hxxps://www[.]opautoclicker[.]com/?utm_source=chatgpt[.]com

Analysis

user interaction
yes
max time kernel
75s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.opautoclicker.com/?utm_source=chatgpt.com
Sample260718-196qmsg13t

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
241	448	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
5320	AutoClicker.exe
5428	AutoClicker.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0004000000016821-337.dat	autoit_exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	53	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a1d4e24469caef25	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
448	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288869306699859"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{6C0DFB7D-D737-4073-ADFC-BAE0243E7F6F}	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2616	1440	msedge.exe	86
PID 1440 wrote to memory of 448	1440	msedge.exe	87
PID 1440 wrote to memory of 4052	1440	msedge.exe	89
PID 1440 wrote to memory of 4052	1440	msedge.exe	89
PID 1440 wrote to memory of 4052	1440	msedge.exe	89
PID 1440 wrote to memory of 3780	1440	msedge.exe	90
PID 1440 wrote to memory of 3780	1440	msedge.exe	90
PID 1440 wrote to memory of 3452	1440	msedge.exe	91
PID 1440 wrote to memory of 3452	1440	msedge.exe	91
PID 1440 wrote to memory of 3452	1440	msedge.exe	91
PID 1440 wrote to memory of 3820	1440	msedge.exe	92
PID 1440 wrote to memory of 3820	1440	msedge.exe	92
PID 1440 wrote to memory of 3820	1440	msedge.exe	92
PID 1440 wrote to memory of 3216	1440	msedge.exe	93
PID 1440 wrote to memory of 3216	1440	msedge.exe	93
PID 1440 wrote to memory of 3216	1440	msedge.exe	93
PID 1440 wrote to memory of 3100	1440	msedge.exe	94
PID 1440 wrote to memory of 3100	1440	msedge.exe	94
PID 1440 wrote to memory of 3100	1440	msedge.exe	94
PID 1440 wrote to memory of 2752	1440	msedge.exe	98
PID 1440 wrote to memory of 2752	1440	msedge.exe	98
PID 1440 wrote to memory of 560	1440	msedge.exe	99
PID 1440 wrote to memory of 560	1440	msedge.exe	99
PID 1440 wrote to memory of 2312	1440	msedge.exe	104
PID 1440 wrote to memory of 3848	1440	msedge.exe	105
PID 1440 wrote to memory of 3848	1440	msedge.exe	105
PID 1440 wrote to memory of 3848	1440	msedge.exe	105
PID 1440 wrote to memory of 3192	1440	msedge.exe	106
PID 1440 wrote to memory of 3192	1440	msedge.exe	106
PID 1440 wrote to memory of 3192	1440	msedge.exe	106
PID 1440 wrote to memory of 2348	1440	msedge.exe	107
PID 1440 wrote to memory of 2348	1440	msedge.exe	107
PID 1440 wrote to memory of 2348	1440	msedge.exe	107
PID 1440 wrote to memory of 696	1440	msedge.exe	108
PID 1440 wrote to memory of 696	1440	msedge.exe	108
PID 1440 wrote to memory of 696	1440	msedge.exe	108
PID 1440 wrote to memory of 648	1440	msedge.exe	118
PID 1440 wrote to memory of 2828	1440	msedge.exe	119
PID 1440 wrote to memory of 2688	1440	msedge.exe	120
PID 1440 wrote to memory of 5220	1440	msedge.exe	121
PID 1440 wrote to memory of 5220	1440	msedge.exe	121
PID 1440 wrote to memory of 5220	1440	msedge.exe	121
PID 1440 wrote to memory of 5360	1440	msedge.exe	122
PID 1440 wrote to memory of 5360	1440	msedge.exe	122
PID 1440 wrote to memory of 5360	1440	msedge.exe	122
PID 1440 wrote to memory of 5952	1440	msedge.exe	123
PID 1440 wrote to memory of 5952	1440	msedge.exe	123
PID 1440 wrote to memory of 6052	1440	msedge.exe	124
PID 1440 wrote to memory of 6052	1440	msedge.exe	124
PID 1440 wrote to memory of 6052	1440	msedge.exe	124
PID 1440 wrote to memory of 6124	1440	msedge.exe	125
PID 1440 wrote to memory of 6124	1440	msedge.exe	125
PID 1440 wrote to memory of 6124	1440	msedge.exe	125
PID 1440 wrote to memory of 5136	1440	msedge.exe	127
PID 1440 wrote to memory of 5136	1440	msedge.exe	127
PID 1440 wrote to memory of 5136	1440	msedge.exe	127
PID 1440 wrote to memory of 5192	1440	msedge.exe	126
PID 1440 wrote to memory of 5192	1440	msedge.exe	126
PID 1440 wrote to memory of 2828	1440	msedge.exe	128
PID 1440 wrote to memory of 5320	1440	msedge.exe	129
PID 1440 wrote to memory of 5428	1440	msedge.exe	131
PID 1440 wrote to memory of 2980	1440	msedge.exe	132
PID 1440 wrote to memory of 2980	1440	msedge.exe	132
PID 1440 wrote to memory of 2980	1440	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.opautoclicker.com/?utm_source=chatgpt.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff8924dc188,0x7ff8924dc194,0x7ff8924dc1a0
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,3388601393979825901,3529850463294458894,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1812,i,9326814870164737419,6315124250804184254,262144 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,9700967477453958170,11357911536027783684,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,4716332255306036703,11018608182525835689,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11752857023254592085,6785576847875554320,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,12462402280316907498,16448398937938353143,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6325164409111647662,11646685573958076298,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,5451430816831915720,14953768202967895015,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,1048169456631123236,6271977360607737477,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,9403111413701359289,4948944345291645896,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,9403111413701359289,4948944345291645896,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6156,i,17742760983070370210,13866151945567386277,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6360,i,9251096255994590203,4665216083352603104,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4364,i,13907203066883846371,16221491707371397160,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6580,i,14222139115789094486,2173328899906342317,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,16816941237082912743,6297212373635328195,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,14163564349046947151,16339401308454369946,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,17090065297486182213,1970387963904360344,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4224,i,5350538008216924851,14646783277607768727,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7272,i,17390338190182719603,12365677937442443500,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2844,i,9880581270531676320,17901171824783777156,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6856,i,6102489392023319023,2518926149085123987,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5844,i,8598441169624956194,3586771735768638134,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,3451979087596150061,11547583913512356374,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6536,i,12407674416017201486,5244007185014904109,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7628,i,13125144761204089905,9547259851602999435,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:8
  2⤵
  PID:2828
- C:\Users\Admin\Downloads\AutoClicker.exe
  "C:\Users\Admin\Downloads\AutoClicker.exe"
  2⤵
  - Executes dropped EXE
  PID:5320
- C:\Users\Admin\Downloads\AutoClicker.exe
  "C:\Users\Admin\Downloads\AutoClicker.exe"
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7752,i,5625393616057097799,569665059844340954,2097152 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7724,i,14693235335506512560,19431541683330286,524288 --field-trial-handle=2472,i,14076455701685350292,14343491326398586932,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 1.1MB
SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
MD5 913a423f66aa1c41e374e21a911a3c20
SHA1 449df612d0f02e868992faabfbf4d5d37c727936
SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
TLSH
T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 54c154a9a60edc6607638b81f389ec98585d2c0bdbd53525f4ed50a8902b8b0a
MD5 114ad8f1d42c8a73ff14c9cee2409897
SHA1 f6abab79803142eede8fdcd6aa5b650761953461
SHA512 ddf97d5d8abccf42d0af6323db72e2989b68a31129c756a0e2e3451c417b222a0431f3fcd5fe0364e67ee7cd7251eec019685ef4a57fb4d995b1f74923fdd416
TLSH
T1F88118D4F13A9882D7A2837DD5E0C62530709AAB0B4FED130270567CE50BBE357AF928
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599580.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599580.TMP
Size 3KB
SHA256 03d559bce282de9903c8975d04e9259bbc8df26e19727c514754218a54016963
MD5 f93d3376c7f25338e38c28da5c5d349d
SHA1 0d754fcf19fde6c959f4972164675fa6f5ee0d74
SHA512 809671c7d0bfa901eb69a7aacdd84a5f573ea1b0ec35a3d9d9c810750c358b31008847eaeb9e4bb0a4eac39ae140fb143fd5db40303902f05e0cbbb455023987
TLSH
T1DF7192D4F1769896E3A2837DC6E1C62534359BAB0B8FDD4B0660463DE50FBE343AE118
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 5d20bf96ea6f462664207f6664dfede1619563e05dc288d279c09fb7770d772c
MD5 253e0ad636c201f2266d2ec54a09afa6
SHA1 fcd00d13efbac49e47b8c847bf3ddffac561ebc6
SHA512 48245abebb3adfca4a173f38d06e7c332f9075a6cd35fe2b670e3ca9c4089f7094b2b5d45279d76ac78010dd9f485dad490e846796531924684aff957c286779
SSDEEP 192:Db+2wEibu5dboBgkU7zfVhiuERFkJ2iOssn3mCVHbJslp0lwa:Db+2wEibu5dboBgkU7zfVhiuERFkJ2iI
TLSH
T1D002AEF787E9C66D887215F296243A1BCE5C0518831C396AC9E6FF4F63E3471E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4b6262efcf4460a37074d6533e61979bdd0ab8c51f599409a112cbe75f289318
MD5 b0e1cfe41a942a63d6c80944ebfc3ee1
SHA1 7cbe69538db0d88286ddc65f54784b0a582d50d3
SHA512 c9e985c4a12f046f7e59d84104f77f15d8ef91a16bef7119d5642d5c2e1c3483bb876ca0fb0a07453971da14ca95d32739098f62c215c31c9d6f50cb821e8147
SSDEEP 192:sxZtRl/yM/jK1Ml8MkB/fWsiMV2p/iaIdpevGDHW6+WN9Sp/YwCh6gIgrJ:sxZtXMB/fWsl2Az5HbG/k9
TLSH
T15652D8126A349E77CCCBD209FA55BB53D6F94472D2940E44AAFCCA0C05E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 430116a6ad9bd841c122ed0fe0f461d294b90f820081ce2de3800f23264d6848
MD5 82181e90ff09b754ec3912c1cec935dd
SHA1 df58c614dd6910a73b819ed06c03c6bd3b70b05c
SHA512 5fdc0426b9c9cf6dcec8aa4499f1e80fc2b1b04dc811bb78c08077e6c33395e1127d64ddf5162e1f8885d501a03099867c022a0850af5757c9c69205079ca8d0
SSDEEP 192:sxZtRl/yM/jK1Ml8M9B/fWs8MV2N/iHIdpUvGjHW6+WNhrpGSp/YwUUC/gIg5aJ:sxZtX1B/fWsT28ILHbXN/66E
TLSH
T1C152D812AA349E77CCDBD209B955BF53D6F54472D2900E44AAFCCA0C45E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 064e660c8937967a41504e9ca0e8ca1c1094303c15e11ffc16754ef888936cb0
MD5 c8dab11ce7383c8d462663b543ea006b
SHA1 96c71bccc4ab050b698b91867ce380892cb8ab1f
SHA512 4eb602d243770545be283b18806be7a28206ae0255982d8a8acc6714934663b40d851d6a7300864f9db3dbd78ffc641c8f0eab6315f7b5c15d0e1607b05278cf
SSDEEP 768:yj4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dJrohwRaq:yj4jeXmWvmKxEu1jacPLZQdis
TLSH
T174E20A3B244CCF7E4F844E5DED2AAE876DD802CB6A584D4447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1ae5b35e34d2d4c2b9d7c13c5f75cac080c3af2264cb28472b10e5308af18b3c
MD5 6d14c93365f82be276b9918fc384cf01
SHA1 214c6b2f10d34dcf7b7ec9b1834cfa81e34537a1
SHA512 1eee996ac70691f75bf8bb6f9206f422058622f5963629d5a34539cd2f12fa799fb6a208f38ba3c47b16836a244538d746546b51a2acc998d6d028f8d131954d
SSDEEP 96:KkHC7ntll+n1AldH+KFLdB+pfHoxXfm3uKQ4nwgKBeeR:zHC7ntll81A3HHLdBwfHoxXfVb3R
TLSH
T119914B41717F52423D7D28089298C76AAA92F1733208A47B7BEC05A20F67E251DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fadcd6ff-1c06-427e-a945-ef7c32692125.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fadcd6ff-1c06-427e-a945-ef7c32692125.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0e922336e6103a70ec3386fbcdd4bb57f50e6885626e8e26ac7e51111ddb71dc
MD5 6bab56f3f38c0a43f225a8f1d4c8c0a5
SHA1 75a32cae044fdf778e813499a800805860f19125
SHA512 8f396a2fd5df5d36ca794718687116656354902f52779c8004f48e2a75890d865104522938721e902565e414a084e2a3fb5cf765182cce57247df26008dc1665
SSDEEP 384:ctNn/s3n9SbsN6Aixph9w2f++BO1/cLFcOObjI9G6w7t:cj+9YpjwmTBO1/c5c29Mt
TLSH
T1FD929D326828AD375DD29684F44B3A5B9FF8512FC6C52FC8D5ECAF0D05CA7AC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2e923488705d72a619fa4127111a994b07d6a808f046d8b13d004cc77665464f
MD5 8540341ed31d4bdd99912a1335d877b2
SHA1 ed7118019e9801809500019ccea8d16535d5942e
SHA512 61c22368b491465ae801bd817023e73f0f7087ba8a32be65ad68b2d6ab7007853698098b0a821d46b8f46af9599c60d06c24c63d2c320376af5ab07115f037d1
SSDEEP 384:eiF1tNn/s3n9S+jsNC8TUNTUlIlHixpQQw2f++BO1/c1FcOObjI9G6w7t:1F1j+9hvwg4DwmTBO1/cvc29Mt
TLSH
T1F8C23AF258D78936D99E8B47F73E2D164EBCC16BB5816A84B3D85A0CCD861BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9399a813e0fe2b009957f2672a0d02d851a5fa50e2ebbe87612e8af1bbcc9c40
MD5 9ddf55a3924079f0aba4d5989ad146b3
SHA1 ac1e9acc1ddc13c0753b9d8c684ce247084a0586
SHA512 efccfb623e1c23e71b895a65fafc2b41b63b9de7eedeefca67fcb143e19f99c627f20e36df3948ffbfb62b795cbe63f4f21ff8e9cf1b106df65eee1fb751e7c9
SSDEEP 192:EONI6hZ0QmiUyfYpc/+jVEBO1Tm65wOZ5gfrU6:EONI6oTpu++BOU2aDU6
TLSH
T10E02D935686C6C778EE2AE45F48B27235FE4212BE9956F84D6E81B1D04C775C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 058215472716150a6bfd973867a0da92aee27ac825745e27e1057a6c8cab5c5c
MD5 b2c41a865078be342e416030a4197a0d
SHA1 a2cd55f506d20d689ca70336fd6bf50543bb1cc6
SHA512 12a8cab78fd2a53596b3802fd2133d2201552fad93ee3ef2531b60fe4f44a817825bbb9ffd973e106e63a61d938b7bde152622d5991c3bf9e533c3c9cb850fe8
SSDEEP 384:wtNn/s3n9SbsN6Hixph9w2f++BO1/cLFcOObjI9G6w7t:wj+9YIjwmTBO1/c5c29Mt
TLSH
T1FF929C3268289D275DD29684F44B3A6B9FF8512FC6C52FC8D6ECAF0D05CA6AC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 458a569621c7b110df36e56d7dfb7cbb1457c71e8fe3707f5dabb384a146bf58
MD5 6c27910ed29beeffcaeb711c9e9109b7
SHA1 dd117163e98fd3a12ecb3e94650095b4d0744139
SHA512 5538282bf46247806dab891ced4763c57359ce432509e2b1bafcce50fd82fa12f526abdbdfde158785d3876822d53a7b886a14ddbbf504a097a131483823f94a
SSDEEP 192:jONj6hZlQmiUyQYtc/+jVEBO1Tm6//Ev5cOq6qUU6:jONj63atu++BO1/cC9cU6
TLSH
T1DF121A326868AC775DD2AA85F88736534FE4522BDA857FC5D2DC2B1C05CF7AC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a65ef220ef6e52cc2b2cf236fcf0c173fbff8900a47719b51196fc1a4ab46fbb
MD5 61d9a2e681b7c8d912e645735d953325
SHA1 1958ac070b9f75d78346a15ef7c77c1308783d9e
SHA512 e31c741774399ccc56e8b2402a469ba471159ddf2e840dd0ec1942d1b455b7ebabcdbab54e3b5a8c376cecf380b586174aa288d2b7882287e1b848966ee27c19
TLSH
T1B3E00243530410FAC06C033000A3163036A7803103D202854D5402645C117011E31D84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe593ef3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe593ef3.TMP
Size 392B
SHA256 ee7eeeae9278c86a9c4deab81121707611a67030fd3b1aed2174b4c8fb2325dc
MD5 78f93d585b48a38d35192f7ddb6bc66d
SHA1 604547ba3d68da3a7cfff772e4717386ba86ef46
SHA512 540909bca244a7934667ffe26bd89e768be2735bee5968fed2cf8f42c713b77adf42da9554f1acff259b45095150ac955ea44e35361ec39858bd7867edc816e3
TLSH
T14AE0044153041051C04403300073171037D5C011035103C5455403545C117011C31D04
MD5 SHA1 SHA512 TLSH

Submit Download

ae7b67c9-d45b-4ce0-84d3-cf5ba5595ecc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ae7b67c9-d45b-4ce0-84d3-cf5ba5595ecc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 181db7afeeb83a9dde1e780f95bf6573741d82382c6a8978f7c6c5bdf207b4bb
MD5 8035a5bb68a47d89cb2d91971139b405
SHA1 11ef1509408217a16f7a7a015dbb7841f28b9d4d
SHA512 f80bb961fac627b19e93a9bcfac6c65decc681102fcdd6bff56892a6e58034f718b5fea6f625777c71678a991f524f806f6c44a40e7e98cbba8d064a8c85292d
TLSH
T14A41E358A6E90148B3B67E5AAFF7A86D487BBC732E47D55E10110D4E4A62B00C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads