fcc5bf9d8d5bb36fbf740eda4bd842c2ea8d948f1259eab6e3fae90c6e2a710c

Analysis

user interaction
yes
max time kernel
26s
max time network
27s
platform
windows11-21h2_x64
resource
win11-20260130-it
resource tags

arch:x64arch:x86image:win11-20260130-itlocale:it-itos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 06:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PvZ_Toolkit_v1.22.0_EN.exe
Size 1020KB
Sample260509-hql8sacs21
SHA256 fcc5bf9d8d5bb36fbf740eda4bd842c2ea8d948f1259eab6e3fae90c6e2a710c
MD5 2f866dcf0e889d10250882281e6d8bd9
SHA1 24d4647199499173fd1c4769057ae22df584c74e
SHA512 b3f45e7f8853580aaa5db3665d567433b77f245eaab98b0d7f5ecb43dd343fc0189cdd44a09ce5a990afb7c4ebebd55ed341fee027e81a0672a9535da763b936
SSDEEP 24576:E+Fl435CDihXNWck7KhL+9ZsQetZ6cvKCt2wLW1sViT+7r:fgpQQkqt2YasVt
TLSH
T12625BF0077C3E1F5ED532030129BB777AAB57E00463E896BA3D47E35AE70193662B2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PvZ_Toolkit_v1.22.0_EN.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1460	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227834101618651"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{421E0605-DC24-4203-BC0D-C3ABE214A470}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3104	4068	PvZ_Toolkit_v1.22.0_EN.exe	78
PID 3104 wrote to memory of 3532	3104	msedge.exe	79
PID 3104 wrote to memory of 1460	3104	msedge.exe	80
PID 3104 wrote to memory of 460	3104	msedge.exe	83
PID 3104 wrote to memory of 460	3104	msedge.exe	83
PID 3104 wrote to memory of 2116	3104	msedge.exe	81
PID 3104 wrote to memory of 2116	3104	msedge.exe	81
PID 3104 wrote to memory of 2116	3104	msedge.exe	81
PID 3104 wrote to memory of 2312	3104	msedge.exe	84
PID 3104 wrote to memory of 4136	3104	msedge.exe	85
PID 3104 wrote to memory of 2312	3104	msedge.exe	84
PID 3104 wrote to memory of 2312	3104	msedge.exe	84
PID 3104 wrote to memory of 4136	3104	msedge.exe	85
PID 3104 wrote to memory of 4136	3104	msedge.exe	85
PID 3104 wrote to memory of 4244	3104	msedge.exe	86
PID 3104 wrote to memory of 4244	3104	msedge.exe	86
PID 3104 wrote to memory of 4244	3104	msedge.exe	86
PID 3104 wrote to memory of 4940	3104	msedge.exe	87
PID 3104 wrote to memory of 604	3104	msedge.exe	88
PID 3104 wrote to memory of 4940	3104	msedge.exe	87
PID 3104 wrote to memory of 4940	3104	msedge.exe	87
PID 3104 wrote to memory of 3392	3104	msedge.exe	89
PID 3104 wrote to memory of 604	3104	msedge.exe	88
PID 3104 wrote to memory of 604	3104	msedge.exe	88
PID 3104 wrote to memory of 3392	3104	msedge.exe	89
PID 3104 wrote to memory of 3392	3104	msedge.exe	89
PID 3104 wrote to memory of 2004	3104	msedge.exe	92
PID 3104 wrote to memory of 2004	3104	msedge.exe	92
PID 3104 wrote to memory of 2004	3104	msedge.exe	92
PID 3104 wrote to memory of 1564	3104	msedge.exe	93
PID 3104 wrote to memory of 3324	3104	msedge.exe	94
PID 3104 wrote to memory of 1564	3104	msedge.exe	93
PID 3104 wrote to memory of 3324	3104	msedge.exe	94
PID 3104 wrote to memory of 3200	3104	msedge.exe	96
PID 3104 wrote to memory of 3196	3104	msedge.exe	97
PID 3196 wrote to memory of 4516	3196	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\PvZ_Toolkit_v1.22.0_EN.exe
"C:\Users\Admin\AppData\Local\Temp\PvZ_Toolkit_v1.22.0_EN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pvz.lmintlcx.com/toolkit/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffe278dc188,0x7ffe278dc194,0x7ffe278dc1a0
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,16880920335924684958,4784168576636907183,524288 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,8289747852982345245,8503457279438547422,262144 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,18038594802273041997,8315504688076708612,524288 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,12711235016706295456,3524525259224367033,2097152 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,3261037422495065390,15046178078305348238,2097152 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,5164155590980235265,12326716635023021971,2097152 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,10311496330265203589,13096033738014846817,2097152 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:9
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4188,i,4277537226843309739,6952117211677800201,2097152 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
    3⤵
    PID:604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4320,i,3353732134411318572,17936726719345520583,2097152 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4212,i,8220434803108295864,17672094556073714861,2097152 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,12517389964272458691,17394691453352081827,524288 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=it --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,1345194134617898585,11857265879946235253,524288 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9661476234564040750,9927396771327085854,524288 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9661476234564040750,9927396771327085854,524288 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,11597946324101609030,3212411100698510766,524288 --field-trial-handle=2064,i,15244584535707217774,1972403088348633639,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 346ea60a0ae4d17c01949616e7832cf3b359983afcbb7e8912fe8a59321ed461
MD5 203e8ac15dc2fa01607dca121531cbf9
SHA1 6bb9e33e0eaaee142dcc669c175ec6b9508af90e
SHA512 9cbb9572308545c1a11487db03ac7301a81dad98c83fd39ad60fc0ba640dee016818808cbd7f5e840f2b2084982cd60ac725f84529aac2387baa86bafeb505f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e365308021ade71cd7fd8bcb77743afa8328c70101415bb9b419c11ce7afa8b2
MD5 20d252cf697b00581a3fc1a7eb0aa400
SHA1 999f264f6caea10fd708d20094aec5024868af67
SHA512 7bdbd68d07d0b20ca7f49d51c821765822e32a81d51915eddc65d999ab43472632b096aaaf0a8fc634bc0a88ab61a5ff5c5b9e3a19f7fb7623f3e7b7a69eb13a
TLSH
T1ACD0805C17F76C31E554AD7004563F15BA55D5B39B49D73164732C791C4208215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 014d42468ef22cfb554d93290573d937250dc28529c4a615388fd929958f1227
MD5 a3b858ce8dfa1701171a948affaee614
SHA1 1ece5d9e3982bc5c0fb7a661d53bf4c92930df05
SHA512 ab1957d0a53965855ce8378874a987bb344ee039469b8def3e5472c3cc2e094a3ff0827b59fa445ac7b47949f90be9dd9504cb58ab755ad925da38092bd8a4b5
TLSH
T161D080287BBF7C51E1015D708C116711FF5695E27F9F96217061583EAC1145167D1283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a6727a0a4fa4cb1a57a4c321f756d9dd6f44ea45d205327c5e7e5f18c2f6950
MD5 8f53b23305ec44c09bb086cb47d00ebe
SHA1 a54d190b6b6e3b05a68b18a4e38bc67e0d914f6d
SHA512 24004588102e1fa8a9bf07c27541083145da06836345681ba0f438a086ca89db4bcfe563005d6b736f731acf1ba98f4abfdd021ee48bd0cd93d4afd01bba7f70
TLSH
T1DBD0805C57B76C31E554AD7004573F15BA55D5B39B49973164732C791C4104215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3169b2f12a89c89af2c81f3252038da38bbe0070d576ab208505debc20ce661e
MD5 e278644b20527f561e5fb70477250fb7
SHA1 81712521b563c759a53fd263b22218255d768116
SHA512 3080da89cd4459e0997cd3c4c94d99e2b837790d86ac4e6c9358563c477b1c1b1dc18a4722d60a29af70151ac8200138d88ff642f1dc20b265b457d6b176f46c
TLSH
T1B271A2045A9A8428E7D1D2B67AEBB00932FC5419014B0F17FEF0C93DBB0BF9251C0917
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58360f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58360f.TMP
Size 3KB
SHA256 a9645c85538e50b4193805dfa55e81ac8085cc28459a427b3190e994f3ebeda2
MD5 b07baaedd192cee0df4c4fabe804c5e5
SHA1 5b46b99f64195b89314d50897290c1afa5f55d38
SHA512 f4a73c3bf05e2f56ae2991d97ec091efe1ed4b5b070bf90c29bc504b0a76be9dc720e288bda803726c934fba567d10165510186b119b7113053061c39f7c41f4
TLSH
T193717E445A6A8019E7D0D2B27AE7700932FC551A410B1F17FEF0C67DBB0BFA211D0917
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 006714043dc9a3cd25820733ee4b936f7b5c539bd1b1b3d661aa2405114ae5d0
MD5 4e724c9920ba6eed4410bf7056c05e1b
SHA1 5ab06cd1186908861cfedc3a9395981c870a8dd5
SHA512 204ec96497c9d7e366cebcaed7b87a799188ff782a5bed3f2e5413fdf4c96e3d3fe69e41bdfc968a15f38d875a933df3dfd6dda2e4a74845ba17f7600b8cf451
SSDEEP 1536:rfEEixdvNdb6GZqW3b5PDuVhpBHExvoZsV62UHPq:YZv30maUUC
TLSH
T17EB36226D6A64C2B01F12264EC754383F325436F9286A82F3A7C5D5C2FBD93A6542F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6b0b834ae8245c96bfac7d0ce7e0c67aa57a907aa3f7b588b4aeed1dc70c11be
MD5 93341b2c934b378bb3d67bc9b9420ade
SHA1 60bfc6124e769c77add0b6c892c786dfb475884e
SHA512 d12f9257086f6d669dfe9c965868aeb5e38d7bbe531a2d35a89d8317ae54070a0c3bdb48128bc4ef8727a39d41748aa40d3c57efca72ed4e4dbafaf73277f3d0
TLSH
T152216BFB43B05A7E9F2191F0AA186E1BCFA90512435C3D7A85E06E27A3E7474E105A4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bc375a1118ee84a0c0f115fd6a61a75c978ff8089e6c28de6e5c7b997c9c5b86
MD5 915c238f56db76811e2b67cbb4668f72
SHA1 39cbf02d4e8008e4066e2c117fe4f0bd1e9e493b
SHA512 a807ac2711e7af4c7c8c117d8829b607b63b1bc4189b3decfd126f607e8946039e3b9d312d075157894b8eca1f67741f67f80ede1858ce9465e035392b9938a6
SSDEEP 192:sxZx/yaLKOMl8Ecv/fDsKWpVP58IupWRA/W6+WNOorB2+/Y0KvuENIgyJ:sxZxwuv/fDsKWvP5cf/b3F/5gO
TLSH
T1B452E9127A38997B8CDBD21DFA55BB53D6F5182292900E44AAFCDA1C04E67EC2303C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 90793d967573de4b12e7077975abf6e815b1a97d96c3d0e8163ab8ab333acb93
MD5 7d27361081a4a90fdf9b615088fe666d
SHA1 98a46615cdefc22b1696429ad08f4a7a886ff4f7
SHA512 ce269b9cce9070df53347c96ce159be69904ec1cff50321ce7875e7a1de25f55ccb0f0eaecdecdaf83f5d181507c6707c254e7aea0eaac9066fe100d5e0b9727
SSDEEP 768:yD91L8/j2JeWRmqSQBq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV30JLl/cW0nzFroDX:yD91L8/j2JeWRmqSQBqu1jaK0JLpcvn4
TLSH
T11BE22A2B284CC77E4FC00E5CEC26AF966ED801CBA6588D5447EA894C03C77EB561B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f52fcdb9986038bf6dd902f9712a802d8e74bd29f14ed54b5b77f05c8148cc74
MD5 3eca522cf12e66570a32fd0a3095a8ce
SHA1 06ef5d67f708090e09c3ac57d37699c92fb096bc
SHA512 fc66e0027b120c421ea9bef1b1c3520e4c3dae070df80faad1300618e9d1b0100f7ab51538042dee0e7fec89b00c9209be6d4eaa45897893165388bbe87a8321
SSDEEP 24:Kga16U4IhKOhw1iSHcByX3I/AoWI5KchM1KSJ2x3fOVsaJd99N4Z1+gIjJNKi6hF:KwvIhK4w0fy9pI5KqM0SkIfK9Ocfy2
TLSH
T18991AA1070369286397E6A4D8394A4AE46C13173311CFABB3FF900619F2AE558EFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 718bff03f7d159f2b8ad0ff850b73696fa8df02fa20ca8bd24f471dc96eeac98
MD5 ee37138ef94f7b6a12de45d7f254e478
SHA1 5c2d5ef01618293b46aba15189d5dddf740dcb05
SHA512 79a96cc958c37019e814666c475fe7e5510dafaceb9e8b865550c086b670605616e2715d2c4e65496612fa1023dfcec9b6ec422f9d6d7236da5936434aa8c874
SSDEEP 192:ZGNe6hNQmiUyDGhoNYX5Hw/5+IOiahHnWYbrU6:ZGNe6RwGKNYX5Q/5+IOiuf3U6
TLSH
T1DB02D834BD6C7C779EF2AE49B48737179FA4107BEA956F84D6E81B1D00C725C2346822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ab7b4723786ad479d4fec320a8c3c736a5e2e6664555f96e852e229b6d86610e
MD5 3048b681d8c9c422042cb20428accd18
SHA1 0f21fd03b8f1d18716d786c104764d05a63c05ef
SHA512 f455ea991f4ce03749b95e74b98757f9902733254ad2bbbeb99da09143bf6cbb2730101f7974ccb49f2adaf491e56a3c45cbae8608d41cf2fddd1aa705b7d39b
SSDEEP 192:8GNu6hrQmiUyhlofYX5Hw/5+IOiahHkghyhqLgqLyU6:8GNu6HUGfYX5Q/5+IOiuEoRwU6
TLSH
T193121934796DEC2759E6A548F48732939FA92077EA85AF84E1E85B1C00C735C274EC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 c26f6c5daac764f15c36017e68944c46e7df5dda76f5bcdd376e6dd6c15d3422
MD5 81f83cc4b005f422938195b000ed2a61
SHA1 e0651cf99f3accbe4bc4f9d53563b5385b8ee032
SHA512 f9338d0308a2025992290557cb249818a5fdf6289d0ae3f02058cd2817a598817bd7930674a15378ac5c48af9c12fe8e746d31d77c650b18a74ff95fb8e753d9
SSDEEP 384:n9i8NbkfGztr/i9JX5Q/5+IOiuEoTiWrfSA9IX2U8:wBfMUTw4IOiuE6tfl9U2U8
TLSH
T16082193DAD684C3F44EEB74CB60E35234E68063BD6B4A968E7E81B0DC17956DF306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

65cc71b9-f2a9-4c58-96c4-e935b55c2cc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\65cc71b9-f2a9-4c58-96c4-e935b55c2cc2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/4068-296-0x0000000001390000-0x000000000161B000-memory.dmp

Download

memory/4068-326-0x0000000001390000-0x000000000161B000-memory.dmp

Download

memory/4068-327-0x0000000001390000-0x000000000161B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads