a5b76157ad9d0fda8b5db04814aa1fdc980b9df9747ab0dc89d9b5ba53e6fded

Analysis

max time kernel
1544s
max time network
1581s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2023 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.exe
Size

2.6MB
MD5

5d28a492d20e32c4ae31993b127d7ac6
SHA1

c01708a59fd3bf96f08804225182a7a6325c76d2
SHA256

a5b76157ad9d0fda8b5db04814aa1fdc980b9df9747ab0dc89d9b5ba53e6fded
SHA512

3d07ea69bc33fffa8b87fa86f5cd3e9a34a9a48e770533b167a765e3b78fe51a1b1ee9d563943eac4048b360e33376776383578e548fd42df3fb048f13c0f6f7
SSDEEP

49152:dqe3f6aAzD7+H98AHaCfu64HCL+WuTmuKwEu:sSi9D7E9vBu/HCK5NKXu

Score

6^/10

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\AVAST Software\Avast	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\AVG\AV\Dir	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d98d6a3f-2a2e-4760-9878-7c60baa0ef2a.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230601140404.pma	setup.exe

Executes dropped EXE 1 IoCs

pid	Process
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp

Loads dropped DLL 3 IoCs

pid	Process
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4544	244	WerFault.exe	85

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
4372	msedge.exe
4372	msedge.exe
3096	msedge.exe
3096	msedge.exe
4128	identity_helper.exe
4128	identity_helper.exe
2096	msedge.exe
2096	msedge.exe
3988	msedge.exe
3988	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 244	3340	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.exe	85
PID 3340 wrote to memory of 244	3340	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.exe	85
PID 3340 wrote to memory of 244	3340	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.exe	85
PID 244 wrote to memory of 3096	244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp	87
PID 244 wrote to memory of 3096	244	TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp	87
PID 3096 wrote to memory of 3936	3096	msedge.exe	89
PID 3096 wrote to memory of 3936	3096	msedge.exe	89
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4804	3096	msedge.exe	92
PID 3096 wrote to memory of 4372	3096	msedge.exe	91
PID 3096 wrote to memory of 4372	3096	msedge.exe	91
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94
PID 3096 wrote to memory of 3240	3096	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.exe
"C:\Users\Admin\AppData\Local\Temp\TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Local\Temp\is-QEKCT.tmp\TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QEKCT.tmp\TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp" /SL5="$A014C,1785071,899584,C:\Users\Admin\AppData\Local\Temp\TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.exe"
  2⤵
  - Checks for any installed AV software in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/YqC26Fr4
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd49a046f8,0x7ffd49a04708,0x7ffd49a04718
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:3612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff626065460,0x7ff626065470,0x7ff626065480
        5⤵
        
        PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
      4⤵
      PID:728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5820 /prefetch:8
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3136 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5300 /prefetch:8
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6800 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3776 /prefetch:8
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1124 /prefetch:1
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11643277796034687216,9170562434856665195,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 1196
    3⤵
    - Program crash
    PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 244 -ip 244
1⤵
PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1db53baf44edd6b1bc2b7576e2f01e12

SHA1
e35739fa87978775dcb3d8df5c8d2063631fa8df

SHA256
0d73ba3eea4c552ce3ffa767e4cd5fff4e459e543756987ab5d55f1e6d963f48

SHA512
84f544858803ac14bac962d2df1dbc7ed6e1134ecf16d242d7ee7316648b56b5bc095241363837bf0bf0afd16ca7deebe7afb7d40057604acbf09821fd5a9912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
72a374d245332d4fe531f7340dd21602

SHA1
88fb7f4919ba84c83b584ef8d87c251344ef09c6

SHA256
036419d0669b9e6c38fd93ef064e3fa5b413a244bb7e4091c3a58bef1d65fdd5

SHA512
05ad53a08b21f0271a1dd09680d167d0cfb3de59fc018c8e75ae0f1b5d1f0ee3b54ef341527984aa6e530380d94f1a88c50cf2725e005fa21fffad52e43c984f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
793e64a0ca10f73d12c4d45f215e7ea7

SHA1
3836febd661c1f688035063c2ce9819da76214f9

SHA256
1ad52a009ce6fd3c1fce89c3312c0fcafd12b734503338694c84d1c0caa83978

SHA512
79dd7063dcdd0a3de1acc114af46cd90fee82b35168e8bb9f2ad292ddfa238cae91526d3da9f39d39c565fea632e07cf640a97f1d8a02d91ebe71288de5d01c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
7e591c4bd1fee39b08cbe062c88df875

SHA1
bf5d281b43326a5168fcfcd47d30237a6b8d16f4

SHA256
78fe698273720cc849782e7fb4bb2c6a8d99e7335197a4cfffbd666eb4e3ad1b

SHA512
21badefbd5522ed95fd7d5cbfe62ba74da3947aa48b48a0d9014281b2a9c1b39dd6e86e3e2d4813ccc1b3b165affc7cf959ac5d7b3a95517093f9b041d098497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6ccebe29890b0f699d292a1fb611872e

SHA1
1ba7cd3efe7132419706423a70aefbc746c7b3b9

SHA256
4521a4f0d26d1cd04bba2cfcd67ced35dd093c779fb7bc304120f58a240b9a99

SHA512
adc8dc90bcb04eecd79fe5b83d1e4f10045110a7ccce5c6d2763781a8943e540b37d2a6e5dd01c226badb29e421e755e71b996313ebc8d6b216f1a77c557e229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6b66e5743c86abdeb030afc319eb9dd9

SHA1
5ee74a98f107e4f991f9ed0454ecb988e04ce1df

SHA256
cc762d9dd447935348065bc3b2dd0a9ac31122ac81f9703258e3a68e7c51f5b2

SHA512
9f5dc500d14c50c59b475ae5ba8ed0e805b01a28391ed11c75134b8973a89dd9d9ee65372ff1260693f428dfa58b7eac40bc03bf9ba4b761247dd0af0a9a76a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6c3703e9624e121cb126bab8db7619c0

SHA1
f9620ee115709fae1dcf32f90f4b2a97169abd14

SHA256
f7cfdcc097200e45b06fe21f4946d630a1dcaccf9ab47bf63f8628d8ff588d00

SHA512
64baa906967889c38c3237db34a2f8451806ccbe46e4551e434981d0fd360d1d83d7f97e1ef9d8aa888aea7aeebca66d25e23a4eaeb1755a3f8512e430ba7842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c47e8b408ce6edcf216a1dff0efb636

SHA1
24e9c602a939bd009f0e48f8a1b78eadf856963d

SHA256
a8f59694a2580a964135570e5c6be657e2e3ced4409a9b80d05b84efc98f3f45

SHA512
4d0a2711698bfff0def30b5b3a9aac511ca321cdfc3c3a7baeff8661279ecf5055ede343e0dc45814735a8e7024668f8f2d15b0e238d553807e536f26d68f244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6ffeb8bc26a6b8186cba7c40c66646b

SHA1
34255a00cc2afc847b9777a7a6e3f653283ece06

SHA256
4e746136c06a557ab3c8ea420a7c7abc3af4f181a7f64e54f482e6433db43893

SHA512
ab3f8168dd21e7cc87db2daf6af0721ff3e374996d7c4e36c02b358e1a5cb165357fbfcfffd9f35140eaa8570a382b87133eca68856d9e71d7f61813b4535d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3dd484e88064e721c029736ef5c40245

SHA1
7fd54f2d68f468a8b0022e884c44b8c1cfd95554

SHA256
0057982d4219e51ccf1209ffcbeffa79a4c7e2184b213995ad4e381c31eaff86

SHA512
abd1b7b6d67d1f5aae9e2961111ca0c0ae6cebef36827fda4d30baa1774b06909f996d2dfa538f02ac7f9ce034a0cc8d4decf28391b5814d51d367360b8469fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51336ce721dde5992bbe25c6e455e4c6

SHA1
efc3951de612a96cd5e0a67ffaecafa94f5b4a09

SHA256
0e9ceb14b64fb3809d9a87b79904529c70265a0bc3276195108772fbbc7d19e3

SHA512
393415dbf1a8f731259b7cb090ca7dca2f46716406e26e932d0ace224a25213c2a8c2375685d14757a7994ae68c5904727e8ad1a1d3fbc2543a5580755faaf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
d31fc383cb25d0c8360691670745cc54

SHA1
bac2b9721fb007a8b485952abe44b8ad9489a943

SHA256
fe7374b88c28c45467cafcf7f766158ff1ac7ee409487c2b7cf8f86faeea679b

SHA512
c0a4e899ff2942e34f6441b44a2a8c84d2b0edc80ec6079d18a91dfdca032d41bead55267af32057343f13a401df6b32ed49bec199c982e2c6f7512f501e2d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3d874cbf2372e29aa7bde5be5e1db4b3

SHA1
a9214d4e1ddfd7f4cbe8fc61f838f9f2a2f2f26f

SHA256
84c9c0c31f068bcdc2258102ef25547073b785cfedc7345f510de21dd6096000

SHA512
8f90c381382b2a95c3ba3fe941429cc70094c92e78668a54ac88ed3e030c14ee7c3ba8ee7f450533456fd1933663b4c300f265da972fc0493aa409cc17b9fe10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
4883eb6db0db88cd45dffb660db746a5

SHA1
1f5c4d37a0bfce662569d1d5ef402718d4c1c3a8

SHA256
aac0388ebab521d9cf9aa47a7c8f43297c0d98488602267651c25af29685bc72

SHA512
0146bb12d29bbd428b5873b2f610ac15ae983557539d04b84838d54a90f8385b685e33313571545d40c72b77449ef86a795bd8a49bc960abdb9c0e85d0454545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
50cc967712e1320e748de4dbe1de5806

SHA1
b5c7c0ed3b484e6684e19509fd7e973a578a3991

SHA256
9f231a534df10295f75f4c962efb5c7f29da2405d6f2606e6836d54250c8f571

SHA512
fadec82aad587797a4db9e495067212632e423c95f1ee5d8906b26ae225c84d1cf63b540dcf7ab72cda97eca8ba2f3d16c1a5ea5ef6b42708c15bed6068db550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
922f88aa2383cb5130a27e67518dade1

SHA1
7c5c17c617f3c1b1679af90a530dbd3c29fbc5b2

SHA256
c38409dee850f8684b610632cbe551adb1bd351e3d6cad24d2e53cc805acd539

SHA512
4757dc031a7dd008d52810eaa2bb8ff3a6abbdd264c3c5ccab26b7e2144ae054a4faaa9c4d9046afb4753ec35dee2939e067b7dcf36e280056a358852f21f883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
0560642531cfc366abaa1c0b19312096

SHA1
52ce54ec5e67f76fa83b4665261dccea90c696db

SHA256
c0e8f80e6c4596b56a89dd1e77a8ae0f065eba110d9d6a2aaab5314e3ff5ae06

SHA512
3c85b24e4fb18280c9612e674a362cebd33590c69574e367fe4f54265955f9806afa00a75667c672405b07e8321fccc7cc842fb6024c03e803e872dcbbbf1e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N50KM.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N50KM.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N50KM.tmp\loader.gif

Filesize
3KB

MD5
d35d95fc6bd8be33d3ce5da2630b90bd

SHA1
be2fb4098a151f6c77a85ce8c274a3054a61178b

SHA256
dfa608be394c8f6d19aff352185917720f04072ac0412a8cab1174fec4939c08

SHA512
078fa3cf9c08c8bdaa554a52b153a159f537de3ee0ba923d64928cdd99b4f2528b4eb229c1b2352b946ef417efd478b453588a6cda1afc91b374e709afc730e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N50KM.tmp\side-logo.png

Filesize
24KB

MD5
e2d3022fb249af38288c47246bc60228

SHA1
bf7a44230ec7dc0f45e89224a6fe821d25f91f55

SHA256
9a7462e436d86f26ae9c0808b30810b8d2fd25ceef7af24ff09a1af32e63e2a9

SHA512
510d60ed51bc972b6bb3ac80a86d31b6d797a1af0a3ffce068089f0adf39d6591471de7ef7f21ecaccb67255e57bbe04786534256a12bcae5017078df56f12cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N50KM.tmp\zbShieldUtils.dll

Filesize
2.0MB

MD5
e1f18a22199c6f6aa5d87b24e5b39ef1

SHA1
0dcd8f90b575f6f1d10d6789fe769fa26daafd0e

SHA256
62c56c8cf2ac6521ce047b73aa99b6d3952ca53f11d34b00e98d17674a2fc10d

SHA512
5a10a2f096adce6e7db3a40bc3ea3fd44d602966e606706ee5a780703f211de7f77656c79c296390baee1e008dc3ce327eaaf5d78bbae20108670c5bc809a190

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QEKCT.tmp\TikTokStarsUncensored - Linkvertise Downloader_vJYw-42.tmp

Filesize
3.0MB

MD5
eaf2c9683c1424abb77a6104b339fda5

SHA1
82fe536dc66036a759f620003f324bc726192da0

SHA256
a2c20488f11814b0bb8eb471f364c58d8f16a34fb526b84ccb97d15b98450d9a

SHA512
49d9482bb2f41aa87654d22f3ffc31abed183ac68545cef87125de932cf745f8c68a31d17e142c4a4f0f21e2bf1edab8cda59ba2b1b1827f8c84837352196bf1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
0634ae6a9d0b68965bf9fe7577ca45cd

SHA1
1891c5de0327df4621f57f42ebfed5934338ed67

SHA256
13b221bd731dbf3b76817e08ffa13dcaed1320e12691edca127e6f03498bb8a2

SHA512
a6866ec54438f82278eaa675653a2425a21952558842df0b3a91c684eaaf9edc50d3700d5447bfcc98f96762b1f824d0a73069c01198e842694438e3ae017632

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
8KB

MD5
53b44ce953cf9f419dd2b11eda665df7

SHA1
62a06cee2a027d8c60ba23839e1526a8323cac04

SHA256
66d1e9e2bdfa527df26c0745e0833ad7983e4906cefadf33b742c716943052b0

SHA512
1d986bed6b95986c81ac7b6d30babf04fd0bfb98f913d54480874b0a0e26e447f644baa0d7b00b9888143a8bd219cd0001c1c834455cc2a1b02d3842b34f0833

Download Submit
C:\Users\Admin\Downloads\tik-tok-stars-uncensored.htm

Filesize
931B

MD5
0df833b182e7657ca207f4ab6f1f4491

SHA1
e30f09f7c64fd177bb17404f0103a003d19970e5

SHA256
9b3cc8c9a3d473ed9649b6fd49e776e9f555ae5f9b35e9a6f0e2e1290abb7130

SHA512
d3c127a700c2b00e0dee189dd13ee7734e33afaa91503395c1c3acd4fe114706a90fe1886d99f9c5d37a72d8d2267a4f8b65e845d26b1e399397585055e8b6c2

Download Submit
memory/244-165-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/244-171-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/244-166-0x0000000006920000-0x000000000692F000-memory.dmp

Filesize
60KB

Download
memory/244-157-0x0000000006920000-0x000000000692F000-memory.dmp

Filesize
60KB

Download
memory/244-187-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/244-138-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/3340-164-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3340-189-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3340-133-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download