7d0f7d4dd28130bf130a16fc125a37e7fa4f56900fad7f02fadcf609788d1948

Analysis

max time kernel
150s
max time network
152s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
02/04/2023, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Saitama battleground - Linkvertise Downloader_At-LHk1.exe
Size

10.8MB
MD5

9ef88d8681a8606d5572078acfef47d5
SHA1

7d78745444359b634c1fd8f0c4f5bcc11a601daf
SHA256

7d0f7d4dd28130bf130a16fc125a37e7fa4f56900fad7f02fadcf609788d1948
SHA512

f9106049cf41fe67f1e97f1eb12bbb4a3c4dfc72252893aca3413c305ee62210b416d1ad160bf0c9b9a1313e404a406e400f74d3d49b13c0d0d5d363b8cc0ba5
SSDEEP

196608:R38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ughp71:21MlCC0Ybzf4zZKUok5oXN8i1

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Control Panel\International\Geo\Nation	Saitama battleground - Linkvertise Downloader_At-LHk1.tmp

Executes dropped EXE 1 IoCs

pid	Process
1500	Saitama battleground - Linkvertise Downloader_At-LHk1.tmp

Loads dropped DLL 3 IoCs

pid	Process
1500	Saitama battleground - Linkvertise Downloader_At-LHk1.tmp
1500	Saitama battleground - Linkvertise Downloader_At-LHk1.tmp
1500	Saitama battleground - Linkvertise Downloader_At-LHk1.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = aa1453431465d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d1feab3b1465d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{A667B3E1-F949-4A51-9F8D-EC868548A3F0} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\work.ink\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "604"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\work.ink\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 2a304e431465d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "3040"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "23"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "3040"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "387188099"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3364	MicrosoftEdgeCP.exe
3364	MicrosoftEdgeCP.exe
3364	MicrosoftEdgeCP.exe
3364	MicrosoftEdgeCP.exe
3364	MicrosoftEdgeCP.exe
3364	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	MicrosoftEdge.exe
Token: SeDebugPrivilege	1328	MicrosoftEdge.exe
Token: SeDebugPrivilege	1328	MicrosoftEdge.exe
Token: SeDebugPrivilege	1328	MicrosoftEdge.exe
Token: SeDebugPrivilege	3368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2500	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2500	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2500	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2500	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1500	Saitama battleground - Linkvertise Downloader_At-LHk1.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1328	MicrosoftEdge.exe
3364	MicrosoftEdgeCP.exe
3364	MicrosoftEdgeCP.exe
2500	MicrosoftEdgeCP.exe
1328	MicrosoftEdge.exe
1328	MicrosoftEdge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1500	1232	Saitama battleground - Linkvertise Downloader_At-LHk1.exe	66
PID 1232 wrote to memory of 1500	1232	Saitama battleground - Linkvertise Downloader_At-LHk1.exe	66
PID 1232 wrote to memory of 1500	1232	Saitama battleground - Linkvertise Downloader_At-LHk1.exe	66
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 3368	3364	MicrosoftEdgeCP.exe	71
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 5112	3364	MicrosoftEdgeCP.exe	74
PID 3364 wrote to memory of 2500	3364	MicrosoftEdgeCP.exe	75
PID 3364 wrote to memory of 2500	3364	MicrosoftEdgeCP.exe	75
PID 3364 wrote to memory of 2500	3364	MicrosoftEdgeCP.exe	75

C:\Users\Admin\AppData\Local\Temp\Saitama battleground - Linkvertise Downloader_At-LHk1.exe
"C:\Users\Admin\AppData\Local\Temp\Saitama battleground - Linkvertise Downloader_At-LHk1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\is-4QMDT.tmp\Saitama battleground - Linkvertise Downloader_At-LHk1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4QMDT.tmp\Saitama battleground - Linkvertise Downloader_At-LHk1.tmp" /SL5="$801F8,10376221,1235456,C:\Users\Admin\AppData\Local\Temp\Saitama battleground - Linkvertise Downloader_At-LHk1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:1500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1328

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3036

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5112

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV9H23MJ\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1CPPCUZR\app.19277997[1].js

Filesize
239KB

MD5
5360a18e4b91c939f26ae6f4de934986

SHA1
4c4243242876d3499bf1551deae1f9915647ebff

SHA256
f55b1d7675f614e0f92ce36121cc21ca0c31e2c6814dbe6b5cdbf1171bcd2bc7

SHA512
8bb5b0969c59aeeb4d941de4c49ad63cfc8fe865477d41f96a9f0e77707bf156cade52a92d2084336424c90d794f265e6687fe106cdf8c97b4899b123ee7cb61

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1CPPCUZR\app.ecdae8d3[1].css

Filesize
25KB

MD5
605955618a024abe1913a94b55a69431

SHA1
9eccc46de861936cc8aee5c5c1da45d9fb75f0c5

SHA256
31fa4be93ad4eba4c8ce64b4f820f4e1acbd8eb3d90c6f29f354a9760c361216

SHA512
744ad479b10e286f167349c6d4893a9c3153d56cca0b96f76ae3dd81ffa12938ba69ed6994bf535dc466a583c0126f42ec5b9140d5caa2bc880348d14a49bc77

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\23J1WHYA\chunk-vendors.3ded2ec4[1].css

Filesize
51KB

MD5
44168ea98932ccef401f415c89597f2e

SHA1
2d32f8e1472fe776baede9917704abd2672c1108

SHA256
13f5033c8999b1545c9ba66fbe446c2e7ad282dc1c43a53cdf3a23df33a92411

SHA512
937fac3a0e220839732d6c69a104ec9ea1dda9d5f2d9dde418fcffe224df77c92c683e724d88e37b91beeacbf2247bc6984aa66351415c4bd88386a975632719

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\23J1WHYA\chunk-vendors.f4c76a04[1].js

Filesize
248KB

MD5
98befdba42d0ec300bbc40f1fbb00fde

SHA1
29752946ce52dfbae9c34154e01aa2fcb51dea4f

SHA256
1ece5a4c55e358126943c2aeb571331796de3d3569b96c00846770643011a297

SHA512
30ce0c2367760226259109ccfa52df119d68ba9a1d8682d420bc58281e3dff8a003ffa94ed22dcd127f399667e53271fe0b830acde603a7836269a85b84d87c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Q9G1ZSME\invisible[1].js

Filesize
25KB

MD5
b3d11ed4ac4557ea1368701833b7ecb9

SHA1
721720a26083be401f8c21349c884ba0da56545e

SHA256
e85ed05086015e7075bcc4d7382d7f170735a62c8f1ec8be45b1290c27d7bb0e

SHA512
600b469fedd4253e64c4a17e73feb58ebe19cf64469ede7fd0be25fccf1270f28b22302d9249119e4ebf478f7a2e8962b24227c70f5bdc80b5e782fa4b3c14c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\8L4R3AR9\www.bing[1].xml

Filesize
1KB

MD5
f8e94250fa3a880ead5ee3afce8da058

SHA1
81ac71c4db53a69f70e527756eb4965c63a41b46

SHA256
048c54b586d63970c6ec4d1e6c2c67ed4d789dac13f8a671d8996d1889ea9778

SHA512
b9e86f606728b9fb36dc2e2df17761b0845ba5fa344b1b74ccac8e81bebde5f82b48fac3c0810ea46806f80e7a9c23be459ef86d952def8bebc9cf0e2bc7c824

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\VOF2YXQL\favicon[1].ico

Filesize
66KB

MD5
afa017d3bae1d7539d939babd2d8fd67

SHA1
16ecbf50426dba05f7020acd46029894d4148737

SHA256
68cca3dd30e521ceec8d25007ef10349c4483343dcb8de14c3ea533ea8b53948

SHA512
6697ae0eeb7bf0c2cbc85b3e38312d2715cac6a4ebe8b294de10fedf305f10693c1036e1189f2327c8010fdee5a098f2cac39a0ccb1ee021b03cf74e46b18b36

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\VZBXI7LQ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1CPPCUZR\app.19277997[1].js

Filesize
239KB

MD5
5360a18e4b91c939f26ae6f4de934986

SHA1
4c4243242876d3499bf1551deae1f9915647ebff

SHA256
f55b1d7675f614e0f92ce36121cc21ca0c31e2c6814dbe6b5cdbf1171bcd2bc7

SHA512
8bb5b0969c59aeeb4d941de4c49ad63cfc8fe865477d41f96a9f0e77707bf156cade52a92d2084336424c90d794f265e6687fe106cdf8c97b4899b123ee7cb61

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1CPPCUZR\app.ecdae8d3[1].css

Filesize
25KB

MD5
605955618a024abe1913a94b55a69431

SHA1
9eccc46de861936cc8aee5c5c1da45d9fb75f0c5

SHA256
31fa4be93ad4eba4c8ce64b4f820f4e1acbd8eb3d90c6f29f354a9760c361216

SHA512
744ad479b10e286f167349c6d4893a9c3153d56cca0b96f76ae3dd81ffa12938ba69ed6994bf535dc466a583c0126f42ec5b9140d5caa2bc880348d14a49bc77

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\23J1WHYA\chunk-vendors.3ded2ec4[1].css

Filesize
51KB

MD5
44168ea98932ccef401f415c89597f2e

SHA1
2d32f8e1472fe776baede9917704abd2672c1108

SHA256
13f5033c8999b1545c9ba66fbe446c2e7ad282dc1c43a53cdf3a23df33a92411

SHA512
937fac3a0e220839732d6c69a104ec9ea1dda9d5f2d9dde418fcffe224df77c92c683e724d88e37b91beeacbf2247bc6984aa66351415c4bd88386a975632719

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\23J1WHYA\chunk-vendors.f4c76a04[1].js

Filesize
248KB

MD5
98befdba42d0ec300bbc40f1fbb00fde

SHA1
29752946ce52dfbae9c34154e01aa2fcb51dea4f

SHA256
1ece5a4c55e358126943c2aeb571331796de3d3569b96c00846770643011a297

SHA512
30ce0c2367760226259109ccfa52df119d68ba9a1d8682d420bc58281e3dff8a003ffa94ed22dcd127f399667e53271fe0b830acde603a7836269a85b84d87c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9BEJRO97\SaitamabattlegroundScript[1].htm

Filesize
4KB

MD5
f7608454536d35870bac44e7e30ecf15

SHA1
22452263618220f7cd96f5e04e233500cf030226

SHA256
f2787444f242574fa792a373616075b5db3252ce4616d39358a6e28d2d14485a

SHA512
1867fa7e335504f5aa0ff6fca4f85c579a83978fd2263a9fa9bf036182d71e0e4f042e5171449ce1e8d036c5e245f45868da4fa805464e0cd990dd0fa916b030

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Q9G1ZSME\invisible[1].js

Filesize
25KB

MD5
b3d11ed4ac4557ea1368701833b7ecb9

SHA1
721720a26083be401f8c21349c884ba0da56545e

SHA256
e85ed05086015e7075bcc4d7382d7f170735a62c8f1ec8be45b1290c27d7bb0e

SHA512
600b469fedd4253e64c4a17e73feb58ebe19cf64469ede7fd0be25fccf1270f28b22302d9249119e4ebf478f7a2e8962b24227c70f5bdc80b5e782fa4b3c14c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\0G5NI0Y3\work[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
300B

MD5
bf034518c3427206cc85465dc2e296e5

SHA1
ef3d8f548ad3c26e08fa41f2a74e68707cfc3d3a

SHA256
e5da797df9533a2fcae7a6aa79f2b9872c8f227dd1c901c91014c7a9fa82ff7e

SHA512
c307eaf605bd02e03f25b58fa38ff8e59f4fb5672ef6cb5270c8bdb004bca56e47450777bfb7662797ffb18ab409cde66df4536510bc5a435cc945e662bddb78

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
c6b4ed8c5da4494b3e5b7a8d022f6108

SHA1
ee75e36a2978af1ce844dd250f94e58e6c565c6c

SHA256
b2ce001662481990851a2b49b458fca8713ed84a406c8bca807f91b179c8a80d

SHA512
454ff948700404506c7aff971095adb7a805f4d6d76b4464d7c9eb6cbaa86ddc55b1dfcf84877e187514d5688e7aa978f9c9459478bd02e9234b3f7dcabe9957

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
192B

MD5
cb396270dba3e6155a2bb4ee89ce0a9e

SHA1
4e35a8a709863500190a4304bfdf8d150857dad3

SHA256
749ad1befaad9ca2332630c7aee4765250ed0108775883949ae9899bef0d63b8

SHA512
1c30c7aa52a8bd9a7054c409cc108eb707893f1d30093127e0c896b7640607aec43e53d22e4e962247f0c52c8e59f8b40503ed342352aadd128c7cb100444aef

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4QMDT.tmp\Saitama battleground - Linkvertise Downloader_At-LHk1.tmp

Filesize
3.4MB

MD5
fbbad8149a1c6aed741101d3011757cb

SHA1
badef69a28b857fdd0b9859552736faba9e8886a

SHA256
d5f92ec4e4f095bea8fb56825333eaa6c3fb5e3b2dfc245bac058cdfb6cef4b8

SHA512
edc6d6cba79cc6d595cdc72f448189e9d5f5b0208c09bbfdd6344cd029848ec155e5aa744eac437a13f14f61b0297308b36df90b190a138e4c34aa8bb45d3b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CCVV9.tmp\side-logo.png

Filesize
29KB

MD5
06b0076d9f4e2488d32855a0161e9c74

SHA1
7dbc3c098f7fb1256aeca79c256b75802b5fdd69

SHA256
929243f002eb4209a9e68af6744a3d63ece2b173c910a59d6752536dabf3870b

SHA512
7cecc1fc1c13f97dfe1ae7592918c9df16233851a8dd667ac2199b92fd24410a6ef76acfa014cd00aad2d27dfe2887f41100563cf2240f720466dbebaed0375a

Download Submit
\Users\Admin\AppData\Local\Temp\is-CCVV9.tmp\AppUtils.dll

Filesize
1.8MB

MD5
43ce6d593abd5141a3139603f352ae05

SHA1
a97c75e23d275dddfde15ef5fdf3ff3253c0992c

SHA256
94e874f2702ea6be50e7d74864b66e7f763449c3db237803f3fad6adfd64ed3d

SHA512
bfc527529e5f73ba190dfc5bd043175c7e2ae963b665d6d39421c29e025020f1d593dc88b7bee33d86ef6b4f7a4c5e1a0339df4e99cab6849a275d1dda9f439f

Download Submit
\Users\Admin\AppData\Local\Temp\is-CCVV9.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
\Users\Admin\AppData\Local\Temp\is-CCVV9.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
memory/1232-215-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/1232-121-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/1232-155-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/1328-197-0x0000020E5A3E0000-0x0000020E5A3E1000-memory.dmp

Filesize
4KB

Download
memory/1328-160-0x0000020E59F20000-0x0000020E59F30000-memory.dmp

Filesize
64KB

Download
memory/1328-202-0x0000020E5EC80000-0x0000020E5EC82000-memory.dmp

Filesize
8KB

Download
memory/1328-317-0x0000020E605C0000-0x0000020E605C1000-memory.dmp

Filesize
4KB

Download
memory/1328-201-0x0000020E5EC50000-0x0000020E5EC52000-memory.dmp

Filesize
8KB

Download
memory/1328-376-0x0000020E60500000-0x0000020E60591000-memory.dmp

Filesize
580KB

Download
memory/1328-199-0x0000020E5EA00000-0x0000020E5EA02000-memory.dmp

Filesize
8KB

Download
memory/1328-157-0x00007FF83FE5B000-0x00007FF83FE5F000-memory.dmp

Filesize
16KB

Download
memory/1328-315-0x0000020E605B0000-0x0000020E605B1000-memory.dmp

Filesize
4KB

Download
memory/1328-178-0x0000020E5A500000-0x0000020E5A510000-memory.dmp

Filesize
64KB

Download
memory/1500-145-0x0000000005600000-0x000000000560F000-memory.dmp

Filesize
60KB

Download
memory/1500-159-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/1500-158-0x0000000005600000-0x000000000560F000-memory.dmp

Filesize
60KB

Download
memory/1500-156-0x0000000000400000-0x0000000000775000-memory.dmp

Filesize
3.5MB

Download
memory/1500-213-0x0000000000400000-0x0000000000775000-memory.dmp

Filesize
3.5MB

Download
memory/1500-126-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/3368-311-0x000001BB16280000-0x000001BB16282000-memory.dmp

Filesize
8KB

Download
memory/3368-239-0x000001BB043A0000-0x000001BB043A2000-memory.dmp

Filesize
8KB

Download
memory/3368-241-0x000001BB043C0000-0x000001BB043C2000-memory.dmp

Filesize
8KB

Download
memory/3368-243-0x000001BB043E0000-0x000001BB043E2000-memory.dmp

Filesize
8KB

Download
memory/3368-261-0x000001BB14EA0000-0x000001BB14EC0000-memory.dmp

Filesize
128KB

Download
memory/3368-262-0x000001BB14700000-0x000001BB14800000-memory.dmp

Filesize
1024KB

Download
memory/3368-299-0x000001BB16210000-0x000001BB16212000-memory.dmp

Filesize
8KB

Download
memory/3368-301-0x000001BB16230000-0x000001BB16232000-memory.dmp

Filesize
8KB

Download
memory/3368-309-0x000001BB16250000-0x000001BB16252000-memory.dmp

Filesize
8KB

Download
memory/3368-313-0x000001BB162A0000-0x000001BB162A2000-memory.dmp

Filesize
8KB

Download
memory/3368-380-0x000001BB03E00000-0x000001BB03E91000-memory.dmp

Filesize
580KB

Download
memory/3368-347-0x000001BB1B200000-0x000001BB1B300000-memory.dmp

Filesize
1024KB

Download
memory/3368-316-0x000001BB162C0000-0x000001BB162C2000-memory.dmp

Filesize
8KB

Download