Analysis
- user interaction
yes - max time kernel
114s - max time network
869s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/08/2026, 10:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://linkvertise.com/access/6937374/0kcDrreimCc7
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
900 seconds
General
- Target https://linkvertise.com/access/6937374/0kcDrreimCc7
- Sample260806-l2nsjaycpg
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\devmgmt.msc mmc.exe - Drops file in Windows directory 59 IoCs
description ioc Process File created C:\Windows\INF\c_fsquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_barcodescanner.PNF mmc.exe File created C:\Windows\INF\c_computeaccelerator.PNF mmc.exe File created C:\Windows\INF\c_magneticstripereader.PNF mmc.exe File created C:\Windows\INF\c_proximity.PNF mmc.exe File created C:\Windows\INF\oposdrv.PNF mmc.exe File created C:\Windows\INF\c_fssystemrecovery.PNF mmc.exe File created C:\Windows\INF\c_mcx.PNF mmc.exe File created C:\Windows\INF\c_linedisplay.PNF mmc.exe File created C:\Windows\INF\c_smrvolume.PNF mmc.exe File created C:\Windows\INF\ts_generic.PNF mmc.exe File created C:\Windows\INF\c_fsantivirus.PNF mmc.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF mmc.exe File created C:\Windows\INF\c_fsreplication.PNF mmc.exe File created C:\Windows\INF\c_nvmedisk.PNF mmc.exe File created C:\Windows\INF\c_netdriver.PNF mmc.exe File created C:\Windows\INF\c_fscontentscreener.PNF mmc.exe File created C:\Windows\INF\c_diskdrive.PNF mmc.exe File created C:\Windows\INF\c_media.PNF mmc.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF mmc.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF mmc.exe File created C:\Windows\INF\c_extension.PNF mmc.exe File created C:\Windows\INF\c_ucm.PNF mmc.exe File created C:\Windows\INF\c_processor.PNF mmc.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF mmc.exe File created C:\Windows\INF\c_fssystem.PNF mmc.exe File created C:\Windows\INF\wsdprint.PNF mmc.exe File created C:\Windows\INF\c_scmvolume.PNF mmc.exe File created C:\Windows\INF\c_scmdisk.PNF mmc.exe File created C:\Windows\INF\c_fsvirtualization.PNF mmc.exe File created C:\Windows\INF\dc1-controller.PNF mmc.exe File created C:\Windows\INF\digitalmediadevice.PNF mmc.exe File created C:\Windows\INF\rawsilo.PNF mmc.exe File created C:\Windows\INF\c_fsencryption.PNF mmc.exe File created C:\Windows\INF\c_firmware.PNF mmc.exe File created C:\Windows\INF\c_receiptprinter.PNF mmc.exe File created C:\Windows\INF\c_smrdisk.PNF mmc.exe File created C:\Windows\INF\c_holographic.PNF mmc.exe File created C:\Windows\INF\c_primitive.PNF mmc.exe File created C:\Windows\INF\c_cashdrawer.PNF mmc.exe File created C:\Windows\INF\rdcameradriver.PNF mmc.exe File created C:\Windows\INF\c_camera.PNF mmc.exe File created C:\Windows\INF\remoteposdrv.PNF mmc.exe File created C:\Windows\INF\c_monitor.PNF mmc.exe File created C:\Windows\INF\c_apo.PNF mmc.exe File created C:\Windows\INF\c_volume.PNF mmc.exe File created C:\Windows\INF\xusb22.PNF mmc.exe File created C:\Windows\INF\c_fsinfrastructure.PNF mmc.exe File created C:\Windows\INF\c_fsundelete.PNF mmc.exe File created C:\Windows\INF\c_fscopyprotection.PNF mmc.exe File created C:\Windows\INF\miradisp.PNF mmc.exe File created C:\Windows\INF\c_fshsm.PNF mmc.exe File created C:\Windows\INF\c_fscompression.PNF mmc.exe File created C:\Windows\INF\c_swcomponent.PNF mmc.exe File created C:\Windows\INF\PerceptionSimulationSixDof.PNF mmc.exe File created C:\Windows\INF\c_display.PNF mmc.exe File created C:\Windows\INF\c_sslaccel.PNF mmc.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF mmc.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3772 msedge.exe - Checks SCSI registry key(s) 3 TTPs 32 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304841402271844" msedge.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{C76E5C0D-BF75-4763-B0D4-1D26A66AC0A5} msedge.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings control.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{A10C9B3C-E44F-4989-B2FE-475DD4DAD671} msedge.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2704 mmc.exe 2704 mmc.exe - Suspicious behavior: LoadsDriver 12 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 676 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 676 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs
pid Process 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 1692 control.exe Token: SeCreatePagefilePrivilege 1692 control.exe Token: 33 2704 mmc.exe Token: SeIncBasePriorityPrivilege 2704 mmc.exe Token: 33 2704 mmc.exe Token: SeIncBasePriorityPrivilege 2704 mmc.exe Token: SeShutdownPrivilege 1692 control.exe Token: SeCreatePagefilePrivilege 1692 control.exe Token: 33 2704 mmc.exe Token: SeIncBasePriorityPrivilege 2704 mmc.exe Token: 33 2704 mmc.exe Token: SeIncBasePriorityPrivilege 2704 mmc.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2704 mmc.exe 2704 mmc.exe 2704 mmc.exe 2704 mmc.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4028 wrote to memory of 2772 4028 msedge.exe 80 PID 4028 wrote to memory of 3000 4028 msedge.exe 82 PID 4028 wrote to memory of 3772 4028 msedge.exe 81 PID 4028 wrote to memory of 3000 4028 msedge.exe 82 PID 4028 wrote to memory of 3000 4028 msedge.exe 82 PID 4028 wrote to memory of 5380 4028 msedge.exe 83 PID 4028 wrote to memory of 5380 4028 msedge.exe 83 PID 4028 wrote to memory of 5932 4028 msedge.exe 85 PID 4028 wrote to memory of 5932 4028 msedge.exe 85 PID 4028 wrote to memory of 5932 4028 msedge.exe 85 PID 4028 wrote to memory of 3924 4028 msedge.exe 86 PID 4028 wrote to memory of 3924 4028 msedge.exe 86 PID 4028 wrote to memory of 3924 4028 msedge.exe 86 PID 4028 wrote to memory of 3540 4028 msedge.exe 88 PID 4028 wrote to memory of 3540 4028 msedge.exe 88 PID 4028 wrote to memory of 3540 4028 msedge.exe 88 PID 4028 wrote to memory of 1340 4028 msedge.exe 89 PID 4028 wrote to memory of 5248 4028 msedge.exe 90 PID 4028 wrote to memory of 1340 4028 msedge.exe 89 PID 4028 wrote to memory of 5724 4028 msedge.exe 91 PID 4028 wrote to memory of 5724 4028 msedge.exe 91 PID 4028 wrote to memory of 5724 4028 msedge.exe 91 PID 4028 wrote to memory of 5472 4028 msedge.exe 92 PID 4028 wrote to memory of 5472 4028 msedge.exe 92 PID 4028 wrote to memory of 5472 4028 msedge.exe 92 PID 4028 wrote to memory of 3340 4028 msedge.exe 93 PID 4028 wrote to memory of 3340 4028 msedge.exe 93 PID 4028 wrote to memory of 3340 4028 msedge.exe 93 PID 4028 wrote to memory of 248 4028 msedge.exe 94 PID 4028 wrote to memory of 248 4028 msedge.exe 94 PID 4028 wrote to memory of 248 4028 msedge.exe 94 PID 4028 wrote to memory of 2960 4028 msedge.exe 95 PID 4028 wrote to memory of 2540 4028 msedge.exe 96 PID 4028 wrote to memory of 2960 4028 msedge.exe 95 PID 4028 wrote to memory of 2540 4028 msedge.exe 96 PID 4028 wrote to memory of 5536 4028 msedge.exe 98 PID 4028 wrote to memory of 5080 4028 msedge.exe 99 PID 5080 wrote to memory of 5128 5080 msedge.exe 100 PID 4028 wrote to memory of 2908 4028 msedge.exe 103 PID 4028 wrote to memory of 2908 4028 msedge.exe 103 PID 4028 wrote to memory of 2908 4028 msedge.exe 103 PID 4028 wrote to memory of 5348 4028 msedge.exe 104 PID 4028 wrote to memory of 4296 4028 msedge.exe 105 PID 4028 wrote to memory of 3496 4028 msedge.exe 106 PID 4028 wrote to memory of 4888 4028 msedge.exe 107 PID 4028 wrote to memory of 4888 4028 msedge.exe 107 PID 1692 wrote to memory of 2704 1692 control.exe 125 PID 4028 wrote to memory of 1892 4028 msedge.exe 126 PID 4028 wrote to memory of 1892 4028 msedge.exe 126 PID 4028 wrote to memory of 1892 4028 msedge.exe 126 PID 4028 wrote to memory of 5316 4028 msedge.exe 127 PID 4028 wrote to memory of 5316 4028 msedge.exe 127 PID 4028 wrote to memory of 5316 4028 msedge.exe 127 PID 4028 wrote to memory of 2576 4028 msedge.exe 128 PID 4028 wrote to memory of 2576 4028 msedge.exe 128 PID 4028 wrote to memory of 2576 4028 msedge.exe 128 PID 4028 wrote to memory of 5888 4028 msedge.exe 129 PID 4028 wrote to memory of 5888 4028 msedge.exe 129 PID 4028 wrote to memory of 5888 4028 msedge.exe 129 PID 4028 wrote to memory of 2772 4028 msedge.exe 80 PID 4028 wrote to memory of 3000 4028 msedge.exe 82 PID 4028 wrote to memory of 3772 4028 msedge.exe 81 PID 4028 wrote to memory of 3000 4028 msedge.exe 82 PID 4028 wrote to memory of 3000 4028 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://linkvertise.com/access/6937374/0kcDrreimCc71⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffccef0c188,0x7ffccef0c194,0x7ffccef0c1a02⤵PID:2772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,15535020065364236720,17082446612935962498,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:112⤵
- System Time Discovery
PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,11835735243741543122,15151243892121255662,262144 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,850937278136326587,275192260978838791,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:132⤵PID:5380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13437258349994710906,2312214825904915434,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:12⤵PID:5932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,1074897228698117608,10107592146958242473,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3436,i,9627240876096006460,6226327389518489231,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:3540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,6494006362922172069,1450878432340481387,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:122⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,7073401490337321882,2106958873184896343,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:142⤵
- Modifies registry class
PID:5248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5536,i,8137767627253318213,16990302863564877560,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:5724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5028,i,17892254453263747256,10856525715556251680,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:5472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5044,i,3218646687831075184,9875642728830872101,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5780,i,2788051777492025106,12958506582569963754,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,18187273042769230112,16270386304924679619,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:142⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,13483404572858402863,6823859575339376494,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:142⤵PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,3269068245092594074,14733677566162838795,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:142⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,3269068245092594074,14733677566162838795,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:142⤵PID:5536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,9562602174183421624,11820583939693894332,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵PID:5128
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6112,i,12547638506795871354,5643607846322904800,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:12⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,3265136997450503924,17423950662102527619,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:142⤵PID:5348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,8140704746001987755,16209707267184152331,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:142⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,16040179622064833829,18246153132311790550,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:142⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3980,i,17594678874652238151,2325359424860481124,524288 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:142⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5832,i,1571495440840733188,13653648576201363639,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:12⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7024,i,10503776959073196703,2564273284224780138,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:5316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3116,i,15376246148600253886,5864481372657511781,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:12⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7612,i,5791667065710267301,2222324048088776606,2097152 --field-trial-handle=2112,i,12023947370363713336,17620460758192983026,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:5888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:1404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:5988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s FDResPub1⤵PID:1016
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.DeviceManager1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2704
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:1812
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
- MD5 a9d241f865f7d582346ece871b98ee14
- SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
- SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
- TLSH T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
- MD5 2415c177850265ec333bf407bedd2c4b
- SHA1 2ccfbe660996437603bf4e0b70309310c3095994
- SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
- TLSH T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 860a63777fb81de9ae52bab95b2ef805f1c293b276a8ec513e0c3186431e707e
- MD5 25a1f732857a3ad2307d5cd46080d135
- SHA1 2412bf00ddb5c2f63a46effcb86cc8eb141699ea
- SHA512 eb5d1f38672ba3b0fdaad756bbddc0d38164d7271a9b17c971fbf950a7663fb5fcab2851a78009079861d2014666b875d64da95a83d39b95176e82b2fc0eb2a2
- TLSH T15AE02BA5D9A6AC3B08FD075974545A41D70127272E40895F3B3C820D8FB463A199A91C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
- Size 87KB
- SHA256 84c0e824a00db89597225be25b38f9ab3a3d96242a983750d8b9c5d89863ee45
- MD5 9f393b023d9ac8fcacd341a3271a4e58
- SHA1 d7dd9d32da88be8b62604029e54e3441bab57cba
- SHA512 6a005f5ec36e3beb1880b6c84c0d0a1981d0ae7c950ea7f4ce33d760dbce13d19f0e641a2901deb0340d450b6770080ad63a99195565f5bb4aafabdb1108ca3f
- SSDEEP 1536:Io8gz1ACb5WlLZoejPZeWZkSemB6DAh9ZA2yeTUoW/mbSr6ONtaOyeQls8EYRUuv:I/8ttWl1JzZeWmSHsBeQo/bSPtaIQaS1
- TLSH T1E89312F73B0F111AE924367FD2F7C4F1EA0181C506701658372626EA9E8C9A4EF99E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
- Size 179KB
- SHA256 d6d025ec49e94616702918286691644dc04e8fab3be1169323ca1eaeaccd6e5f
- MD5 9c94856f12116cba0239aaf8390fa37a
- SHA1 816485761cf4fa84a38312c34ddbf94ea3a02690
- SHA512 4b867eadc6af605cd539859c07c5c0b8257c475bde290b5d7612f886650888326e7a6795832771738a3566b898fb1108742c5707a5620671d61930c59da559fc
- SSDEEP 3072:PTCEhKnUToef844ZNS6De1mXSONDLbk+gE3AAID9aDPwO4DqP3UtukxAnZLqWfwy:7xhKnUdEjAm1DHk+DgDswpvQwy
- TLSH T11B042326C8AF5EB810DCDC7F156D947DE22A3C1B88E534BDCF288653DA3D49C24216E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 4KB
- SHA256 8fb6f8a6a5ba7633754e10eac4ea8ca999e7509e3fa88f7b97363dfa235c2b70
- MD5 f8db790abff8eb2c153a6357a6b4bc6f
- SHA1 b9fc9a32b9e26378d6348127d9f8a2f2b2485bf3
- SHA512 da64057ab4c3a7b66b3f1488e7eb983d0f7fa1a5e1e7bdc4ffddf5eca221dc98e44a5769a7f15392b3901ec57267e455538b461e030313664b76d2c3c6607b8b
- SSDEEP 96:awKh2TnL3F+NK39/ZNGI/NxVcZTC21DSIZ5VPd8mmogz:tKwzF+N09/bGIFxVcZTC25lHVPd8mm3z
- TLSH T10981D381F2623448F7613070B0C26E5A35B2004589C7CED682F18B3AEA1B76D974FC2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596a2a.TMP
- Size 3KB
- SHA256 fbd58c8281847dc4c93c6bd99dd239c0cbcbdc84970a49c1e600a379fdd24ab5
- MD5 9a5c22d5fc0c0eff3a64f0916a0f5170
- SHA1 31cf5082a7215f997e634919e862f4e0ef766473
- SHA512 77d117ab9bcd9d748f358eae03d3de6b085fa930c14fdfea0f05dc4cff10969091af6ec264d444468f94a74a4dddf7e381c52b706f41bde775159b29dca5eb31
- TLSH T1476191D6F2223840F3203071B0C28E5A397251494AC79ED6D4F05BB6EE2AB2D875FC0C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 9KB
- SHA256 dc8a02f3442f331de1a82cee97e76f856d26a6818188d142903c1bcd51f29a2d
- MD5 d1a15fd4793a2f33f01bf10224442707
- SHA1 635e481170e83e3212bcfe8655034c78b12a4a93
- SHA512 1581779b14f6a33e6d9f5055cf0d6b5c4e0fff2881a9652c65e351c85f2496147860e13db8a042120e84bca1e4a97479dbc15aa3085d29acbb72ab48bac30233
- SSDEEP 192:D1374717t7j7r71707b7H777f7k7gaaij6Wt767h7N7R717yf7pVP7P767F7e7K9:D13sJhffZgXTfjwkaaiGWtml59hmVVP8
- TLSH T1D622DDFF8AF4857EA81156F0E628BF2ECF6E0558429C381BC5D9AF4793E2431D14098E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 27de73df9c66ab85a8bd1997b3848201c0197a0c733dc64a8780538ea01db80e
- MD5 aeaa61a8befd952d308c9680af63fe4e
- SHA1 737983485b3d3d43188cb1fb4956aa4a139b3019
- SHA512 76fdde77e9dd2aa981f6e7b417dfba896d9b0bde322f3d7d82a2e931617274cd4bc092ccdfef3d3d66c8c789044f8cfe3141c35fcf55fe91de43a24b3178a6d7
- SSDEEP 192:sxZ/LRHyMqZjK1Ml8MFX/fOszpKQ7Pg03odpbl/W6+WNpns/Y0ZNtpQIgjJnWJ:sxZ/LEdX/fOszpV7I0Yx/b2/54jJni
- TLSH T15862E8156A389D77CCDBD319FA497F93D2F9166391904E44A9FC8A0C00E7AED221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 f278c51052b75ab56dcb4ec8156df31c404acae26f686f3ab5e506f776d42520
- MD5 243efc8bc7cbdfbb6913d254274232e5
- SHA1 b67423c86a220b0a5ad5be1949047272c7285fc1
- SHA512 b9af5b9471ade212e3badd63484e5cba1b5f57a796b161f738493cb6ad46e0650cce5ab807110276d59d3084d5fef6e8be3b4c03ca5a8fa2206671876e1a9523
- SSDEEP 192:sxZ/LRHyMqZjK1Ml8M2X/fOsGrKQ7Pg03odpbL/W6+WNphGHY0Zy336QIg5LJnWJ:sxZ/LEeX/fOsGrV7I0Yn/bKH5M5Jni
- TLSH T178620A156A385977CCDBD31DFA497B93D2F9057392904E84A9FC9A1C00E7AED221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 31KB
- SHA256 8652f2bb7385ec578c6649d0940f80691484a1b69d80c0b2c794c8f774c3b5e3
- MD5 d51792b63ed3ba1de7e48851e2ecbcb9
- SHA1 441158678a38e65a5837887ae322829c74aa752d
- SHA512 468d51f64995a86b8c72048d3fe0014e3cad088e553e92f24ae91a3986ac987584f131594b5bfde63b68ca46b72748b9528957f737e8af7a0fc7e1752d42c053
- SSDEEP 768:XwZh38Dv2aFWRm6GQXm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro15:XwZh38Dv2aFWRm6GQXmu1jaK09LplMbH
- TLSH T13AE21B3B280CC77E4F844E9DEC26AF966ED802CB66684D5447FA494C03CA7EF511B49B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 23KB
- SHA256 4c60287040a8d39043971af5bd27ec049f198c922534103d376387d308ca46aa
- MD5 3da6589ee835f303273f60bbeec0f0d7
- SHA1 7522c2337a03d80ba93f2e260b30624799dee0b1
- SHA512 a086c89986f50ac0d2e1d402d0059de98342d4b9d4d534c62a704978be77c4abaced86111018ef43ed635f772919cb61ed46650d1a8eddc45ee8a8f1ae830d58
- SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjlp5tC:ctGj+BCNC5qFVpKxpPC
- TLSH T13BB2461632BA02023C3EB91D879597371A42B2733418E93B7BE954B64E67E214DFD8CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\7259779d-1a19-4cfb-825d-ce9233119c8c\index-dir\the-real-index
- Size 72B
- SHA256 ef02bc72590544e32e23dea2a248947eca9d4805f1980c863d9ef710b4a246fb
- MD5 4ed670b0a7722ca94de6dc8be28f49d4
- SHA1 6344f9c7f7a8ee1840683b6679511cfb69c09eaf
- SHA512 abfc4a846ec8bfdebae73af6db241ac9479481aa82425dbd6202bf1eb9e36ae016a3ef0218df90204af6ddabdfd61b76496fceaa5a8f0d85047c6d3abea4e3ea
- TLSH T152A0022843C61581D1546374B0590FA13712C8541551070344A1459D9C902C45915826
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\7259779d-1a19-4cfb-825d-ce9233119c8c\index-dir\the-real-index~RFe59548f.TMP
- Size 48B
- SHA256 17752d911e35412598e1bf3a8a1cc26b6ff5f57deaaee0e5bd82aca3b7522bc8
- MD5 f45950f64fda16d2897353b4b9dc3ccc
- SHA1 e5296c5114e3aa98db9f61f4064f162865de6b33
- SHA512 085dacd1b628a39b5a83e68f4b7e3112e0cb5b88894a95341bcd921437863b633d30120a89e3846476375438c7e926fd4f3733551dcf2108ee62f11497a76c19
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
- Size 182B
- SHA256 46f13acc9492ff1110f32c364e5079f17a796da8923470f75d89978971fa4028
- MD5 530cfa76ab45589335201e753a141461
- SHA1 ca0addd95754ee40ae39f2e93219a5b80dfe5aff
- SHA512 7ed22accaab7ab1b9a6c10b7f671b0b247294429745928ff5a5c541e6ffb1d2387643cdffb3b678e6b50e54ba2e8baa65b0a8db854c72bbd83bf79b5267db029
- TLSH T111C012B7145285513A6535EE524232C8C9727FC80CC4B9CC94923045223082E0905614
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
- Size 95B
- SHA256 4c1b32d5249d09c96afe1ae60cd58b1ffa63a23f1895c8623d1b6928389a8029
- MD5 d9d2ab4710e3c5dd22a2b294eb902124
- SHA1 bc0fead019555412badf9fb31ce96cd90fc8de78
- SHA512 ca2db970eb010abaf2adbf9160c4b2b1f0c712efb06f26b2a65013f0ae566075d5e4efe7775437c8ad4a166f819609ee31d0740da3dd3fe4926272b64edf9d0a
- TLSH T105B002FB4445D9D55E7138E7414633DDC57273DC5C85FE8DD4751055322057F5011D64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59069d.TMP
- Size 182B
- SHA256 93e8e7558b1f6bc0d5486b91fb871a039cadb1c4ab1988fd981bc54dd5094b3f
- MD5 3e59f96c8e467cfe00492db34b2b867a
- SHA1 a2d530ab609b80b4fc7eeab298bdcb3386a71877
- SHA512 2c85f280942a557eb2323a51ad1e27071d1069ca03ce0115b12843bfde973261ed5d6078a21d73fb616922cb13c7f8bb7cab6cf4224992a4799662078d918866
- TLSH T10FC012B7448989916A2E38EAA10232C8D9367FE91C89FA4C846A30962230A6A1420E24
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 eab4f894f66dc98299b97e0698e6a9ddc8273146c10a5e0b8983b66e2ce77392
- MD5 515562a35b711ea36a5d9ab123166414
- SHA1 ba32d7fbdf3afd37f78a138c16ea6db1f0b2f8ec
- SHA512 018d5a99e595a22caf3843d557b27c0c566354589b2b912530b6adeec3a0fb40a418a91d9845e6acc19cf0ddbb332eb9c6599072801523751b87d2173678633f
- SSDEEP 384:nOiFPZcII8NW8TUNTUlIRsrk6hqo1zCfbHoMacjHXQRGnTKwBODNZOCKW1ty/7IL:lFHINwgxLqqoMbj3QRGnewBKZOTWR
- TLSH T19DF2B1F298D78977E89E4B87A77D2D0289FCC153B5885A84B7C85D1CCC861BFD30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 26KB
- SHA256 f7e190354837508dcce72d39fa68a75f61128dd728f9d749e57bec470d420ce8
- MD5 f6908c698cafe40671022ec958d7fd57
- SHA1 01b70004aafe49e0e25521da76be5ee7774327b8
- SHA512 1706db00eb0ee3c9b4fa3540c920c5bfefd7d44dce8caf2fa272a95a1424de4170bfb05bceb4bb8d15e57773e00bbf6a9f2f6e0aaaeb46ec681328f755c05617
- SSDEEP 384:nIiF9CcmyWCs38NK8TUNTUlIxBrk6S+yVl1zCfbHoMacjHXyRGe4KV8p0WMty/7n:TFccps3dwg40yVTqoMbj3yRGI8p0S
- TLSH T1CBC24A32E898CABBECDA4FE9A64E3503CDE05263C68C9AD4D9DC1D5C009B19D574F827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 91cf9c1b6f4ef3647a5dcedece703887e7926212ccf355d5444dd92c2fd060d0
- MD5 f9049589448908265c64c6ca7257d1ca
- SHA1 6818e266c590ed2b257b6d1be5174103d6d24f73
- SHA512 11537ae4df42febf66642b1fa87aab57dbc44990b5067db869a440c154aede3915b427bc05287d2b90e4c941c146789d9cd9bb68120b8be5b3d7635cc6f96f02
- SSDEEP 384:nniFiZcIv38NW8TUNTUlIRcrk6QBo1zCfbHoMacjHXy8GnTKwBODNZOCKW1ty/7o:iFQv3Nwgd3qqoMbj3y8GnewBKZOTWR
- TLSH T179D24A32AC68C9B7EDEA4FD9A74E3207CDF44263D68C9AD8D5DC6D1C009A19D130BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 8513e68a819eb9ff1694474f4e5bef79e9fc53dfc1646a823a98760da4b1be3c
- MD5 d599f6089d3e09eb3adc3c0ddf748307
- SHA1 98f4f0e00e4ffb3d00c5586f6514477233d2747a
- SHA512 73227d174d6fa02beef11d6ad6dbf8bf190720ff438b19fced86697c9b28b910cee6c5667e20188ad625a96cb653ba7efea3e969414572433575dcc1ab72dbed
- SSDEEP 384:nOiF0ZcII8NW8TUNTUlIRsrk6hqo1zCfbHoMacjHXQRGnTKwBODNZOCKW1ty/7IL:lFyINwgxLqqoMbj3QRGnewBKZOTWR
- TLSH T1ADF2B1F298D78977E89E4B87A77D2D0289FCC153B5885A84B7C85D1CCC861BFD30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 d86ba2e3a32a08e563dcde93ea6826914583e2d90ce8e74fc4b8d2a153d0cc37
- MD5 a28b58572e2d6373b0816ba9bd610686
- SHA1 9e45aab2c5573a00bb08c139331c324a832cf02d
- SHA512 8fc88a57145a24f8557a0a84805142e242df8229392a9035b08fc21d6c2dacff1a30fd55968d8b72e3e4a75e8dc695385dc1ca59a51b78776a527877f28efb16
- SSDEEP 384:nCiFiZcIx8NW8TUNTUlIRYrk6Z7o1zCfbHoMacjHXy8GnTKwBODNZOCKW1ty/7IL:JFQxNwgxaqqoMbj3y8GnewBKZOTWR
- TLSH T11FD25A32A868C9B7ECEA4FD9A74E3203CDE44263D68C9AD8D5DC6D1C009A19D130BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 d3915d9d8b4536fb1f7f9efeb228cf3b072d6efc921d12df2a47110b2b13f988
- MD5 56e4b11b4f1fedd8e52d3fcfd0aef626
- SHA1 03cb32e381b6f54ac1d82985fe5abd100d5bac30
- SHA512 85c27085eef6882dc8769d5c73c5ff19a517f361c4bc25679f2ed9ff0a8849b1ef59161ce3ad0ad90c4e8b8418c4104b7e110a2df37e50d7ea1aa73d8ccb8c0d
- SSDEEP 384:npiF9CcmyWCs38Nf8TUNTUlIxBrk6o5gVF1zCfbHoMacjXShe4KV8p0WMty/7Ig5:AFccps34wg4tgVzqoMbjXShI8p0S
- TLSH T172C25C36EC98CABBECDB0F99E74E6603DDE05263868C9ED4DAD85D0C008719D174B827
- MD5 SHA1 SHA512 SSDEEP TLSH