Malware Analysis Report

2025-06-16 07:20

Sample ID 240602-bzgw4afa28
Target AutoClicker.exe
SHA256 2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e
Tags
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

SHA256

2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

Threat Level: Likely benign

The file AutoClicker.exe was found to be: Likely benign.

Malicious Activity Summary


AutoIT Executable

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 01:34

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 01:34

Reported

2024-06-02 01:38

Platform

win7-20240221-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"

Signatures

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe

"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 01:34

Reported

2024-06-02 01:37

Platform

win10v2004-20240508-en

Max time kernel

67s

Max time network

69s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"

Signatures

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 912 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 912 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 4872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 4872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 4184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 4184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4060 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe

"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\SubmitRemove.pot"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.remouse.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe31d446f8,0x7ffe31d44708,0x7ffe31d44718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13579118937451860568,3726002024977878238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.32.7:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 7.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 204.201.50.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 www.remouse.com udp
CA 144.217.129.142:80 www.remouse.com tcp
CA 144.217.129.142:80 www.remouse.com tcp
CA 144.217.129.142:443 www.remouse.com tcp
CA 144.217.129.142:443 www.remouse.com tcp
CA 144.217.129.142:443 www.remouse.com tcp
CA 144.217.129.142:443 www.remouse.com tcp
CA 144.217.129.142:443 www.remouse.com tcp
CA 144.217.129.142:443 www.remouse.com tcp
US 8.8.8.8:53 142.129.217.144.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp

Files

memory/2620-8-0x00007FFE0F630000-0x00007FFE0F640000-memory.dmp

memory/2620-9-0x00007FFE0F630000-0x00007FFE0F640000-memory.dmp

memory/2620-10-0x00007FFE0F630000-0x00007FFE0F640000-memory.dmp

memory/2620-11-0x00007FFE0F630000-0x00007FFE0F640000-memory.dmp

memory/2620-12-0x00007FFE0F630000-0x00007FFE0F640000-memory.dmp

memory/2620-13-0x00007FFE4F64D000-0x00007FFE4F64E000-memory.dmp

memory/2620-14-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-15-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-17-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-18-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-16-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-19-0x00007FFE0D450000-0x00007FFE0D460000-memory.dmp

memory/2620-20-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-22-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-21-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-23-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-24-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-25-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-26-0x00007FFE0D450000-0x00007FFE0D460000-memory.dmp

memory/2620-27-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-29-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-28-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/2620-54-0x00007FFE0F630000-0x00007FFE0F640000-memory.dmp

memory/2620-53-0x00007FFE0F630000-0x00007FFE0F640000-memory.dmp

memory/2620-52-0x00007FFE0F630000-0x00007FFE0F640000-memory.dmp

memory/2620-55-0x00007FFE0F630000-0x00007FFE0F640000-memory.dmp

memory/2620-56-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ACLib\record.ico

MD5 1111e06679f96ff28c1e229b06ce7b41
SHA1 9fe5a6c6014b561060a640d0db02a303a35b8832
SHA256 59d5e9106e907fa61a560294a51c14abcde024fdd690e41a7f4d6c88db7287a6
SHA512 077aff77bbf827b9920cf53dff38427475e590c07ab8901fc34ce7b7fb9e9409207e53aff06fa7d1e3984bcf127507d0fc19284d8e7203c76d67c9b98c1c8f37

C:\Users\Admin\AppData\Local\Temp\ACLib\ACA_conf.ini

MD5 9fc316cbe8318252302157d8f80269e1
SHA1 8007646ed851b7775b2b642a08c80bdc876fdcd4
SHA256 25c69f887a1fdb22fdf08bfee4d8c124df474cd9d65d26097bf4728c3158beb3
SHA512 81682312adb2647f7aa58438a0a0ec8b8d26a0fab42dea87912d1b4ae6caf4ff52326fc74df80d90917e473904f6a5eba70eb71a4cbb6a7e1d969a799d2333ac

C:\Users\Admin\AppData\Local\Temp\ACLib\playback.ico

MD5 a20254ea7f9ef810c1681fa314edaa28
SHA1 fdd3040411043fa1d93efd4298db8668458b6fb8
SHA256 5375290e66a20bff81fb4d80346756f2d442184789681297cd1b84446a3fe80d
SHA512 4c52a7f77930e6f1bfaa1fee7e39133f74675a8666902c71be752758a29d8d167157e34f89f729ab29855990bc41757a11031adc7560c4d6b9cd77000bbcf87c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_4060_WAJZAAAJFJOAOIJF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 18d9587404afce45b3e32965ef597130
SHA1 25d4bdd2cb8b66d73cea435c9718fd8b2e3944e8
SHA256 70b41916ad0cc48a17d8921771683460263ba66e8aa3d319cafea8114ea6488f
SHA512 aa0a759417ee14838fd734e95de77178c7a94e8cec32f6d382cdca21a2957e198d3b4a74ed864f9b4d48557f38747ebd63de077c1ec60deda38220e719f730e2

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

MD5 53d917f045b45e10bcc14cf019b7621c
SHA1 9c0e37f1cd786ecf164935e71a08a2bf0ec36a98
SHA256 5851729bcb75cefbd59725cbe46a2c381c5af1b8519c9da70627b237030c823a
SHA512 0def45ff3d73e4dc638b0e1dcaba068cbc27a720e1dedb454de5f1830c7c0437dfc64900de8746f0bdf283bc45592cbfd139172cf4cdd54796980277c75a5bc5

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres

MD5 6c6d11e9fa9da4a9abb4f9ae41164a7c
SHA1 49d2523f3d4074c80554972cfa4a2c8dd22ee8f2
SHA256 76438cc2de7c0471c01ace0ee500d6b873eb31a25e7f242767d8ae50219b8d5e
SHA512 2e31a00835c798b4752ea79549b44af517e4f0fb1d4ea9d3e0e1f51a5d4e954eb2c9f05e990f4c215f7670acaedb59013746275aa1bc850186673e029e1324c6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f0f28aaef3ac21f06ee4926ea96b7376
SHA1 bd30e7f8d17f6e6a4afa8abb2a84c4bf71c2c4dc
SHA256 1e666e2c22ed7fa0272133bd86b6dc1c9211d4eacf032d19443af1ff13a99db0
SHA512 4c5be844eedd03a9dc70c0f0e7e52f92a52c868c3dfc43c458dc2b6d9c3e646ee7da564a1073aa36f2d2c6eb1c4e5330e0bd40cff8415524d0bbce980ae7a3fc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5388a1827b6c08ae70c71a61420dcdc5
SHA1 a4e1b6764b39b23403e6c02ac0d22c444b2a908a
SHA256 8f6066adf2fe05b2d9d5a176850c67cce4ce7d46359111b7b4a592c3f24e49ae
SHA512 f380a5dd867a8e0308f296c3bd211b0ab0b11ea5b6756d76564cd44e79a91d47abd226faf3511e76af7a18686b8b071fd7e62fec26a616cc8c995108776e05d0