e7c7832ff3fe03187b27af4c38bd73b6739cf9e5e5942c8d3ff1181eeee55719

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BlurAutoClicker_3.9.1_x64-setup.exe
Size 6.7MB
Sample260728-ec181axeja
SHA256 e7c7832ff3fe03187b27af4c38bd73b6739cf9e5e5942c8d3ff1181eeee55719
MD5 5716f737595d5b3fd799fd1b7ccb3052
SHA1 03569a5c44ab52f6045fadb5aa5cb335d602c19c
SHA512 179e4e7012ad4421cf3527dd3b70855aa8a785d56f935cbc7993d4d2873df8d77f9a383ffeb1b8f7b626d1447a935adb0f470a9b9ea9bc4b979220b011e5016e
SSDEEP 196608:tQkwJpekV80EqH7tYvBRr/atQGqhG2NyuJR:tLf7p9/sQG2G2YU
TLSH
T11366334977F80A56C7BE1A71244F29B19D939C17BF50EEC362C2FD19784A28E6D3A301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2628	BlurAutoClicker.exe

Loads dropped DLL 7 IoCs

pid	Process
5476	BlurAutoClicker_3.9.1_x64-setup.exe
5476	BlurAutoClicker_3.9.1_x64-setup.exe
5476	BlurAutoClicker_3.9.1_x64-setup.exe
5476	BlurAutoClicker_3.9.1_x64-setup.exe
5476	BlurAutoClicker_3.9.1_x64-setup.exe
5476	BlurAutoClicker_3.9.1_x64-setup.exe
5476	BlurAutoClicker_3.9.1_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BlurAutoClicker.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1812_166634999\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_72097108\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_72097108\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_72097108\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1812_166634999\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_72097108\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_72097108\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_72097108\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_72097108\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3532_977894286\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_882911929\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1812_166634999\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_882911929\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1851209361\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_72097108\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1812_1275711592\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_72097108\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1812_1275711592\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1592399970\_locales\mk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlurAutoClicker_3.9.1_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5860	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296841850971677"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{ED309FB6-941A-487F-853D-2B84E4DA05EE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5476	BlurAutoClicker_3.9.1_x64-setup.exe
5476	BlurAutoClicker_3.9.1_x64-setup.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2428	msedgewebview2.exe
2428	msedgewebview2.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
4964	msedgewebview2.exe
4964	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	BlurAutoClicker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3760	msedgewebview2.exe
1812	msedgewebview2.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	5476	BlurAutoClicker_3.9.1_x64-setup.exe
Token: SeImpersonatePrivilege	5476	BlurAutoClicker_3.9.1_x64-setup.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe
Token: 33	2628	BlurAutoClicker.exe
Token: SeIncBasePriorityPrivilege	2628	BlurAutoClicker.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
3532	msedge.exe
2628	BlurAutoClicker.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2628	BlurAutoClicker.exe
2628	BlurAutoClicker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 3760	2628	BlurAutoClicker.exe	91
PID 3760 wrote to memory of 4652	3760	msedgewebview2.exe	93
PID 3760 wrote to memory of 1096	3760	msedgewebview2.exe	94
PID 3760 wrote to memory of 1096	3760	msedgewebview2.exe	94
PID 3760 wrote to memory of 1096	3760	msedgewebview2.exe	94
PID 3760 wrote to memory of 1096	3760	msedgewebview2.exe	94
PID 3760 wrote to memory of 3700	3760	msedgewebview2.exe	95
PID 3760 wrote to memory of 3028	3760	msedgewebview2.exe	96
PID 3760 wrote to memory of 3028	3760	msedgewebview2.exe	96
PID 3760 wrote to memory of 3028	3760	msedgewebview2.exe	96
PID 3760 wrote to memory of 2972	3760	msedgewebview2.exe	97
PID 3760 wrote to memory of 2972	3760	msedgewebview2.exe	97
PID 3760 wrote to memory of 2972	3760	msedgewebview2.exe	97
PID 3760 wrote to memory of 2972	3760	msedgewebview2.exe	97
PID 3760 wrote to memory of 2972	3760	msedgewebview2.exe	97
PID 2628 wrote to memory of 1812	2628	BlurAutoClicker.exe	98
PID 1812 wrote to memory of 4924	1812	msedgewebview2.exe	99
PID 1812 wrote to memory of 4664	1812	msedgewebview2.exe	100
PID 1812 wrote to memory of 4664	1812	msedgewebview2.exe	100
PID 1812 wrote to memory of 4664	1812	msedgewebview2.exe	100
PID 1812 wrote to memory of 4664	1812	msedgewebview2.exe	100
PID 1812 wrote to memory of 5916	1812	msedgewebview2.exe	101
PID 1812 wrote to memory of 1288	1812	msedgewebview2.exe	102
PID 1812 wrote to memory of 1288	1812	msedgewebview2.exe	102
PID 1812 wrote to memory of 1288	1812	msedgewebview2.exe	102
PID 1812 wrote to memory of 4168	1812	msedgewebview2.exe	103
PID 1812 wrote to memory of 4168	1812	msedgewebview2.exe	103
PID 1812 wrote to memory of 4168	1812	msedgewebview2.exe	103
PID 1812 wrote to memory of 4168	1812	msedgewebview2.exe	103
PID 1812 wrote to memory of 4168	1812	msedgewebview2.exe	103
PID 3532 wrote to memory of 3068	3532	msedge.exe	106
PID 3532 wrote to memory of 5860	3532	msedge.exe	107
PID 3532 wrote to memory of 5144	3532	msedge.exe	108
PID 3532 wrote to memory of 5144	3532	msedge.exe	108
PID 3532 wrote to memory of 5144	3532	msedge.exe	108
PID 3532 wrote to memory of 6108	3532	msedge.exe	109
PID 3532 wrote to memory of 6108	3532	msedge.exe	109
PID 3532 wrote to memory of 1580	3532	msedge.exe	112
PID 3532 wrote to memory of 2900	3532	msedge.exe	111
PID 3532 wrote to memory of 1580	3532	msedge.exe	112
PID 3532 wrote to memory of 1580	3532	msedge.exe	112
PID 3532 wrote to memory of 2900	3532	msedge.exe	111
PID 3532 wrote to memory of 2900	3532	msedge.exe	111
PID 3532 wrote to memory of 2864	3532	msedge.exe	113
PID 3532 wrote to memory of 5872	3532	msedge.exe	114
PID 3532 wrote to memory of 2864	3532	msedge.exe	113
PID 3532 wrote to memory of 2864	3532	msedge.exe	113
PID 3532 wrote to memory of 5872	3532	msedge.exe	114
PID 3532 wrote to memory of 5872	3532	msedge.exe	114
PID 3532 wrote to memory of 5832	3532	msedge.exe	115
PID 3532 wrote to memory of 5832	3532	msedge.exe	115
PID 3532 wrote to memory of 6272	3532	msedge.exe	117
PID 3532 wrote to memory of 6280	3532	msedge.exe	118
PID 3532 wrote to memory of 6272	3532	msedge.exe	117
PID 3532 wrote to memory of 6280	3532	msedge.exe	118
PID 3532 wrote to memory of 6404	3532	msedge.exe	120
PID 3532 wrote to memory of 6568	3532	msedge.exe	121
PID 3532 wrote to memory of 6568	3532	msedge.exe	121
PID 3532 wrote to memory of 6568	3532	msedge.exe	121
PID 3532 wrote to memory of 6672	3532	msedge.exe	122
PID 3532 wrote to memory of 6672	3532	msedge.exe	122
PID 3532 wrote to memory of 6692	3532	msedge.exe	123
PID 3532 wrote to memory of 6692	3532	msedge.exe	123
PID 3532 wrote to memory of 6588	3532	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\BlurAutoClicker_3.9.1_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\BlurAutoClicker_3.9.1_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5476
- C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe
  "C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2628.2348.2133190114826476441 /pfhostedapp:7e1f3440eb8002d84762801c2001a60bfc4389cb
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView /prefetch:4 /pfhostedapp:7e1f3440eb8002d84762801c2001a60bfc4389cb --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcf5875fd8,0x7ffcf5875fe4,0x7ffcf5875ff0
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,9925178451353327861,18125577628024778358,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7e1f3440eb8002d84762801c2001a60bfc4389cb
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2176 --field-trial-handle=1740,i,9925178451353327861,18125577628024778358,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7e1f3440eb8002d84762801c2001a60bfc4389cb
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1740,i,9925178451353327861,18125577628024778358,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7e1f3440eb8002d84762801c2001a60bfc4389cb
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3528 --field-trial-handle=1740,i,9925178451353327861,18125577628024778358,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7e1f3440eb8002d84762801c2001a60bfc4389cb /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1740,i,9925178451353327861,18125577628024778358,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7e1f3440eb8002d84762801c2001a60bfc4389cb
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4744 --field-trial-handle=1740,i,9925178451353327861,18125577628024778358,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7e1f3440eb8002d84762801c2001a60bfc4389cb
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4700 --field-trial-handle=1740,i,9925178451353327861,18125577628024778358,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7e1f3440eb8002d84762801c2001a60bfc4389cb
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2628.2348.17923167149194888998 /pfhostedapp:c7c22851b588f47dafdfb3a31ee98c103359b7ab
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView /prefetch:4 /pfhostedapp:c7c22851b588f47dafdfb3a31ee98c103359b7ab --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x194,0x198,0x19c,0x164,0x168,0x7ffcf5875fd8,0x7ffcf5875fe4,0x7ffcf5875ff0
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,10733637488941523574,5866413447043260367,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:c7c22851b588f47dafdfb3a31ee98c103359b7ab
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2348 --field-trial-handle=1796,i,10733637488941523574,5866413447043260367,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:c7c22851b588f47dafdfb3a31ee98c103359b7ab
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2472 --field-trial-handle=1796,i,10733637488941523574,5866413447043260367,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c7c22851b588f47dafdfb3a31ee98c103359b7ab
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3440 --field-trial-handle=1796,i,10733637488941523574,5866413447043260367,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c7c22851b588f47dafdfb3a31ee98c103359b7ab /prefetch:1
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1796,i,10733637488941523574,5866413447043260367,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c7c22851b588f47dafdfb3a31ee98c103359b7ab
      4⤵
      PID:6316
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=1796,i,10733637488941523574,5866413447043260367,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c7c22851b588f47dafdfb3a31ee98c103359b7ab
      4⤵
      PID:6956
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4500 --field-trial-handle=1796,i,10733637488941523574,5866413447043260367,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c7c22851b588f47dafdfb3a31ee98c103359b7ab
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcf2fac188,0x7ffcf2fac194,0x7ffcf2fac1a0
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,2710928267770885392,8378179276585489095,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,8342960480854166743,796996354852697403,262144 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,2158219980197122553,7096679327176517422,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:13
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,14385324829308957066,18006018284471792015,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,17258872220906552931,1989686281227415947,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,2799599741505146246,9461933204503455952,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:9
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,17795414613833841628,13586737440456587957,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,9463079016558324182,14030368812928267667,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,2981685453464254140,17926239612241011557,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:6272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,14801989356068662212,5732224294231785149,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:6280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9447620282312784778,12367335810730322031,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:6396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9447620282312784778,12367335810730322031,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:6404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6244,i,391576423891381112,15266280838370193209,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,4549869500788108479,2356771582324946876,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:6672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,13522747477640513156,13991978076195156018,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:6692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,9803394083143441914,17563587717004032297,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:6588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,7698371796712556746,8834101458691864486,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
  2⤵
  PID:6600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7048,i,17338516801296758534,15683085658363107791,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:6728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4428,i,13015121304623165944,12492919065037787827,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:7020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4856,i,3121270836392598683,9702904372970403513,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:7028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,12446457265454298480,3559368143055213707,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,1786244565597714948,4565426314344207938,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,12768679653000725690,10768563036979759792,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:14
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,11330980511317444331,10370316052385655984,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7080,i,4728789215077536416,6370013462880832472,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:6492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7036,i,16060681610243253396,8163761570311026556,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,17761859245227671989,10450551087393382764,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,2902994188703910250,11240961777625214262,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6916,i,5536909628951949100,18007851438988063787,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3604,i,10775771772285759193,4874189612970069791,2097152 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:6552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,3601272502899926944,82024549980565621,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,14053986321662189042,4332709159797886880,524288 --field-trial-handle=2416,i,7951315269699432050,4332075300157359870,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:14
  2⤵
  PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BlurAutoClicker.exe

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe
Size 18.3MB
SHA256 9efe0b0665c531d37fdc0e1f494f43ee0e69ce3df02a339176b62daaf62c21fa
MD5 43fb99db76636afa669213f719ae5959
SHA1 404caa6b1812ad67a32e5470acdec0efc33204b9
SHA512 f9b713543df30ea2520a4b6de99b5f9f63d858f4e0309e272a15a3a5d1003f38d49624a3597d0f25b05214502dcd5190505804653d8db7450343200766a9a2d4
SSDEEP 196608:K1vFag9334FEvl+93IeaRpHqLpmkMtT8KkSEeAw+0g:2Fag9333ZlN8Kkzvv
TLSH
T169170A916F5B95A8F196C8F083964D7FAF2038CB0A3575AB0494613C2F7F7E06A38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4a17a475b6ab1b3b1fd13ba1363e4fe482878791d4f87adcd5f57a130b42679f
MD5 26469585e0c38f890a1cff402c9a9839
SHA1 524ae23b49d8563c42b9cac201a416f8a59df0ae
SHA512 413c26016b4da6d7e919f2e3c2c8734a28ecff4f824c00724b01ed30038f39bcf6897c1fdee9f098d200e4734afbd7c17ef189f90302ca7f8c483a603cdbdbd2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 678236f06f459ac7fde72b0e69ffb57ef117e63975aba0017fc7575e9f2fcc38
MD5 77f7c71b5878845f787d4d034c0978ec
SHA1 75ba24354b91613d7ab59170e3506e2eecb35368
SHA512 8f6d24aee724b614cf88e25397daf6a93276cbf800184d568f9bd3efb2a4de928edbd4f6066679c23b80da86eca0378a7d05aeb63e4b642d0af3a12a91f9e0e8
TLSH
T17BD0121733520678D4102073100267198500C16B41864080983C865D1E840540903441
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Default\Preferences
Size 6KB
SHA256 555f944040d6c9838ee8427df7e6363fe376a1d46a23b9b019d6bbfd6952b5db
MD5 62903f323ece7b12d3430ce01efad1b6
SHA1 3c726fb0ee3ccec2e8e03e1a8119dc2803dfaeeb
SHA512 666eeb3fc73950b980a58fec1c1b1449cde89a2ccde0d1df52baa3bc2f2e5e8a727e0d14e43af464257d793d4e54a91f458ba5991aed254af3129502452d237a
SSDEEP 96:st+/dyaQs5Gjb9Qkyo5h16Z0ps7/x+6MhmuecJt61ejefK+goQ28XM1C7K:stGLQINonpsV+Fdt6QjJ/G6K
TLSH
T100D1B5165E647CBB4CC7E508BA297B43E2FA607261D51E58EBFC861C04EB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a61b1492-caaa-44f4-b6f9-a053e8d8f1b6.tmp

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Default\a61b1492-caaa-44f4-b6f9-a053e8d8f1b6.tmp
Size 6KB
SHA256 cd79df8819d5a1d10283717936f4c1322a4848b4b7843035715dc87957115f3f
MD5 254263f54777386802d708735c095028
SHA1 28fff27388778ececc87fe6c6a5af1204894114f
SHA512 626108e014c4335d69ac698eac5f5625491dd0fb049c1cf3b1ffb10709f9eb8d0dfc62445c12b7da2f73779f74c9ea9dfcbf6ded9167f013f1889d8aa920be0d
SSDEEP 96:st+/dyaQsCjb9Qkyo5h16Z0ps7/x+6MhmuecJt61ejefK+god28XM1C7K:stGLQeNonpsV+Fdt6QjJuG6K
TLSH
T17DD1B6165E6479BB4CC6E508BA297B47E2FA607271D51E58FBFC861C04EB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State
Size 2KB
SHA256 d9fa8dc682b3ca91026f216eccdc1a860694110162b26a0618329b458637690f
MD5 cc8f19c231bb6ab597127678048babc8
SHA1 ce617d7481b1c3992156df65f080360d411f0e10
SHA512 26a6c238c4e4a53251d9869e839841a98986ef978eb6e5bfc2e0a5cbaee4dae0e9ea2e3cf7bfa11e36d4bb3660fb5e04709e6783d5d66c36cecf9be011f431a7
TLSH
T1ED519733A8649E77C9E34A4879463F239E765262EB512F50E6EC0B0C00D769C1382C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State
Size 3KB
SHA256 6b468265bec5715a3ccdfd6350b26a56d6c07d4e92b8b69a3685c8edb193b73e
MD5 23879a6baa4bee19f10fcb746eaf2099
SHA1 871e7e43f7d9190936fd9c061a5694a41eb4d7f3
SHA512 978b23314ca1d6a842d328b56d4cbd3c4d018e68cfc00c945f9f017f609ff140d6cf25d73397e65e3662f857dec769df990540d021082494eccd4d1e904d1f75
TLSH
T176616837697499778DE38A49B9863B16ABA65123E6913F94D6FC0F0C01D73DC1382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State
Size 15KB
SHA256 8438f93fc81ee3296a9331230618e2515a52b17c642f9654f2d3fb406d5daac1
MD5 2cdf15ff451354dd6f1f66d246d20d96
SHA1 ee18a6cc595d33de3cf19c285b5936d326f87988
SHA512 b00cde8d2b155fd62c79242311394ae60a2cd239f4ac63faebd1c4614c345222b39dc302d9c47686fcf0472dd46974191d66498229b3dc306b3536448aff712e
SSDEEP 384:z+aQikB+z/xvxjg/qhE7NBS00sg1JisdjM9zf:S/UxvxjgC+yFJis1MFf
TLSH
T109728D3B59783E2395B7EA057949079BDBBA94B291C16EB48AFD5F0C06873980342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5941f1.TMP

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State~RFe5941f1.TMP
Size 1KB
SHA256 22f52859ff9ad64a9034b9c203f0a7abb5f4ccdeb789ae45bc85bbe921d7e3ee
MD5 a1f3b29171c952148399feba04e7e5fb
SHA1 902c644811be9fb1f19ca056fa39addb23d00118
SHA512 cebfd30fb819c4644f6a82c466a0d1463120e9aaaf1d13dbb4218a3c5f1b174b4a7071ae24b542ae4cfdb5cfd07621557ba1cae828a77c695c0b4dc004c78b79
TLSH
T185214073D4B84F72EC96124A31527B57AE625367D2000E00A2ED4B0C01A368CDB6AC37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4ec36b3b2be282022dbf002765f317b10c5e160c17de38759728f21950d48551
MD5 89d167f10edcfbc61cf1e02a9a157dc6
SHA1 efe802ea054d9e6458d26445b2d59e5096e9f209
SHA512 f86e85c4bc26cee94501f189ed73cd40c9ad7e1e07aca9f014c1235793da33a30ced5e69f8f2871c53dcc45167a8a1a725bb13c66846c5bc9b514bee4569f98e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f45e6192040e4c7cfb46ebe603b76fb48bbe3d5dba037a285ba8d1589086750e
MD5 77338ce5e0c4645ad27ce84b29ba5d0b
SHA1 5332f5255a0337dafdacd38a4024ef2d266710cb
SHA512 296ec9587694f72993d8d08c254d9044a8fb1e44650b93e52631f280c9fcd93e164b5aa67bd481733d93381e200803d6cbbaa951b340940e5b4bd6674f9761a2
TLSH
T10ED0125772410934C02020330403610D0982C60B8409C4005428C91D1E444900913451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

9e76aaf6-83ab-4730-b36c-20fafe8c5eb4.tmp

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\9e76aaf6-83ab-4730-b36c-20fafe8c5eb4.tmp
Size 6KB
SHA256 2cd5e6a1546ac34ee68783178b887af8945f187aba8ef1ab0bd4a19f61c2ed14
MD5 4b5524f044facde048737aa4352dac41
SHA1 aa95d1e9c27321107ce1a1063678d7df70734b24
SHA512 46867d2e8887e06f21b7b8a77ef43e495045a2462d9a3dff1d77e84d9cfd612b1ecd659eec816469dcc3104218f51726d6dba7f5bf15da80fadce2aa858fe6f1
SSDEEP 96:st0/d94vsb9KkCo5h16Z0Hs7/x+6MhmuecJljj0jeiK+gY/g28XM1C7K:st4bSRonHsV+Fdlj4jahG6K
TLSH
T13FD1B7165E68697B4CC7E119BA397B17E2FA602271D01E58EBFC8A1C04DB6CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 7f3af231c105fb15e04c6fdf290ac84f565a31d5d50fdb9ce527e4e0e0ef3099
MD5 25909b2d96d2b05a5450b853a354ebb2
SHA1 0cb20fd576d1c19861390b375af075542b43066a
SHA512 87781903528548c975d89f7f5cc94e0c88afc1e5b27826c21d584a2f2a8da2d91ec700230403343dff26efdf190e9874576399a322b30785ef19572e0389dc33
TLSH
T190D01296C0437427D76D9570B2E6E5157A7708B0021B1EC351A6A07D926571F7C05C4F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598d71.TMP

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe598d71.TMP
Size 48B
SHA256 8070671bba87c4abbc036dc9c66a5f77eca925bf9f52820b063de8c2a96a343b
MD5 311fa00d2f0fa64e3a24fee603d8dc24
SHA1 9e120588824aa256f9231edfa1fe3f33599a376d
SHA512 cdf124f226f6568194b3c74703f95da5ce0a2a0e527a87bca83f242871ee46806ac36f7d5a95ba27a0b619db211e68e932fbb63f50aa87d674af2dfeb0822b24
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Preferences
Size 6KB
SHA256 513b2e176b41dd97b0fbfe5742d6aea3ccb690dfd2072d9f82f5813936d97ec0
MD5 fb3fe74b7bcbe8bcf80987743834a883
SHA1 3ab7a83f781769a9ede31eb4fb3e12a370ee8990
SHA512 1d0059aa23bbda8016f948e058d1156d291b56162003b0abe89ae160a454aac8b6ce8a3dfe28079852470c509ec7548a0d61ae8e3fcc36db005d1378cf4a08f9
SSDEEP 96:st0/db4OGsb9KkCo5h16Z0Hs7/x+6MhmuecJJ94XIjeiK+gYjBtW28XM1C7K:st4BMRonHsV+FdJ944jaIIG6K
TLSH
T1CED1A7166E64697B4CC6E11DBA397B17E2F6606262D01E48EBFC861C14DA6DC630390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 16KB
SHA256 9e173db949645e49090dbf27cc8fd998942d54b3eaf27ba18c1890607bf86009
MD5 3225a126ce0bd9b6bde9511628350939
SHA1 efd3999294de64298e6894c7dee9b30b44e721bd
SHA512 2994a369bed2e32a9e2f5f41492e25fd562a4ebdfe2f67be005034351ced3478532c5a335d9bbb6e4dea8f937c62e8bdb59949d085ef346dcd1a6887388c59c9
SSDEEP 384:x+aQikB+z/xvxjg/qhEiNBSWfbTOVpiAFisdvk9z1:8/UxvxjgC+mXAFisBkF1
TLSH
T1B4729E3BD865AE2399F3D6417A0A679FCBB594A291C16DE48AED5F0C06C33DD0342C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 17KB
SHA256 6ade47edc08f204078eab42383909de63144b2b8ad6f7963bb715a6c997bd6e6
MD5 c773be24b384d339afaa4617fd92ba26
SHA1 53b4fb380199c8bc33b637d05445f7459ded7516
SHA512 d87657587d305abe0d3ecb3e67b2f6331cb96fb9f00473e05d684c75b7706169f3d94b93038ae7cc03417b8f67c73fa0015999e3ba9eda1c4e3463e5be6b573b
SSDEEP 384:w+aQikB+z/xvxjg/qhE5NlWfPTOVymIiAFisdvk9z1:P/UxvxjgC+mMlAFisBkF1
TLSH
T1CB729D37D875AE23A8F396457A4A679FCBB584A291C16DE88EED5F0C06C32DD0346C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 17KB
SHA256 f5d2d62083b5587886bf5747dc5a3a2a632a1e6ef8da6afe7ab31def84d06493
MD5 7c5ba721cd8ef97702d25d9a99b755d5
SHA1 f054df1d099a477b0c603a27e30faba2c56bfddd
SHA512 1b1a6ddb562984674f0e39d9ea0591b58700681bcb7b20528d1130d7899d31ba2093ccf0d9cf57403c45c1657d0c4d89e9786453ba1d30ae4ed532476ba03c55
SSDEEP 384:F+aQikB+z/xvxjg/qhE9NlWfS9iyOVymIoAFisdvk9z1:Q/UxvxjgC+1NMPAFisBkF1
TLSH
T17C829E3BD875AE23A8F396417A4A679FC7B584A291C16EE48EEC5F0C06C32DD0343C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 15KB
SHA256 ac34c6bc28393cf91ff432f8141613dab6f6e25254545851c81b5fe9d9d2c91f
MD5 cda144d65a160e45675d7e1a41d3c7b2
SHA1 3e6b89222d3d710f69c6f99595401947e1098a66
SHA512 392a4f84d35f38c90fcae8cb6d19149203b891a83be6271572da9272721bd928099b5bc7b0abf5efe55f75c0bf3fd12613ca51aaf8ea31516899346cd4233f54
SSDEEP 384:e+aQikB+z/xvxjg/qhEVNBSWfmTOUFisdvk9z1:p/UxvxjgC+2JFisBkF1
TLSH
T16E728E3B58B93E3395F3EA057959175FCBBA94B291C1ADB84AFD9F0C06873980342C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 15KB
SHA256 f758406a27428c9b8cda816092cf34290a75060ad8ed286854c293462079e929
MD5 c53439c3b2ee50c3a0d511207f24e58a
SHA1 a9a3c38e323c3610a9a9224cc62f9ecf9eb9030e
SHA512 f24e4c67dc1decf8e8211f6cb507f1b1024c50cd679e20ae12c523015565bfe1b681c817c307bcbf50dfccef5bfd39bcbf643a9ad3949672004cf5030c78c4eb
SSDEEP 384:w+aQikB+z/xvxjg/qhEoNBSWfmTOUFisdvk9z1:P/UxvxjgC+pJFisBkF1
TLSH
T1C1728D3B58793E3395F3EA057A49175FCABA94B291C1ADB84AFD9F0D06872980342C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 2KB
SHA256 88d6825163d6d60b992ed00d42c343d266f956baf75e6314abf0193bbde13ec3
MD5 5853f62f26392e8fab0fa0fee35950d6
SHA1 acec8f5c241deac79e8ab6970adf2b934e8232e6
SHA512 857c29e86988cd4e4e2ca9a50eff8af907f618350014b771eaa69aebe6ba5f82d5f3d7813d6ef82980e7285fd670cbad54c60d80c1d76f78a1aea5c40b50a4ec
TLSH
T1B451A4336C609B3799E38654790B3F2B8E36A0A2EB916F509AEC4B0C01D764C5342C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 3KB
SHA256 d7d52f4c728db6dc3c589c39129c720419bfd5fba27359337106dbc182c34765
MD5 8097240440da4f122f8935d5f2344c43
SHA1 569a64fbdc8d70d81ba846426216ad671be128b6
SHA512 de9204ba12f192df57866450bfd6ff306635367b994638815c65b356cf0c549e6f0ca5bd991b27d8c282a157b2eb1c80aafaf9eef1730c28d93b909020d34578
TLSH
T17D6186376DB09A375DE3CA14B9863B1AABA56023E6817F95DAEC0F0C01D738C1352C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 15KB
SHA256 c10393f8548aecf8905d0350d25ffb356436ed37977dcfa4514848e5c1f6e792
MD5 f97e297e01357fdb1db0dcc557b91372
SHA1 eb5f38430dc8281a1cfd0fb78e22e9bfeebe6a01
SHA512 332b009fad0b3aac1757022c820ccf1225587d3008c1674fad436d26fbfeca36c4be8e9ebc29f60b0f0dff2f0f8b2ac5bc6b4aca8f6f988fa0c1e278adaca0bf
SSDEEP 384:s+aQikB+z/xvxjg/qhEaNBSWfATOUFisdvk9z1:L/UxvxjgC+lJFisBkF1
TLSH
T151729E3B58B93E3395F3EA057949175FCBBA94B291C16DA84AFD9F0C06873980342C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe593b2b.TMP

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State~RFe593b2b.TMP
Size 1KB
SHA256 21733cc51251b7dd88222e805ed1b0d4f39b7b34809e774cb369031777d76f4f
MD5 cff59529ec7a84d1c71316ca45ccca2a
SHA1 2b1e0bc0623ce45a53278db8c91c09d1bab2877a
SHA512 f08553229d961d9b9c2f6f2e610bc047c2b4cd69778f319e78450e77be59977d1aad59e6e23950837c3578b2f5b7263f6126eefcddbc4ed2f9b838707736c758
TLSH
T1642140B3A9A14B72ACC2826571177E5B4D3160A783408E44A2ED8B0C02A628DD76BC76
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\bcc2ef54ddd674d5\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 45d326d51fc12b43cc21567b210d4d2cf9d286757e2ee80cb2540c4af9756000
MD5 473fcda1a7f0c2fd53d38be647c94dc4
SHA1 0fe533538da7525a8699e4a438471d0d8b7da21b
SHA512 21bfb59d04f11985288e899d65e8e67d3a8d3d107a90e2e31ff4343cc44df1eb83b913e8bd651cc3f6f968db57df866ee0ab9f42ba6c8a7b0cab7236c4bf54c2
SSDEEP 3:T41HlGlll/l/lXp9ZjrPBY0LlWlxemQlll/ZP:CH0dPBY0cQD
TLSH
T11953124112820517C442037006CA4A943AB46204038304118260D130D459B042571180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\bcc2ef54ddd674d5\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 326410334921c9a003ca819820b2f26e6a31201d54a4b7dec0cf621756e46a94
MD5 22d47fde80501801656894bc91506aa6
SHA1 c5550f5450eca9b24416c56d722b7a6d7d63bfb4
SHA512 8abc97b035bc4a660184b1fd51ef190fc620d4017821d5e9ced6aee82fdc720be05eb412b606c4dcf2edbe354c370609bfc6ea8b5e14b6a26122f37ea5ffc6d2
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\bcc2ef54ddd674d5\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1KB
SHA256 40928da695b4c88e4f1487f64b20258fe457319908f7b1534ee8874e03fb895b
MD5 febfbea66e6cc686e0709f8a483cfd4e
SHA1 683597e562895538eae3005eb3335b560fccaff9
SHA512 2ae97de729e626afe740417c3b280c6b90e754077b0fe6c23a30b2c12a150dab7f016c299c2c58a892762253102159ad38de05325feac31e3b7a53c5a777b521
TLSH
T1ED112E2C37D60E30F396AA3080766A682077B1055490938D80C043260922808E4B4FA6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a06486374ad6d2fb1fcccf716cc1f475463f0f51635e4f06e349e902b08381ad
MD5 b5391b22e97cb3eb13c88d41358414c5
SHA1 83024e42406108b8b9cc0b486869b9c2acc3dcda
SHA512 defd37ca5d1c6fe572b4193fdbef2f90012310154f2777fded0dc562392d12cb2eceb850d4d671cfb3bbe6e1071c9f33428d5e814b165aa23a16ed91995a862a
SSDEEP 48:VkmChBbtXaov9kNm60rIJIvr+OZlzv8UcVJE5oEJ0dfjw6CniGae6dMxtQ:fCh250raqqObzv+c2Enik6abQ
TLSH
T1BA91FA5C6B6228CFDB666CB50EE444B53BF52C3A52079EC94140FF790516F6331E901B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d55f2a77e45a12f3bedcd09e13be59c8948688cce0ad6d661cde83bd5fcd858a
MD5 cfbc4d43883430a80d10344dedf647f0
SHA1 e5932dce90dc1d663866bed58610b953c70b98e8
SHA512 3756995691572fbd782d4b2936175eca4427e2423cf41f4bc61c7f83a6eef56883d1340ce185a7fc90768c7db73bf210d8fce5468256cec156d2a91add88d912
SSDEEP 48:EkmChBqjiXRov97Fm6orIgWIvF9OZl6sv6UcVpE5oWnJ0dUfjw6CniGaRldMxty:uChCCaorNWqTObVv4+w2EniDlaby
TLSH
T1DEA14F6C67A229CFCB215DB40AE048753BF52C3A91479ECA1150FFB9041AFA371E901B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 74f518bcaff3a3dbe268510010ab9b74b622cc5b19c4d36336a6f57fec84d521
MD5 4fd5c20df0da33496e0ebf51cea2ab26
SHA1 ac57cb232bbec450a8d46962a698ca1dd2496f55
SHA512 35ac980abea7299fa666828b9d7d7b4e2ff75c087ad1d079e371e0177e558035f44d1998422861593df8b8cb9eea2469b75d3fe67b40257eaf4223e9a26d7d3e
SSDEEP 48:VxkmChBqjiXRov97FWq6orIgWIvF9AZl6sveUcVpE59WnJ0dUfjw6C9ZiGaRldM9:VzChCCBorNWqTAbVv05w2E9ZiDlabEK
TLSH
T16BB1506C27A229CFCB211DB40EE048753BF52C3A91479ECA1150FFB9045AFA372E901B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 b5c38096dcef3d2c5bef414166be0750342419d9ede610d00764fc7978bfec9b
MD5 8c799e1af3d1cf63d0b9944d09fa5e20
SHA1 d17991aa19dc64a631fbcd40c23d2841dd66a7d3
SHA512 0cb454b85256b6abef459ad0296f3c3c156bc027f055375542ec8988127c423ddb25ff2ea007e39d4823c6920a4ac925176af04df4b5dc983fce3b8d6df480e3
SSDEEP 192:DiMAL3YUIDJ/ldJOoJ0Jn9MRjaJfxOvK23mvAItGjh4QKPWKdsXo/Y9HvXvPvfyh:DiMAL3YUIV/ldJOU0Jn9MRjaJfxOvK2w
TLSH
T1FF22ACF7C7D8862DC9111AF4AB243F2FCD1E0924432C3D2A89D5AF4B93E1871E28565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b056ebb4dc041c5c5dfee634f4a7a1afb9b45850ba41c73bf5a8a6db1b64458a
MD5 857fcff1b7fc795f3e6e1f6ad3c8e8d1
SHA1 422bfd96d90ea3e8c69257a551b6928dfe086460
SHA512 475b949c34313d7f71ff1231c9cf25444287ee0bc713201cd7a0441a9e12bf6fdfd73543140a601255ce40b3885c9c5bf3e17edba03e7bdfbe319d35113d65b6
TLSH
T183D022E3168171FBA56D3E93886AEC8FC32B00201882EED5B3D0989C093D87E060B184
MD5 SHA1 SHA512 TLSH

Submit Download

c4529e51-317d-4a2a-b7c3-d001843fb3dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c4529e51-317d-4a2a-b7c3-d001843fb3dd.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bf474ac7ff749a01d989bacd9127182618177a098150e69f6dde39326259e608
MD5 dd8d20f3f9ca690a3b1eda5803edeef9
SHA1 5e2cd1eeb73411e07492058c8812256f5eaca170
SHA512 de2e3323a49a8784505d528f61a7dac319c6297f9efad1a0051ed523d730a97f9e9940104cb42657d59595f5daf438b7b666a3f8123ff06e316f9385af17f7cb
SSDEEP 192:sxRORPScB1E/fSsT8hZxiboA8pKFyN/g6+WNy7gHpGXatFoEI8YnGrIgDQiaXDGd:sxROsm1E/fSsT8vx9T/5lkX0x0iP
TLSH
T1E162D956A924C8778CC7D619BE75BF62D7FA102299911E4CBBFCCA0C04DB6ED220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fd513939fbb2087bf1433a543977073bd3151cd76b9f3d360bd0eadd5de93a71
MD5 737ef562ee059252edf32bca705b5722
SHA1 36c76b44bfe45eaf929dd9a258c080eaea90ef2b
SHA512 4c5ba22b75ce60a066a71ccdac3c8323f49a853cbdea185bba0e0d87c81e79125048c68b5403e2d038f8afda79b9e1b0464b6cbb95392d1253ab5153ae29e208
SSDEEP 192:sxRORPScB4E/fSsT8hZxiboA8pgFyN/g6+WNybwBpGXSNgtDUstzHWPok8YnGrIS:sxROsm4E/fSsT8vx9l/5tOXXdx0iP
TLSH
T12B72D867A92489778CC6D619FA75BF62D7F61022D9901E4CB7FCCA0C10DB6ED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fe8473bcc1dff35ad9d24d58cb88be1c3d6a2b6af18bdd586b81eeb6b66b2609
MD5 2ad420fa2a7bf0f96eeb6e03a8246b4a
SHA1 5bf313e7f44c362c5a69e4c0cf6b8e0480c7da9c
SHA512 06505042c19157df64d5e8e0c4a2cd00e1201f30d86423e6e1e8f086aaf3aa6e65e36e5931437f2407baa6290d3d878294e3229f82806516914e2d125ddbdaf7
SSDEEP 192:sxRORPScB1E/fSsTShZxijoA8pKFO/g6+WNYpGXYoce8YnGrIgDqiaXDGxF6m:sxROsm1E/fSsTSvxfR/5zXqxGiP
TLSH
T1D162D9169924D8778CCBD619FE75BF52D7FA102299911E4CBAFCCA0C04DB6ED120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 192f98af71f444192a19e036bee88c04b051a246ff16f15870f681dd45870b34
MD5 0f3769f011ed9123923682db52659921
SHA1 8b602e9bbdaafda607658ea750491e4b59b84720
SHA512 b847807232160bc02bd466befcea7ccadbc5f7e297625750d5bf1016c5f8dda2a3900dc9bab00b1f33e0503b11a24480c7d9024c134eb754a78d7df0dec1e532
SSDEEP 192:sxRlRPScB1E/fSsLShZxijoA8pK0P/g6+WNY2O/Yo7e8YnGrIgViaXDGxF6m:sxRlsm1E/fSsLSvxfl/5I/ZxFiP
TLSH
T1C762C8169928D8778CC7D619FE75BF62D7FA102299911E4CBAFCCA0C04DB6ED120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7a5f8dbc7be09071d117d953b82345c6cad43f33530dde6ed854bcaf32f11f83
MD5 f001e19b768a21f61f0d3000a6a5a5ea
SHA1 18cd1018ead9163a03985c4b9f8bbc005453e5a9
SHA512 837c6501116179ff3ce7486da76cbb1703995ada59bfc5cd6fd693b3715af7ca77f8fa9475d33e5ea3ea969d5133ae751625090c88940b22d6f3bf3b51cb8e71
SSDEEP 768:j26HjT7pLuLf6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVJUBVuwxro9qe0X:j26HjFEf6RWgs2f02u1jaOUB4wKtg
TLSH
T151D2DB7B640DCBBE4F800ADDEC197E9F6D6802CB9698CD8447FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3193d17c66aa2b0493245cf0e6185181b021796e3737099fcecec8902dfb4a4d
MD5 68cff3d1db9a73d2f7b8dc111afa4d59
SHA1 f38e6022e0159a8ebe4072d970a99ad0047eae70
SHA512 0566a843330ee06b701efdbaafca0f00b55aa008279e3d99fcd3e79273973cfa55d877f4094dcd848bc729e92c3ba34c5fc281dfd70e50ddf16b1f2ed752e6df
SSDEEP 96:KRVCbvlfjHWLQeg3HK4GgJHcNVIbTMHRu/bpLP7W/cKgD7K4CgN7cRZUnIepeKe/:CVCbvlfj2LQ/3dGgJ8NVIbTMHRu/bpLM
TLSH
T140916704317E128138BEA94C80F5896AC7C2B8E67655E52B7FE805978F67E134DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6747.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6747.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 93e4b21f1d86402191e62cb4b8fd5f34efc60ebcc79bb8608f1386ad7f1e7213
MD5 b13b06c8ea571ea70556b48e505f4bc1
SHA1 04bf48b7bc554a1f51a5be1e42d3a26e061e4f96
SHA512 ed02cdd52d4e4af0cc94886b08454cc8c6f951cb16a9ebb4b1c296a8e39e708dec481d74ecdbe6f6f95d166ad761bd943722f6a97491a544d9fc63bf6aa88be7
SSDEEP 768:QU3Xxhp/TBOWMUtm0StRONXyer1IRCzni95b9Md:QU3XtWSIqnub+d
TLSH
T19AF2CF31A9959E338CE6E392F5427793BFF52073D5C84A44E9EE9F0D0993A5E130B406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7bb61103fb9539f3a05ca966f250afcfa7311ce196811979b276b45f1ba57473
MD5 7b5e0ec7d112a95abe6184dd10c7b308
SHA1 7ec5b15b1868a536f17ae99aaec591b6d7d08d9e
SHA512 ecc7fc3ae8137aabf2dcd18dfb567cb374aad41db1ae22a410e259af67f636e132c231c920d3c90d6afa0fd14de67ce763aa55363659ede92c1ec865a483492b
SSDEEP 768:Q53XFhp/TBOWMUtm0StxONXyer1IRCzni95b9Md:Q53XZ+SIqnub+d
TLSH
T1C3F2CF31A9959E338CE6E392F1427793BEF42073D5C84A44E9EE9F0D0993A5E130B406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 98e0399666f86c2a09355ff5d60ddb35406a313618af8c2db4ebb22134f16cd2
MD5 7721e6e8586f40d7e8b71de14ef90c56
SHA1 aab746344b03fb0bdadc9291729b5620df71728b
SHA512 7c77314f644934d511fb8162e869970b31a00a579fa814814ce73d7763ab97764725e2cf6ae368b01d539de63c94047885399da6db5bdd7d668fbd91fce1dfcb
SSDEEP 768:sFHN3rwgz0hOxsOWMUtm0St0ONXyer1IRCzni95b9Md:UN3hDESIqnub+d
TLSH
T1BF1328F598D38A33D8AE5783A77D6E46AEBCD063B5884980B7D55E4CCC8257FC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 68a2a016727c65ddfc98076b33585f9a698ef3530f251e0154695453e949de2f
MD5 06c32542b1eb99f454f9a78d66b8ee78
SHA1 59e0140a4e9d8f42048727260e2b4adc5c4fb75b
SHA512 2ba75647772180de636f773c939fc0c819626bc852f98942d9d0b05938b6311f0b92798f3ef7a46f5bcd2b432ff3b30de2b32ddc227ee4e5f7dfedb80cea0fa6
SSDEEP 768:arv+4UNbd837Tz/TBOWMUtm0StYONXyer1IRCzni95eVH1SK3:absbe37nfSIqnuEH1R
TLSH
T14313B032A594DE334DF2A396B043B7837FB82067C5C40A90E9DA5F4E098769E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 8306b9fd4d0b34222ead0a0b5e93433ebd85bf700b22fc1e9c772b3ca846e64b
MD5 62e8dc844e50863cb66ed4e6191cd63c
SHA1 ee4b381ed7c0c246e87fdb9edc01f68eb43af9ed
SHA512 5986a7e1051c0e2796799a9e7b3da87aba2c1ecd5831b0d571b46beb4d54dc291d01b8e038048c5db0c8dcc2d135220a202ef32173c77955151bab95fe6d6fb5
SSDEEP 768:sFMaB30wgzNhOOsOWMUtm0St4ONXyer1IRCzni95b9Md:naB3S2HSIqnub+d
TLSH
T1BF1328F598D38A33D8AE5793A37D6E469EBCD063B5888580B7D55E4CCC8257FC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 86b56682f94834673406d7f46fecf7dc6f3c86b72a028c9d1f4c1fd4c4018520
MD5 212ec873cb04e34a4c088cc680a82d90
SHA1 c961069446abd8527cca01ad534a043acde10f68
SHA512 14bbe6d68ffaf5458daa776cf7ee1ebf77522c8d070f4b5840f5d8f844c10422c6e27e42a7098eb05bbf9823a78ad778c04297684d2e77f09a0ad63b86347829
SSDEEP 768:Hrv+4UNbdf3kxhp/TBOWMUtm0StRONXyer1IRCzni95eVH1SK3:Hbsbx3ktWSIqnuEH1R
TLSH
T19C13B032A5A4DE334DF6A396B443B7837FB82067C5C40A90E9DA5F4E098759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3d72a2e4e8c0833d84e99c567c18e5cb556e6be716f0fff7e115dc6c0d6fed9c
MD5 0baf3bdc48538de5a63704bde7068502
SHA1 f6e25e48faabb0457cac224f842e247f4c02d982
SHA512 0a06caaeab85e5aa8ff0c938455f2abd4c6034a11c8f2b2ce4346766b90a0dcceb30eb983a404a610395fd228cd2d732036855dc219bcf5e93752c049d7124a6
SSDEEP 768:hrv+4UNbdz3Qc/TBOWMUtm2ONXyer1IRCzniBceVH1SK7:hbsbV3z5SIqnbEH1l
TLSH
T14B03CF32A5A89E338DE2A3D6B047B3437FB86057C6C40790E9DE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 976a34f8b8669028597bc12defd0fbe7e5b04e50eba6f154f5c4a47754009b05
MD5 3034cfe2e8fe37a460d6995a26814d1b
SHA1 83983d7e4fef3d83e0f25db69cb07aba9d2235ca
SHA512 2eafb20220ff01b2cf179c0ffac0fa166ea250c3be1ccc1fdee6259066b1f37cadcbdb9f47d425542bc026606b3956a4c4150c9ed6b99803b3a94cece571b276
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59ea85.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59ea85.TMP
Size 392B
SHA256 5ef2c0c5811b6d8ee14facc530bff4db77bd7c12f96a14a122a069e0bbac1d9a
MD5 a7cd4d909fc9105f4448b03b25fdb85e
SHA1 113909d223098f37ed8596907dd029dc6a99e696
SHA512 da65a700bbc0ae13e313ac8096a6e5fbd73a4247cd04aeaca7f803c0f94d02c4635d006279cf7e533176860f98113eed41c1f9d9cefd75a666b7956d90f6adf8
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b8c1978-2ad9-46c1-ab87-824c429d12fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4b8c1978-2ad9-46c1-ab87-824c429d12fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59a2fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59a2fd.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

b95f3dd9-591d-4ff5-9dcf-8062e45e0730.tmp

Path C:\Users\Admin\AppData\Local\Temp\b95f3dd9-591d-4ff5-9dcf-8062e45e0730.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg596.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsg596.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg596.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg596.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3532_1907517871\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\BlurAutoClicker\settings.json
Size 7KB
SHA256 d214552356ed5d79e1e6f2e0a610832a3eb8655ee75d67f15a6be7af5b3969c3
MD5 97633686197e138f594db02b63cbfc87
SHA1 37ea1cb44be226073d3cf3c87efeac9459da3ef3
SHA512 34147848737031b7e482ff732b418a30cb7afbd4dcc156676ce483d8bb2bd0f0425e27d2dec31044afa9f8bb4553ddec592a85c9bcb61ac2e15b93cc3d24baf2
SSDEEP 96:8Uohf+gsWIB/tYoSOE8Fz9OuK1OV8CiDnx:hohf+gsWIB/vSeFz9a1I8Cmnx
TLSH
T189E17C69D2241CFA2095D675D879521B1A41E4638FD23C3CB24C889C1F1D97EA2F2EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\BlurAutoClicker\settings.json
Size 7KB
SHA256 59f144b20a89f3ae14380933ebe4f03ae920f4ffb74feb87ec7ca0952f479f28
MD5 17f9ae0b9fbb69d67be3287c7f3ff6df
SHA1 7e2851ea8a1d498abf336c78fb558d78d4fa7695
SHA512 e488a7524fcd6f0783a436965189a67ee06dc38d08bc5f93ffa3f6f0d0f39703bcc7b9dc67008c63e028a094e44d000f16e8b45482e6bcb39c9bb2d47bb6ce29
SSDEEP 96:8Uohf+gsW21/tYoSOE8Fz9OuK1OV8CiDnx:hohf+gsW21/vSeFz9a1I8Cmnx
TLSH
T17EE17C69D2241CFA2095D675D879521B1A41E4638FD23C3CB24C889C1F1D97EA2F2EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlurAutoClicker.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BlurAutoClicker.lnk
Size 1KB
SHA256 28884d379816368d5cfebb505d323fa389e1fa5ff378745626f537b17a1b9fb9
MD5 d700dfb6e37ef6c53751a72507944cb4
SHA1 8c7c785cde11a88ef9734b2d535e916a90841758
SHA512 5a6e1eadccbea41dcab40edec2bdb0f18ceb242118523bf862d039f8d0fca89dfd1590a62aa8d44af948c068568d01c724b775d539a2bf0b28e4eb791f0aa527
TLSH
T1A321A9018BE62B02D3E9D1712EF7A1278D32B823E2949F6C0100C74D2D257824F49F4E
MD5 SHA1 SHA512 TLSH

Submit Download

BlurAutoClicker.lnk

Path C:\Users\Admin\Desktop\BlurAutoClicker.lnk
Size 1KB
SHA256 bbd8a1ef9c8d4c5bdaa3f1203a3367493b31a806eecbcfd8ab7a914c55bfa457
MD5 bb23f1cfdbd06e98002d2aaa75b094f0
SHA1 313a25a1bf1c42b81ef9015c2bfd454d76afc7e3
SHA512 4a2026dc30dbc6153b497b9b554c1c66da181be948f07cab05fbb402580ab6bb5a8869d3565dacb36ed2a37dad5dfedd134250ded3f7ea5eb6624272e4a1c757
TLSH
T1A621A6019FEA1A02D3E9D5B52EF7A1278D32B823A2849F6C0110C70D2D20B834F45B4E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1096-77-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download

memory/2428-1633-0x000001953CE00000-0x000001953CE01000-memory.dmp

Download

memory/2428-1629-0x000001953CE00000-0x000001953CE01000-memory.dmp

Download

memory/2428-1628-0x000001953CE00000-0x000001953CE01000-memory.dmp

Download

memory/2428-1630-0x000001953CE00000-0x000001953CE01000-memory.dmp

Download

memory/2428-1631-0x000001953CE00000-0x000001953CE01000-memory.dmp

Download

memory/2428-1632-0x000001953CE00000-0x000001953CE01000-memory.dmp

Download

memory/2428-1622-0x000001953CE00000-0x000001953CE01000-memory.dmp

Download

memory/2428-1624-0x000001953CE00000-0x000001953CE01000-memory.dmp

Download

memory/2972-153-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download

memory/6316-1377-0x00007FFD17830000-0x00007FFD17831000-memory.dmp

Download

memory/6316-1378-0x00007FFD16AD0000-0x00007FFD16AD1000-memory.dmp

Download