hxxps://cdn[.]discordapp[.]com/attachments/1418753933899464747/1483648855856775391/AutoFarmUi_SourceCode[.]rar?ex=6ab3352c&is=6ab1e3ac&hm=be5cb8e3c3a881d9bfb6af1d03c37eed895f25850c69a4e180a7badd21dae736&

Analysis

user interaction
yes
max time kernel
270s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1418753933899464747/1483648855856775391/AutoFarmUi_SourceCode.rar?ex=6ab3352c&is=6ab1e3ac&hm=be5cb8e3c3a881d9bfb6af1d03c37eed895f25850c69a4e180a7badd21dae736&
Sample260922-kwp8qscc23

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1920	cmd.exe
3060	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3432	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345410506475325"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{A8179B32-EB00-493C-8499-CD1D750A7181}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1668	mspaint.exe
1668	mspaint.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2360	7zG.exe
Token: 35	2360	7zG.exe
Token: SeSecurityPrivilege	2360	7zG.exe
Token: SeSecurityPrivilege	2360	7zG.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
2360	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4436	OpenWith.exe
1668	mspaint.exe
1668	mspaint.exe
1668	mspaint.exe
1668	mspaint.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4432	4852	msedge.exe	86
PID 4852 wrote to memory of 3432	4852	msedge.exe	87
PID 4852 wrote to memory of 1632	4852	msedge.exe	88
PID 4852 wrote to memory of 1632	4852	msedge.exe	88
PID 4852 wrote to memory of 1632	4852	msedge.exe	88
PID 4852 wrote to memory of 2828	4852	msedge.exe	89
PID 4852 wrote to memory of 2828	4852	msedge.exe	89
PID 4852 wrote to memory of 4152	4852	msedge.exe	91
PID 4852 wrote to memory of 4152	4852	msedge.exe	91
PID 4852 wrote to memory of 4152	4852	msedge.exe	91
PID 4852 wrote to memory of 2312	4852	msedge.exe	92
PID 4852 wrote to memory of 2312	4852	msedge.exe	92
PID 4852 wrote to memory of 2312	4852	msedge.exe	92
PID 4852 wrote to memory of 3344	4852	msedge.exe	93
PID 4852 wrote to memory of 3420	4852	msedge.exe	94
PID 4852 wrote to memory of 3344	4852	msedge.exe	93
PID 4852 wrote to memory of 3344	4852	msedge.exe	93
PID 4852 wrote to memory of 3420	4852	msedge.exe	94
PID 4852 wrote to memory of 3420	4852	msedge.exe	94
PID 4852 wrote to memory of 4496	4852	msedge.exe	98
PID 4852 wrote to memory of 4496	4852	msedge.exe	98
PID 4852 wrote to memory of 872	4852	msedge.exe	99
PID 4852 wrote to memory of 872	4852	msedge.exe	99
PID 4852 wrote to memory of 652	4852	msedge.exe	101
PID 4852 wrote to memory of 652	4852	msedge.exe	101
PID 4852 wrote to memory of 4812	4852	msedge.exe	102
PID 4852 wrote to memory of 4812	4852	msedge.exe	102
PID 4852 wrote to memory of 4812	4852	msedge.exe	102
PID 4852 wrote to memory of 3184	4852	msedge.exe	103
PID 4852 wrote to memory of 4060	4852	msedge.exe	106
PID 4852 wrote to memory of 4920	4852	msedge.exe	118
PID 4852 wrote to memory of 1544	4852	msedge.exe	119
PID 4852 wrote to memory of 4864	4852	msedge.exe	120
PID 1920 wrote to memory of 3420	1920	cmd.exe	131
PID 4852 wrote to memory of 1224	4852	msedge.exe	132
PID 4852 wrote to memory of 1224	4852	msedge.exe	132
PID 3060 wrote to memory of 2560	3060	cmd.exe	139
PID 4852 wrote to memory of 1668	4852	msedge.exe	141
PID 4852 wrote to memory of 1668	4852	msedge.exe	141
PID 4852 wrote to memory of 5096	4852	msedge.exe	143
PID 4852 wrote to memory of 4736	4852	msedge.exe	145
PID 4852 wrote to memory of 4736	4852	msedge.exe	145
PID 4852 wrote to memory of 1384	4852	msedge.exe	146
PID 4852 wrote to memory of 1384	4852	msedge.exe	146
PID 4852 wrote to memory of 940	4852	msedge.exe	147
PID 4852 wrote to memory of 940	4852	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1418753933899464747/1483648855856775391/AutoFarmUi_SourceCode.rar?ex=6ab3352c&is=6ab1e3ac&hm=be5cb8e3c3a881d9bfb6af1d03c37eed895f25850c69a4e180a7badd21dae736&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffc878fc188,0x7ffc878fc194,0x7ffc878fc1a0
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,16388254209050222447,11570570943381112791,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1816,i,5929954122649412469,18244240244777402083,262144 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,13530749959945738072,10786622635492746079,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7770546212198730323,10113179155239181192,2097152 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,6670594279346234473,12048933069029472295,2097152 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,4730132820331351104,5984290268812797340,2097152 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,4714697209354177976,1713021185358323244,2097152 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,17857950903399700496,13844891368992782416,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,4943252937392390235,1408397277317364000,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,16948559631303692155,1809102896625250999,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5636,i,10789806786645509880,7533315959897646607,2097152 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,1391169225908714875,6503893216661950221,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7891366106379191797,5992888173588615085,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7891366106379191797,5992888173588615085,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,1616477230138832664,13364316750315768517,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,2855134923325458467,6474841333733887095,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,10406502157680574298,15638918503963922610,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,15485687404368020802,9144537061355516460,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,5376780481643717840,7041121696780595326,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6936,i,9754582995698877494,4408427113231948002,262144 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,18358290653298713176,9139626028238731831,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,8437721803813933747,11285117081320461284,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,17909375910082213591,1892110017018489549,524288 --field-trial-handle=2872,i,274771109589430274,4335161867667931153,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4424

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\AutoFarmUi_SourceCode\" -ad -an -ai#7zMap32300:104:7zEvent25525
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\AutoFarmUi_SourceCode\build.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3420

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\AutoFarmUi_SourceCode\icon.ico"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\AutoFarmUi_SourceCode\build.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b0b657208858c183f5bc2600d7293a0c7cd336652c82af1cdd54b50e86ba2a24
MD5 cbd072ad146a3023ad93056c77a54ba5
SHA1 728e2f2cd7049f6184a9695adff29b9072dd6094
SHA512 3841313199a26eb63865468cdbf04e75b54c9826eb777083a0ee1e58f5168ae37e4a47348e0bf175d4d368d47b958ea9c878f505201c152d7c491238514190e1
TLSH
T1F0E07DA909CCC32EB218654B436C470CC3C0B74FD2CC6A4B370089C9B18B044BAC2BA6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e97bb1a154448f548555540677ea0393c5f42d578a02d59b8c20226f0ca27709
MD5 964ebc78394e5f9c5c5b9988c98abf03
SHA1 d47774ceb18fafbfb158195ed0c6ceeda8083c38
SHA512 dc1a6eedae78ab823f7f9b958a79b51bc3e053840ee9fd4fc5b838d115cd84aaacf57abf22370d3bc63d97e9e242ca8cbd948f4fe5b7b5b394d8db7bb6d122e9
TLSH
T187E026EE04C8C2EEF21C648B416C4B0C828C370F93CC6B0B2B0084C97483C58B68A793
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b27a2f8bdd54162bf369628aa5944ee080150d726c66102cc122926a3187a070
MD5 9399db346804b6b8ddfea209ba5cf063
SHA1 2482f4fd784a96d3a6b6487cab1008d4f2ea41e9
SHA512 4e2559a4bef7f2ce8772c360df5b4a12d2ee31d4a2bd8c061829dd10696bfae72e5c1e0244944fe7c4fb87b9d0dfa8e506cc8ddbe1bf59322f1d9ac71db7ff72
TLSH
T1D161E68A89833CE9FB6011747BE109CB377618BC56B35F4A2BE4DD38B84EF084100C14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591534.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591534.TMP
Size 3KB
SHA256 45b7ad5ff96773a16af14555ca11924506a67821939b9618ece956c3eb8fca5f
MD5 772a991bd9b26a03d433aeb64a7eb67a
SHA1 d09cfc4a3236cce7f5ac952cbf2afd565f0c92eb
SHA512 5a12fd6fb5fa77256bd102b0c0cd83b9fdce6d950632441bf17cad196c18fd54f1ccb893efbf063f1205c58c291eba07befad307cf40321e8a91ca6e50d54528
TLSH
T1F861E68A89833CE9F76011747BE109CB337A18BC56B35F4A2BE8CD38B84EB084500C14
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6973eae5fc8a3794c8bb7bc8ee4bf0533db817d4ba530286931c4f20948965e7
MD5 04cfc9eae3c1689d6f88c30166e0e758
SHA1 d2668203c3d9c171607c4135d3c6585870e3ddd8
SHA512 aaed5ea7507e4045ae32a51c954f9d2c77752675f0454d3ee832ca0041e672932ef9c5f2f61fd2301b6e9ed0eada4919b3f5eb81d44b85b13ce2b2f6b1efc3d6
TLSH
T15C219AF7C7D9856E89055AF46A24AE1BCE2D051543183C2A89D4EF6BE7E30A6E00194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b2e0cb5e3054612f65423f71e4b2cd632dc72d9850a0966a80444618104c2f11
MD5 f846876f3cb6629ded977c383707b0df
SHA1 10ad88f47018adbbd586b1ab2b8ed78cdfd12254
SHA512 17653e23d29dc26b9dc2c0291efc50b0d8a40ac7a27246e27016b37795fd6496bf4f4010a40b14bd0fc0a22029307cf0693cb65964e6146a7e4876376b4f4bd6
SSDEEP 192:sxZVRZni/f3sJ9IdpJHW6+WNGYrBLSIgrJ:sxZVni/f3sJ+JHbGZ9
TLSH
T16612B652AE28B53B8CC7D20DBB69BF53D6F9503251951E58EAFC861C04E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7b7f5e9f199ccdd4ad40b3ba48c5c1ebd05e88b3d603fc392a945d0184a13de7
MD5 425fde224ffb8380962232c4a2e9b293
SHA1 ca9d63a6211dba2f9f13e9976ecef04d22e43222
SHA512 67adc8f39db7535c4a7a4db41621f5793d5dae9f64e979dd4354de8aa946ac23b7e853f74cdb7e5418fb1a3cba4fb2fa860f907939db46c83aeabf9cb5d18487
SSDEEP 192:sxZVRZni/f3sbW9IdpLHW6+WNGYriLSIg5TJ:sxZVni/f3sa+LHbGwb
TLSH
T1F822C756AE28B53B8CC7E20DBA59BF13E6F9503251951E48AAFCC71C05EBACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a28d96a0abedd526e5fe4e66ef85523c7e611caed98850863080e91f34a1550f
MD5 b81809384cef17dafc49a9456501c55b
SHA1 4ec1c06078a4de513e87c94160b7e166647b4b36
SHA512 d857d873b7ce6aa02c0570ba0895eec6650c659d63acf891ef0adf9e78353a8d310fc46b19c3038d54ca95cc2159f8ff73357baf9b7ace1ff69458ce4cfcff29
SSDEEP 192:sxZVRZni/f3sJ9IdpJHW6+WNGYrBLSIg5pJ:sxZVni/f3sJ+JHbGZ1
TLSH
T18522B752AE38B53B8CC7D20DBB69BF53D6F9503251951E58AAFC861C04E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 12df9b51cb8c53aae92ad49768d3320fd907137c2c236312c72e6a40987ba397
MD5 9443f64d2422e71148e0d2f2407e2163
SHA1 1b849984c5d8a98ff7cfd3c7fb323b51328ce95f
SHA512 d87551503df21867a96d65f6b0807882c24c57a8aac88ac6f02a836a0b40764a1b2d54e4cbbe7e8396f939d353ca1e59fe0052a8e5daed6a0484f1ac68337e5d
SSDEEP 192:sxZVRZni/f3sbW9IdpJHW6+WNGYrDLSIg5TJ:sxZVni/f3sa+JHbGhb
TLSH
T1E222B652AE28B57B8CC7E20DBA59BF13E6F9503251951E48AAFCC71C05E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e25328e375b03f05b341bc4bbdfb53ce871e59735a866981b5650a623cde2ae3
MD5 4368ee38d77d9a872e5a4f23c35733fa
SHA1 49443309a1924a91e77dd1bb146217872e0d7bdf
SHA512 3aa0511af94e7b5670a1d2cb04d4df802acacaa90209fd71f04bfd94832c0b94cf94e4a02ea06a9f49b2f49f91d718dd0621ad72682e29b5bae6f1a954e5ba3a
SSDEEP 768:Fyy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb+roRrE:Fyy4J/DWvbtBhu1jajiLm0bVVE
TLSH
T1F6C20A3F684CCA7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cb1668df58f0c5b1691025eb7b2c85b1848d5fa402d7b67ffca0f8ec37a3c882
MD5 bd2c71b50374f69227a4d8f45572f606
SHA1 d54d614c34999a938f48655e771139076748da14
SHA512 09528251ffdf6bffaf27b2ef912c1862ca7ceb0efb2503806c887dc49357c9e0016504f2df312f2abdd80e036f212f506268846f0379ff740bac7dd20eb48be6
SSDEEP 48:KIDI1Ks04jyLLuvL1t7cIPKhGkzy9RIJKasUk:KIDCKs0+5cgKhGCGRKKasD
TLSH
T172913E5674BA0245387D2A5C81F0966E12423673312EEB6B7BFD44A14E27F0A1EFC6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b1c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b1c2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ba97bfd6d16d33ed069d2db5fdb5a690b68ad7955a127f6e7750227dbdcec699
MD5 8d287113906d06bf5e58ce368450eab3
SHA1 bb9fa8942e453d32514b4841280b0216af00b15b
SHA512 8bbe556181577d6598cc8a0d1010a014a5bfb0540e347acc8c8372565f8cee36a0be3b6b35c52a06c1758239c383c5a2c4d1bccdd20299242f32f0af740810e7
SSDEEP 384:QZcIdsNi0bjzZr+THX58E9O/J5r5xuvzxV+MhdpMoc:udSs7a6O/J5V4184pMr
TLSH
T18C827D31A968BC775DF6A145F88A32039FB89067E6C95FD0C1ECAB1D04DA369131BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 42093946c7a1256959c2806c52ffa725d898a009a18091cc257d9cee0b5e8de3
MD5 b6fb6d493d609fdcaed99160b5241048
SHA1 811f66395eb2f30c94e2659ab662336c8c222672
SHA512 a1750ce5d3fbe583eb99cc4ead7a70c8004f77e7b77ff7b30af13bb7cbf4baf4ed22e184719dd6b907ded8089eabd11824221f7bc2ebb11ef63ec626bdde8cbc
SSDEEP 384:PiFpZcI2UrsN68TUNTUlIlFbjzZr+THX58E9O/JXZr5xuvzxV+MhdpMoc:aFh2cDwgfs7a6O/JJV4184pMr
TLSH
T1E6A25C329D98ED7B6DFA9645F94A3203CFB480A7D5C9AE90D2DCAE1D00DB299130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 13871fc75aff5efc3b43e1e8d32be597712d9caf54e63b6d08821c92ed7cee07
MD5 f8ffb943543185778b4616f5f15cfd0f
SHA1 219672a474585f344971469a09cf3673162062c0
SHA512 88f43ae0d2e630a149f789fcaf254c2acdeeeb81634628620ee0d6a6352c43109a0f2c1406585fe476f31d76b94bfa2d9c3cd4d410845a87ae14b9b4222bbb7f
SSDEEP 192:1ONr6wlDgQmiUyooW4X58gZ9OK8tDl1XhU6:1ONr6kg0W4X58E9O/jrU6
TLSH
T14602E934F9687C7B9EF6AE09F58727139FA5206BE6852F80C6E81A1D01D765C1307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6e1742f6c2c22233c5a6642b65a6d47d0f0820a7843a9134b41ce4652bdcfaff
MD5 533ad1b3868846e43a3b9a05147ab0d9
SHA1 d5987c0c3008af19a95ba35cbbac4fa99de7fef4
SHA512 5222cb483ed4a6a5220472e6458d729443c524e1b02255e4b88bffd7f5da429246ac19d91ac97d352de3ef915c87617ba3c0909e69607870a509701a9e930577
SSDEEP 384:CZcIdsNiFbjzZr+THX58E9O/J5r5xuvzxV+MhdpMoc:wdLs7a6O/J5V4184pMr
TLSH
T196827D31A968BC775DF6A145F88A32039FB89067E6C95FD0C1ECAB1D04DA369131BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4899996e522ce6ec892e66deae804a43e2e355e62e8b4976fac0686be3757618
MD5 6c78f71b5e7744975a1071b7cc68ef5a
SHA1 accf8edd18c30be739bba28f2d66877a664a3ff3
SHA512 ffe547ce41b954a123d08e40fb0def232e0387bb8378cbf0313e995eb073b11bdac12852aed0019c9bd336b44a8cd5546b7c6555663455f5e0ffcc3194e156ac
SSDEEP 192:1OND6wlDPQmiUyFoB4X58gZ9OK8JjveV/N5U6:1OND6kRrB4X58E9O/Jir5U6
TLSH
T1CB12F835F9A8BC2B5EE2A544F48731039FB5516BE78A6F90D2DC2A1C05DF65C130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9df7eabd-ca6a-4cd9-9dda-c56ae2ef7cba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9df7eabd-ca6a-4cd9-9dda-c56ae2ef7cba.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 99756ac36ceb9c9f9c448a2aad1b16b2c64e4aa9b9d898e4191de7d3d0ea7a76
MD5 02cf19ec92d31bb9f5fb8d5135e6438f
SHA1 ee26642beea2cd45762b35f68e1c7768fe4030d7
SHA512 bc8f07fe114b84078030063027f1eb914b9d2b91b14ab0b25a8312fff57bb500f31f93c0599162fc3e0794badcd83219191e8223314294d74aae805a71851858
TLSH
T16A412858B6FD1048B3B77F56ABF6A86D447FB9772E1AD19E10010E4E0A23B40D86173B
MD5 SHA1 SHA512 TLSH

Submit Download

AutoFarmUi_SourceCode.rar

Path C:\Users\Admin\Downloads\AutoFarmUi_SourceCode.rar
Size 724KB
SHA256 b60071347471e1113ef8e9ba5fa0d72c75494c016317921015189f6ae93cee06
MD5 d7f5c789ba2ab839845ae209f5df67f0
SHA1 771c34862e491dc5de9bcabb7765bf71ad1f6d72
SHA512 3f090580e7713ca26f8f6f3b93eabac2ba734ce3dcbf8ee23016dbbda02c947047787b6ec3fb723c24f391373b8ff66a173cbb1da6d6544060dfb8ac36be08ff
SSDEEP 12288:ILO5az1eY7kND/3Bqq9Z4pmzWpprveIfCFUh0hJ970fQ8Ze6+BciNhF0u3+p/ENf:ILO5aB/74DPBnzWj2IlW7uQv6+P5Ly/0
TLSH
T115F433D22A08E1053993BF69FA02D710393DB2993D9AD8BCBF54038AA55163349F3FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.bat

Path C:\Users\Admin\Downloads\AutoFarmUi_SourceCode\build.bat
Size 2KB
SHA256 f5b3b00dfaf02097c001cf832ebceda01715ec0cdfe54eec1cea36c0f48a8848
MD5 9e700a60c799fe0fe1659627451be262
SHA1 41e4687d897b380b64d7d96b09a67e655c1c08d8
SHA512 7cac41da4c82d4cc576028d84171378203ec61c97329c40c4f041c37b192d36b1f7cfba7a243425caad3b0ed34eaba731dae24ff9a2e304cf7ddcc40aeab8e5d
TLSH
T12751D0583114C01B0AF19B6547B48293EA6C91DB0F705DF4B417F6B81B3239336FAA8A
MD5 SHA1 SHA512 TLSH

Submit Download

icon.ico

Path C:\Users\Admin\Downloads\AutoFarmUi_SourceCode\icon.ico
Size 3KB
SHA256 9e1877296c1c57b7aaa04219c1d8439d13ec9e99e8259b98b9a1ecf8d502ff7a
MD5 d62ff87f9d5f38a490a17ee3c18cd019
SHA1 5b4b41f44924de55e1ceba27da11ba47c91f7d8c
SHA512 d6195300f9a6d4b327a263004a3771c4e2a3b0e03a1fc06d9a8d33b8871a7d5e27bbd9974e05cdb53f8ee432852d25f9a3730a6ec09fd62a52a4332a876327ec
TLSH
T15171995FE57AC308D704747E1A58D0A73AA10D5A8B12EF61736B8E837C46F46F280331
MD5 SHA1 SHA512 TLSH

Submit Download