cd6ba78ea24a28b76160d343d46cfb16df91b123afd9bde2ad234cccd8d82083

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker-3.1.1.exe
Size 857KB
Sample260628-skleeahy2y
SHA256 cd6ba78ea24a28b76160d343d46cfb16df91b123afd9bde2ad234cccd8d82083
MD5 9b2946bb3d8ae8d01f3d64fc6dee2c9e
SHA1 a62be821aeb5667d445fc6710018b3cdce66e417
SHA512 6902a54b75729625b6b7f079e1d40311e051e644607ab5eb6137f1bb4249f13ee68055b172bef200ed600d7c0988d1a747df3d271848fb7b66e1d83ac57dc55e
SSDEEP 12288:vaWzgMg7v3qnCiMErQohh0F4HCJ8lny8QWMZorOBC3AbDYP:yaHMv6CYrjzny8QWxiiAfYP
TLSH
T11B15AE12B6D640B1DF9639F01937E316AB356D196222CE8797F03E628E31183DE2635F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_356026732\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1882567271\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1882567271\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_356026732\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoClicker-3.1.1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4496	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271331168160194"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3839916939-1319118069-2256772647-1000\{E630BF5F-3D1E-4E47-B3A7-530B180D215D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6840	mspaint.exe
6840	mspaint.exe
4776	mspaint.exe
4776	mspaint.exe
5464	mspaint.exe
5464	mspaint.exe
6004	mspaint.exe
6004	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5912	AutoClicker-3.1.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1560	OpenWith.exe
4820	OpenWith.exe
5348	OpenWith.exe
6840	mspaint.exe
6840	mspaint.exe
6840	mspaint.exe
6840	mspaint.exe
4776	mspaint.exe
4776	mspaint.exe
4776	mspaint.exe
4776	mspaint.exe
5464	mspaint.exe
5464	mspaint.exe
5464	mspaint.exe
5464	mspaint.exe
6004	mspaint.exe
6004	mspaint.exe
6004	mspaint.exe
6004	mspaint.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2484	2004	msedge.exe	106
PID 2004 wrote to memory of 4496	2004	msedge.exe	107
PID 2004 wrote to memory of 1152	2004	msedge.exe	108
PID 2004 wrote to memory of 1152	2004	msedge.exe	108
PID 2004 wrote to memory of 1152	2004	msedge.exe	108
PID 2004 wrote to memory of 6704	2004	msedge.exe	109
PID 2004 wrote to memory of 6704	2004	msedge.exe	109
PID 2004 wrote to memory of 6936	2004	msedge.exe	112
PID 2004 wrote to memory of 6672	2004	msedge.exe	113
PID 2004 wrote to memory of 6936	2004	msedge.exe	112
PID 2004 wrote to memory of 6936	2004	msedge.exe	112
PID 2004 wrote to memory of 6672	2004	msedge.exe	113
PID 2004 wrote to memory of 6672	2004	msedge.exe	113
PID 2004 wrote to memory of 2084	2004	msedge.exe	114
PID 2004 wrote to memory of 2084	2004	msedge.exe	114
PID 2004 wrote to memory of 2084	2004	msedge.exe	114
PID 2004 wrote to memory of 3156	2004	msedge.exe	116
PID 2004 wrote to memory of 3436	2004	msedge.exe	117
PID 2004 wrote to memory of 3156	2004	msedge.exe	116
PID 2004 wrote to memory of 3156	2004	msedge.exe	116
PID 2004 wrote to memory of 3436	2004	msedge.exe	117
PID 2004 wrote to memory of 3436	2004	msedge.exe	117
PID 2004 wrote to memory of 2524	2004	msedge.exe	118
PID 2004 wrote to memory of 2524	2004	msedge.exe	118
PID 2004 wrote to memory of 2964	2004	msedge.exe	119
PID 2004 wrote to memory of 2964	2004	msedge.exe	119
PID 2004 wrote to memory of 6896	2004	msedge.exe	121
PID 2004 wrote to memory of 5848	2004	msedge.exe	124
PID 2004 wrote to memory of 3776	2004	msedge.exe	125
PID 2004 wrote to memory of 4852	2004	msedge.exe	126
PID 2004 wrote to memory of 3112	2004	msedge.exe	127
PID 2004 wrote to memory of 3112	2004	msedge.exe	127
PID 2004 wrote to memory of 3976	2004	msedge.exe	130
PID 2004 wrote to memory of 3976	2004	msedge.exe	130
PID 2004 wrote to memory of 6296	2004	msedge.exe	131
PID 2004 wrote to memory of 6296	2004	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.1.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:5912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5348

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ExpandWait.jpeg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:6372

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ExpandWait.jpeg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4776

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ExpandWait.jpeg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5464

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ExpandWait.jpeg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RestoreWrite.mhtml
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x2d4,0x7fff0c46c188,0x7fff0c46c194,0x7fff0c46c1a0
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,9869739272483627043,5505907075605685411,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,10638846615373453337,2897184918891697169,262144 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,6567271946194589014,13764545618115741494,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:13
  2⤵
  PID:6704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,15578573335722268638,4300201015698938025,2097152 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:6936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,15673694886273056901,6804115675003187913,2097152 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:6672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4812,i,17506219008648157110,12231608769357774175,2097152 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5132,i,16733974977831537886,15053418266333324489,2097152 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5228,i,645243283208331542,14329445754086071835,2097152 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,2953237474209094910,8348545684696320162,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:14
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,18351527525450671099,10719407213316408823,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,4018685550285598063,6941021623521490015,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:6224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,4018685550285598063,6941021623521490015,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:6896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2049703092470703214,8542002906284863706,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,17321208428653953192,12166876300603694172,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,13579504797681240723,2455600678099586712,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,7425984182273387801,11866795810558145202,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:14
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,18253974406041791525,388167456467406954,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:14
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,18221060691148060788,14697020312555530869,524288 --field-trial-handle=2276,i,14870707388514928504,259850661641627843,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:6296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RestoreWrite.mhtml
1⤵
PID:6748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f955c8d6f1a1a3190d5e321035e28ca582fcb76ec2f60d653e90465ff9d1ea00
MD5 0213e77255f07e9c3fc2c451f7a980eb
SHA1 a625e805f5575150fe89058ebdc7b3356ff294ad
SHA512 94f5a80a660d01988274953f2dc96b3f630595c4d1011e0137458475b3b6bda55410996e5d95fff27f7dfa7d3bf4ad111036266eb70344bc4183986e8f524b78
TLSH
T1BBD080277919E851C05611315C39C7795619414B3EE5C20F75D5E04ED8D645063D7547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83748c5f59c12f467f96b0d21c3c9653419dfd0271c8efbdeebbd6ba4bd7548e
MD5 96bfca4318642edfa521d002be0f096d
SHA1 447f1b34ddedc860a8f0bd0c6dc12c229624acab
SHA512 b49889400d8441bd0f61eebe0a2489d48e83671a4d77bfdef519545878aebce5aa04d5e498b1e16dc02fc2a5990edce5232840f2805bd3cf047ef33c92fa70f4
TLSH
T112D080277919E851C0561171583DC779561941473EE6C20F79D5F04ED8D645073D7543
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 39a199e279f0ce8190fd1b4db37bd2c04f6aadd483e14f82668b57f3f0d50c9b
MD5 197042d413ef475d83adf8b3ac08ddd8
SHA1 bfed55bd2d9b6313f1887c63a4e46fc1f4e14ce6
SHA512 db58f2e37a49ca54b8a2bd3ad1e2f0b1d025a6eeb5944f28ae6b8f84d6fd15865ecf9adaa36e3bd4043319dbb6f461ad1b714c7dfbd11a760b4099ddbaa11aa7
TLSH
T1A4F028AAC921AC3708FC0B2834A45F8BEB5113672740895F3B3D460D8FB5A7F474681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ec6dbe0a9ac15f5b6d034022b797cff6e232fd2529481248741bed9df68154ef
MD5 309b572d3eae7330d0a5270a6615ba96
SHA1 8134fb7c51d6665f3a2d9ecdc925ecaa02078aa4
SHA512 48103bb769775df4eb196cddf818349c0d95dff646b9a05a5f1175b2264662d7a02ff7889b8bbbc92ab205696b2bdabcec0a02291bcea3334b5f9121fc0c9a02
TLSH
T12E518CF387E4856D8A0195F0A718AE2BDE1D0914832C3D5A89E4AF5BD3E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 977c3f99e39d586394f387326e769b889c2e4a567d6c89e9a63f233f994f9bfc
MD5 126c8f0c36355154a5ce1083d53757a1
SHA1 38da6e0a1989ee4b32d5c97cffb2f358a8584b92
SHA512 5a0324460b045781cb93241472b247c0146fa6a7b02f796c34c333bc1478adc67b62eb7ddd2b3153f202275dc433e6547b25a07e5d9311a06f4d69292d416eba
SSDEEP 192:sxRARoyMqZjK1Ml8wcb/fxsg2PZbTUImANzoA8ped/g6+WNIYzlU+vGuIgjBJ:sxRA5Cb/fxsg2RbgI2m/5InOjL
TLSH
T1B762EA156A34597BCCDBE219FA457F53D6F81573E2904E44AAFC8A0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8251b6c64bded74578a6c1657b6a11b1eb6040d4b0e714639bbef49711220688
MD5 6b244bdc5cdf5e39db5a800540fc14fc
SHA1 7581c2e41fdbb35267659b95430da331ce42d916
SHA512 52136873edecc50fdff96ced975dc0f77cab7dc48caf059e20a833943ab45a0af31b070605962b2678e4abde9657f36fc0679fc8f9d9de8a6110e385271e3035
SSDEEP 768:BawEPU7pLuL7IlWgfDfEN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBqYLfaDro68Inr:BawEPYE7IlWgfDfENu1jaWqYbaw68Iss
TLSH
T1A4E2EC3B680CCB7E4F444E9CEC29BE9A6DE801CF96D88D5447EA450C03C6BEB51165EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 90cc69963057918f0c0322820d6fcd0a306b7bfe630941610d01cb9b85a4a180
MD5 468881ed4c0f2b49d477d2b608f92e29
SHA1 2c683a3a769b9587312e69f47a19d1b5c52c5542
SHA512 2b415882bfd08964dc4d71946628f616f2702fc38cb4e13b7d03888cab4456ab116de1e9a0295b7fdeddf25338f71e5944e404c1bb1a72279774438cf44f8cf9
SSDEEP 384:cdYt3tEJdTHLGHaR1xBprW9d6T9bLzwJbBRrn+gI4XIj++OT48TWe7sePqZC:cdYt3tEJdTHLGHaR1xBprW9d6T9bLzwf
TLSH
T1DCB21611393E234138FE2908E1A5861F674230B3305AA63F3BBD64E61E67E015EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0e2a76ba85599bad02650aa001ff8cecf9f476a8b15b16528274266ff80b0608
MD5 cab24ec101f381490c10df947783b0ed
SHA1 85554fea52bb03a89a5929c7fbbb28a89e3262cb
SHA512 c611c74b15c6d79d81b7cc83124e275d0557b87fbb71ed1e2e13cbd2dd3079c0c6160de31b96be3e75059b56a64567ba45c64b79712f392dee0e0d83b233c0c1
SSDEEP 384:nJiF1tNn/s3n9Sg8NE8TUNTUlIRUthESusEz3P2TCfxVWNED4URWGmmn15wbAjEd:gF1j+9ZdwgeTEkAf1VWhUBmmn12bfZz
TLSH
T10BD24C72D864CE77ADE78FC9B70A764AEEE041A3C5885AD8D9D84D4D00D32DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 58831588d0b622ed804b1bb0697343effefdc9447e14de3b532a22c942abc147
MD5 26ecc346826796af009296fe6e938b88
SHA1 3d6544c888d85fd6305a9f36f51aecda252d1963
SHA512 c106dde725d2d5cc6223adaab48a5298a6d094b705628061605fa2d5a5f5d3a628ca47a8e607cc92220f6a94c24aa3bed4cd7c48ae361e241945b2b754377c81
SSDEEP 384:njiF1tNn/s3n9SM8NL8TUNTUlIRshESur2xTCfxVWNED4URkFITGT0Ic8Lk1IzKV:OF1j+9lewgIESqVWhUaFi+0VvN
TLSH
T145C24A32DC64CAABEDFA8FC9B709764BAEE001A7D1C85AD8D9D81D0D00972DD1747C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7838d811be68c434257e42d069e8572b54e7a8e65ba51d2f0233a9ee30b58cd3
MD5 d1e677eeb1f4b9a4cf8c9627d271d928
SHA1 a60055ae718fab036a34bb11864303f91d0296f9
SHA512 39906d59f75cb0a7904641827adfa3f1e4eec7b99aaa251de898d3b283a5b902c05cb9d98669da6ce026e3c2ec56c54c13d112b7ee49d31b0e2a52c7637f6f24
SSDEEP 384:nxiF1tNn/s3n9SM8NE8TUNTUlIREhESusBq3uTCfxVWNED4URW/mITGT0Ic8Lk1m:YF1j+9ldwggEk8tVWhUCmi+0WvN
TLSH
T15EC25B72DC64CEABADEA8BD5B309764BEEE001A3C4C85ED8DAD91D0D00972DD174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c7eaa6ab587e3388c828c754f89451d492349cfef602eef54d782f45bcdb9bef
MD5 921c2b1ef01b62bec7e5edcccb2041f3
SHA1 d0cdd21a7edcc929262b90fa0eb2cd854fdebd6d
SHA512 657c88a5003c79fc42a62fd6e5fdf10f141475e434eea19d7ec2f1621ed916c6d857ab9649496beb4d159e573a93402e879da894be56022946ca01444f3fbcac
SSDEEP 384:nAiF1tNn/s3n9SX8NE8TUNTUlIRUthESusQz3P2TCfxVWNED4URW/mmn15wbAjEd:bF1j+9udwgeTEkMf1VWhUCmmn12bfZz
TLSH
T141D24B32D864CEA7ADE78FC9B30A764AEEE041A3C5C85AD8D9D84E4D00D72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e54d9bca93a4a4769e1c4563b3bf73138ceb2e4ddb9b8826e79948c8433eef12
MD5 0d33eaeb91d75d9e06e29a30dbaf5cc5
SHA1 00663eff871b24dfd3d392bc605a88f41bc11f93
SHA512 15a590c296b2645671f035e0a0d96002f1b8c9d624d630afc5f387a4402b37e209aed06b71d2b85905010191260d67549b0de219dd5fc53fec0b3be33df0c7b2
TLSH
T1122120E15C3C1ED0C4ED0DFFF08B38F844D8D225F59475396898E998462DA1E258043F
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 f2e8379499e154d30b0714305a7e7473ed3bda556b4332356382aa2fcbfd1aba
MD5 905e97c7c5e8ad68a2fa74cd7aea6ff6
SHA1 fc998efa497a10c19780cc41580eefef84a67f4e
SHA512 dfe716bccdd0820a558aed77d0e00e2565a78cf37fe1a60bae87d92e692ef5fb0482b219891b0f1337b9b4aec5aef970b2b9f82d52d093507faa9164f5ffa8fd
TLSH
T19451F0D4C0812C5FDBCB310EC6D411E41B5FA9DA69E190620D7F7E85A47F149C7EB862
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 90c68bc31531e63b56c6d57ebb24f45488fc7556b3691ea69acfd8a1aa57c2d5
MD5 6c7c9209f169d3f941dbc69db8e3a1e8
SHA1 d805907c78c8ea63a6e4ffb598cc08804f18f584
SHA512 d2954863fb2aa17247fadff356df415401ba0b666964916f2c40b6bd63f4433c86c70452346275f37e6a47ca5fa30850d24011c951d83b9449409ff8db54d40c
SSDEEP 96:0QSmXS5SdMSwRS3RzojRHmS3RzojRHDBXSmXSESd3Sw5S3RzoFRHRS3RzoFRHjuA:0QSmXS5SCSwRS3RzojRGS3RzojRlXSmA
TLSH
T101A1EED4C4812C5FEBCB310EC6D410E41B9FA9DA69E250620E3F7E95A17F149C7EB862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download