1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1

Resubmissions

02/11/2026, 01:33

261102-byzeragv6p5

02/11/2026, 00:53

261102-a85h3ses7v6

Analysis

user interaction
yes
max time kernel
146s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker.exe
Size 1.1MB
Sample261102-byzeragv6p
SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
MD5 913a423f66aa1c41e374e21a911a3c20
SHA1 449df612d0f02e868992faabfbf4d5d37c727936
SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
TLSH
T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4812	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1568	WINWORD.EXE
1568	WINWORD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3124	AutoClicker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5700	OpenWith.exe
2160	OpenWith.exe
452	OpenWith.exe
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe
3124	AutoClicker.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 5080	3124	AutoClicker.exe	99
PID 5080 wrote to memory of 6000	5080	msedge.exe	100
PID 5080 wrote to memory of 4812	5080	msedge.exe	102
PID 5080 wrote to memory of 52	5080	msedge.exe	104
PID 5080 wrote to memory of 52	5080	msedge.exe	104
PID 5080 wrote to memory of 2008	5080	msedge.exe	121
PID 5080 wrote to memory of 2008	5080	msedge.exe	121
PID 5080 wrote to memory of 2008	5080	msedge.exe	121
PID 5080 wrote to memory of 4276	5080	msedge.exe	106
PID 5080 wrote to memory of 4276	5080	msedge.exe	106
PID 5080 wrote to memory of 4276	5080	msedge.exe	106
PID 5080 wrote to memory of 2032	5080	msedge.exe	103
PID 5080 wrote to memory of 2032	5080	msedge.exe	103
PID 5080 wrote to memory of 2032	5080	msedge.exe	103
PID 5080 wrote to memory of 5204	5080	msedge.exe	107
PID 5080 wrote to memory of 5204	5080	msedge.exe	107
PID 5080 wrote to memory of 5204	5080	msedge.exe	107
PID 5080 wrote to memory of 2708	5080	msedge.exe	108
PID 5080 wrote to memory of 2708	5080	msedge.exe	108
PID 5080 wrote to memory of 2708	5080	msedge.exe	108
PID 5080 wrote to memory of 1852	5080	msedge.exe	110
PID 5080 wrote to memory of 1852	5080	msedge.exe	110
PID 5080 wrote to memory of 1852	5080	msedge.exe	110
PID 5080 wrote to memory of 3132	5080	msedge.exe	111
PID 5080 wrote to memory of 3132	5080	msedge.exe	111
PID 5080 wrote to memory of 5016	5080	msedge.exe	112
PID 5080 wrote to memory of 2308	5080	msedge.exe	113
PID 5080 wrote to memory of 5016	5080	msedge.exe	112
PID 5080 wrote to memory of 2308	5080	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.remouse.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffaa6bdc188,0x7ffaa6bdc194,0x7ffaa6bdc1a0
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,13774126132384436927,9109072534873765883,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2012,i,17678788974173499499,14479538059613396754,262144 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:2
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,7333059962328830762,6920492806782068100,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
    3⤵
    PID:52
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11574640492444589207,14142199693230704210,2097152 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3714521464728533384,11947547948063401554,2097152 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,15527233013908347068,15830820897020058041,2097152 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,17188500504118135033,8274503770790981109,2097152 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5192,i,3871780690415746017,15924430716770632288,2097152 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3392,i,8569469840053075852,4667105955115407791,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,3065673496220404423,7972772821925218708,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13292728025573772775,2089392865533884324,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,4006992549930406424,11028013362057722845,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,4006992549930406424,11028013362057722845,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,11076988242921508366,8280869499922489551,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,13626904051981181670,9902018373998042955,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,762464683244650036,6066953721225383472,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,4728539796498458614,11027505994050145419,524288 --field-trial-handle=3040,i,13657675962857767819,2162220423603505993,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
    3⤵
    PID:828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:452

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\RenameExport.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\RenameExport.rtf" /o ""
1⤵
PID:5196

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\RenameExport.rtf" /o ""
1⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4768d82b-fe2a-48d0-b457-084caf3593c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4768d82b-fe2a-48d0-b457-084caf3593c8.tmp
Size 34KB
SHA256 547aec0a8af44435b491cb7b121e5323fc19aeee385e8ec9b21b2c969232deab
MD5 ebd91cfe4dfc55e806177f6dab695f90
SHA1 5b704b8bee3df97d5d4c09c82d7517ac8f9f19e9
SHA512 ea0d530ee1bde107f02ced8d9b0efdf7939ff5039049c38134e2789f66b5ac0caef25c7b169e1485847b5167bee825eafc55ad2d8876df8dab104b3c0350c65e
SSDEEP 768:Uy3hvlKnJtxDc9bsMSJz/Fn/qE75ErrLx:Uy3hEnVQbs7JT4kI9
TLSH
T114F2CFB5AC515D938DE7A740768A3A93BFF44953C8C91E84D9CA9E1C01C739D334B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adafec42-f287-47f6-bbab-206767637ab1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\adafec42-f287-47f6-bbab-206767637ab1.tmp
Size 105KB
SHA256 1d62e22dec5c299be491cb2f809a917a5b2650bcf6f26d1655b204a91c995427
MD5 a1423f7d471bb13fff5ecfcdaea6454c
SHA1 7ded49e29e2ee4ecada313702dc82cddf87e8600
SHA512 6e90c834830dc60cf4e69d47a842a672355eeac4f32e8a0122d66df5ce75da4ac71274dc3cb208dbb06f3cd4f506485158442b7832ede2cf24ef8c5b26c1705b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T119B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

09d05d89-8447-4bde-9bc8-5e327a65b249.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09d05d89-8447-4bde-9bc8-5e327a65b249.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6fc744dd-5bb4-48ea-bada-8856c80253f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6fc744dd-5bb4-48ea-bada-8856c80253f6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2cb83ea-12fd-4da5-ac6e-923f752d6eac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b2cb83ea-12fd-4da5-ac6e-923f752d6eac.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

d0a5f08b-60d9-4768-966e-853c2f2139ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0a5f08b-60d9-4768-966e-853c2f2139ae.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4394b42474bee078115dba8e5d5bf846e5830c20691c320c1cfe5fdaa76dbac4
MD5 246b47b0c36eee83051209c1f7f250e1
SHA1 79e34e3b4f9c917c6c4c11b8d4dc91936957902c
SHA512 85fa35b15e9181ca27acb751fc2dd2eea7be6ee3c034c078552283da24b744616b959ad8f69c671e380ed531c2ba50310903170618377bd19b985a0a78846bd1
SSDEEP 48:K8CI/KfqUfyZIIbKtCchLIlKssgzyJWInKnKcJ:K8CoKfqWaIAKtCuLiKsseqWAKnKW
TLSH
T141B1372470270A303A7E750C72E4999A468231A33024E57F3BFE85A25E7BE191DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1d55fef-1621-4cd7-b84f-4d3a157c81fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1d55fef-1621-4cd7-b84f-4d3a157c81fd.tmp
Size 38KB
SHA256 08e056a45ca5574869bf5c8c883a85a8a8111eb1d21909b3b8771bb53848e18d
MD5 d0883cdae80918009edca1764e76bdd0
SHA1 f31f7ce9c41377e0e44b333cfd80aa8980dcb653
SHA512 a45bb08121ddd50429a8684522c3545c54cb5453882a70d2e86d74ff7bc73397ccaad5ff06fb645ba799674233a08879168eccc30588ee899968471a09197025
SSDEEP 768:+/UxvxjgC+U3gTKnJNxDc9bsMSJz/FnGqSHXPyK/:zZj3+U35PVQbs7JTvSb/
TLSH
T19403C079EC515C53CDE76640398BA787BFF419A3C8C52D9899DEAE0C06C73AC1347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6d2fadf-bf12-47b9-8132-10d78d54970e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c6d2fadf-bf12-47b9-8132-10d78d54970e.tmp
Size 37KB
SHA256 e42489917530788427a9418b20a724e0740c8eba9ffa448816c2125b37210fd9
MD5 b0b574098d6e404c9fc16f835baf222b
SHA1 19e2b8ae6b3373366de0a9f93c05c3cb23a0272f
SHA512 e82ba17968de0a12912f2abde4d7288e7b8ec3b35acf776840de309afbab9f5d88ccd8014d24ca86722a1f6a99f52b72e574a2ee0dd46cfef2d4db1e600800ed
SSDEEP 768:z/UxvxjgC+U3f9KnJ7xDc9bsMSJz/FnnASHXPyK/:GZj3+U3sVVQbs7JTySb/
TLSH
T15C03C03AEC5058A7CDE767803A8AA757BFF84953C5C52A9845DE6E0D07C73AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bbbe2a3-448a-4284-8517-8f8ab2475be3.tmp

Path C:\Users\Admin\AppData\Local\Temp\6bbbe2a3-448a-4284-8517-8f8ab2475be3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACA_conf.ini

Path C:\Users\Admin\AppData\Local\Temp\ACLib\ACA_conf.ini
Size 25B
SHA256 07a80a2eb85138c1ebb7a1d21f5456e59b650cfaf4e03bad027734c2ec82e214
MD5 263ec697ad2a5bb02eef689c75518acc
SHA1 457f4cf95a4f80785e063adb0e508e630283ce29
SHA512 066c604ae91f80daffc2d8bc442006fa94b4a1e8158bf4b7743982ec350ac42a437c2ae2a3997dd728ea6ca7099ff426313d068d55b816a451ae69f51580087f
MD5 SHA1 SHA512

Submit Download

playback.ico

Path C:\Users\Admin\AppData\Local\Temp\ACLib\playback.ico
Size 4KB
SHA256 5375290e66a20bff81fb4d80346756f2d442184789681297cd1b84446a3fe80d
MD5 a20254ea7f9ef810c1681fa314edaa28
SHA1 fdd3040411043fa1d93efd4298db8668458b6fb8
SHA512 4c52a7f77930e6f1bfaa1fee7e39133f74675a8666902c71be752758a29d8d167157e34f89f729ab29855990bc41757a11031adc7560c4d6b9cd77000bbcf87c
SSDEEP 24:suY3ByPA9DWC431S75OSoTaQHDOB07Qq9+EmMj4ASx4:+RyPjCk1S1OSTQjOB07QqgEm+4A
TLSH
T11C91A9838B982B6CC7C071F95040B99E46230E4E5DE41633E7B0F74AA275CB3DD196AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

record.ico

Path C:\Users\Admin\AppData\Local\Temp\ACLib\record.ico
Size 4KB
SHA256 59d5e9106e907fa61a560294a51c14abcde024fdd690e41a7f4d6c88db7287a6
MD5 1111e06679f96ff28c1e229b06ce7b41
SHA1 9fe5a6c6014b561060a640d0db02a303a35b8832
SHA512 077aff77bbf827b9920cf53dff38427475e590c07ab8901fc34ce7b7fb9e9409207e53aff06fa7d1e3984bcf127507d0fc19284d8e7203c76d67c9b98c1c8f37
SSDEEP 48:+8Zjqe+hlcUmCmXGyGC0Uh/2Zr4gvtfyocfR1/mrlR:54Fchp0CuZv44L
TLSH
T1DC915064A259FD4AC205B0F83070D2BCD6AB8ED05A590A903D783F784D798A7CEB621C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stop.ico

Path C:\Users\Admin\AppData\Local\Temp\ACLib\stop.ico
Size 4KB
SHA256 9e869f60ea0a0de06c7d562ff56d1ac53c534849c919e4b12344e73513649483
MD5 7824cefad2522be614ae5b7bdbf88339
SHA1 a0de5c71ac3cd42ca19ee2e4658d95b3f9082c60
SHA512 6d377731bbda34f1875cd14e8ee896c9b8cb0aeb4133a5bc5ff460138b8b3a1b6647d3869b14a9f6949601fa37694bc38c764bf660fd877033296d9ccb0b6342
SSDEEP 12:suYNoooooooooooooooooXHHHHHHHHHHHHHHHHHIooooooooooooooooo:suY
TLSH
T1569105423200EA88C1483AF40C06CAF60249BC118E2412223CF57F4F3FB2087CC2724C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e31e0028-285a-4fff-94eb-2b287fafbc4b.tmp

Path C:\Users\Admin\AppData\Local\Temp\e31e0028-285a-4fff-94eb-2b287fafbc4b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5080_1086523558\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5080_503103336\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1568-10-0x00007FFA87820000-0x00007FFA87830000-memory.dmp

Download

memory/1568-7-0x00007FFA87820000-0x00007FFA87830000-memory.dmp

Download

memory/1568-13-0x00007FFA85200000-0x00007FFA85210000-memory.dmp

Download

memory/1568-12-0x00007FFA85200000-0x00007FFA85210000-memory.dmp

Download

memory/1568-11-0x00007FFA87820000-0x00007FFA87830000-memory.dmp

Download

memory/1568-8-0x00007FFA87820000-0x00007FFA87830000-memory.dmp

Download

memory/1568-9-0x00007FFA87820000-0x00007FFA87830000-memory.dmp

Download

memory/5196-21-0x00007FFA87820000-0x00007FFA87830000-memory.dmp

Download

memory/5196-23-0x00007FFA87820000-0x00007FFA87830000-memory.dmp

Download

memory/5196-22-0x00007FFA87820000-0x00007FFA87830000-memory.dmp

Download

memory/5196-20-0x00007FFA87820000-0x00007FFA87830000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads