93B640DCB7F4F804ADDAC197E9E6DA802CB9698C98047FA951C03C6BEF51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8f16522-a181-4695-8086-f16edc9fd38e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b8f16522-a181-4695-8086-f16edc9fd38e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 df2a51b9579e082ecfb8610b9bd72b81418e95840cc51bd3c4d426ded0af1ed7
MD5 240a5128fad3fad4ddf5c61d3bae1f65
SHA1 0b225a2cba381d9195c05e9087e729518080abca
SHA512 c41e43c1d21cf94728cb28c775609bd08065c2338464897a1d0370f2b8789645f631bb9615cf799db8993c54e6412c8511fd62733bb627ce102c3900ab7dc020
SSDEEP 384:nTZcIs38NSvLKmivyfG6d+dfYb9UUMCgWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9r:Ls3z1eqT1Aam6aQMGdjWca4Ghf93gm
TLSH
T162E29F305878DD779CB7E695F66B2683BDF052F388C84E44D9E99B0D029718E270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 23994230bc00d6c119dac549bac4d6517d0ad4b3301778ecafc78b6ff17226bf
MD5 90fd73bda8e1242ccedba6312d0ff0eb
SHA1 d5d28ee437b1c860939f0e1f072774fbbfbd2162
SHA512 465c7ebdf08dd2a40d5ca5926e9b92dab07a0908908312ea1c5ad91460ae2c4c11a066e09c35e158b2a4a91486aa6d53e4ba67e0ba11443c8bd39b253bed15a8
SSDEEP 768:fFQU35wguWWJAam6aQMGdjWca4Ghf93gm:iU3mTmaME6p3b
TLSH
T1AF03F6F188E79937D8AE9783A73D6D4299BCD1A3B4884980B7D85D0DCD821BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6eadc48de3aa556c1d7b5d3fb21336ba1a0d57bf5ceef9b7da927d9a37536f60
MD5 0d2de4153347b8c83e47d63dd59954d3
SHA1 ac09e50e4d9064ebcd2e81f24e6ffa2b9835d845
SHA512 7306a2d5737e6d5b3f1022ece10f24e24cb91d96901efd97debe2414b3815e93e7562cd06bb65572a8c3661f6c04049f003fea8fffa4a33895a0a4e1cf352577
SSDEEP 768:/rv+4UNbdq3I3q8AAam6aQMGdjWca4GhfBCPeU/:/bsbc3KKmaME6p6H
TLSH
T193F2AE31A87C9973DDB79A99F21B6687BEF021A384D40E80D9D91B0D439708E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 94432eb41d43332815465661a9ee6bc6a5f1bac517372a4c48076736617d4571
MD5 14af6aa475bb3aaba01265d81a2cb8bd
SHA1 e7f05aeee90bfeb8f4ee2b74e3f28d002a039ae0
SHA512 a540772f8adc34dfb482fbd50014b05e37c8475cb21c9858f2244941ce370109d03a11a1f1e5ad9dbc620b2aa971630b82409e5d13824b4e04597791bb134651
SSDEEP 768:erv+4UNbdq3CQqT0Aam6aQMGdjWca4Ghfw3PeU/:ebsbc3WWmaME6pAH
TLSH
T1D1F2AF31A47CD9739CB7A695F25B7683BEB421B388C40E80D9D96B0D439718E370B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 963b1bd0b787e0a49edc76c83106c0fb9c9144843cf94700cc4dd5dc42d69b42
MD5 d264938e09406d342176adbff9ec1e39
SHA1 e4c84fb4ea41852d808f46b15871d9a6208716d9
SHA512 0cb51b4d4eedc0567ee44e9c73e2446bd7d20fb908d0f9efc5a5a66ff101dc66461d4d27fa823183d64a0eb3c0a643a5c82dd56d446973f9b70d8fb7d1630e39
SSDEEP 384:nlZcIs38NSeLKmivXfG6d+dfYb9UUMCgWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9r:ds3wWeqT1Aam6aQMGdjWca4Ghf93gm
TLSH
T12AE29F305878DD778CB7E696F66B2693BDF051F388C84E44D9E99B0D029718E270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

2d541e51-14ee-4dbc-9321-2203ebb31629.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2d541e51-14ee-4dbc-9321-2203ebb31629.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1444_1596188621\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 e7f298e8a9150fdcee34afd3aafc615e31bfdaaef2089c77d054585b441a525f
MD5 bd67fea73c4bee42ab2f176fcffa0a47
SHA1 55d19b721a51975a36bc5f8a5185fefb78d13b5a
SHA512 7ca694d4594643a9a122f0b4351587348fbbdc73f8e6548f7d575db305b60f385ad2cc2edcc3fc2a9340867650d61ec8b7b7cb72a1a362b89dcdc4ba8d6f57c3
TLSH
T10271040541457C04D114D034D5410C407110D510503D11504DD1404DC4031D1D5DD473
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5552-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download