1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
Size

896KB
MD5

672b62133dec4544a19df0748c8257da
SHA1

31f0083b225370603162aaec9fcb08875ecefe1f
SHA256

1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35
SHA512

5b11ae418dc18422d378f455b23308023d69e0dfea0ac5fe994aecbcd502cba12233c6ac706da723c86b730ff9750a8d85be42f838c0349f5a0132d3ae638e03
SSDEEP

12288:UqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT4:UqDEvCTbMWu7rQYlBQcBiT6rprG8as4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2756	msedge.exe
2756	msedge.exe
2272	identity_helper.exe
2272	identity_helper.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
2756	msedge.exe
2756	msedge.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
2756	msedge.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2756	4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe	84
PID 4816 wrote to memory of 2756	4816	1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe	84
PID 2756 wrote to memory of 3364	2756	msedge.exe	85
PID 2756 wrote to memory of 3364	2756	msedge.exe	85
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 856	2756	msedge.exe	86
PID 2756 wrote to memory of 2348	2756	msedge.exe	87
PID 2756 wrote to memory of 2348	2756	msedge.exe	87
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88
PID 2756 wrote to memory of 2156	2756	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe
"C:\Users\Admin\AppData\Local\Temp\1a4f5d15897e0b1180c41bb36a28b866c39ae00252d3b9771fc16eae9644fa35.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd183e46f8,0x7ffd183e4708,0x7ffd183e4718
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
    3⤵
    PID:184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7200 /prefetch:8
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9726566869382632353,9418675138742070139,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
9b46644e1c898ea583131b23efcef984

SHA1
ac49e30221520af4d8411380036b88621a82aa9b

SHA256
72a94ca67e34b2e53d3bf4c7fd501d854455b1d0941a060df304c6dbfea57fbb

SHA512
792fe85033076f989a5495b9ba53024f50e8d9b6f85ed1747d3a9965289a9e6772f5aa0333d8a4807f0b169c2304e4194371293e83cf2445a603d067d8fb8a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
8ed98774027bc909c32c73170764bd84

SHA1
0c58a576eb535343dd8535564f2b8539a51886bc

SHA256
82335b012f37f39444fa9526fec5c27ed1bdd35ee9762d2a5fb6a4866aed2d21

SHA512
0c27b6c2835317b29135dbcddbcc12459758a20f7436795f3506d6ccc1a4cb854932d380a46a03e9c0b912faaf339238ed8cd6c03a0ed8b1f39bbb008d32f7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
36b471084abdc413bd999280e04b08b1

SHA1
9a706f12a1f27b7ddbbbe698b5f21d2562fa4b67

SHA256
80a2e88c24a878dd89bc1e4a6e41d504d8cb7042d5e127251ecc2ce398383689

SHA512
8e3c0c93f5af217434ec61e6b71b3e31323b323bad9db6fc0a58f7fd2c9f5ca24f20835bc4f36f4dbfd5782b11d129b333690804d742980bf32de49ad09ccc89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
37d41f821fdc09f9f5a0e6530fefdbf6

SHA1
e5ae193424d9e692f77afd4acec349baf780e981

SHA256
e3235e8a10317bea7a3b40d592512702f8bc7be27e37d878d1eba20a05e150ab

SHA512
a8cef698dbd8e665e1e991f7646390e66afcf40e8c0457f973dba45e8c8cbe186dad7e2e1e719a2a20c99e2550dcb46c1c49ca00cb5c6e9eec292067cdf49bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
cb41e5ba9a5d75ce194b5dc0dbd6bb7c

SHA1
eab702cd327fef25f1083faf2944992be70a2484

SHA256
0b25d4a26ba6a5df4a479ebea09d91a464a38be91c424cf561407932799090d2

SHA512
ed0cf5234abfe511d39e5ef7760e5300b3d8a816e7720e6f60d06c987b4746cd9d525fcfd9010e1ab0e954aacb82c30592666ee44252be3a44bd1023c478605d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
6a6b8fefb4fa555c125a764ce2f94048

SHA1
93034a6d916215d69e96edaab478deb95632043c

SHA256
e76d9baa504d37fda35a5bf84277b22f3dcdc06299c3037d911d5831397e8a72

SHA512
456ac18a11ab0cc9a8b4495de36761e326d0a1eb56ccc2329acdb98fadcd37352221632d8d3f4dd87d1c8afa3aa67ea1237d5dd8bc3cb13b414e820fdb2d5018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57d8eb.TMP

Filesize
4KB

MD5
6633a9470791889182e738145c294135

SHA1
13159472651fd4a03d511baf73b00750b6935d1a

SHA256
000b811aaa3b9bbb9480d08756616daab2df050257b031e70b1e8b0ca871a30d

SHA512
d9450bc6951214948f664e14ae6e02cdea36f4da8480c020495e6f272a753494c78c84dce54c945c7f7b8f2b35eee5b63b4cc687b7b613fdd68f597bfcdcfc79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
24KB

MD5
5f8a011f88b4ecb10613a5255388ab44

SHA1
eea8d7b22dfedd79be7a4eb25ff6245d859e5288

SHA256
0ed2676161655a3f3220f23fc4da2b25c0168860668b6d8eaa0b3a3e63cad8b7

SHA512
24220d3211b525fbfb0e3d6db6fd11946768e00bfbaa84e4728edb735e27b33bf8a3918d619cff1c5fc3013cde3ed86b8159059269c983736b2c33ba1244a135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe580308.TMP

Filesize
24KB

MD5
78088597267ac34644377d44fe5c0b29

SHA1
9091149384a0d21fe903e79d7c15d987b8704183

SHA256
58022bcd00ea86fd34a4f2e0d2580be7be96dc5e8c3d2318a305c928194af4bf

SHA512
38bd4a8667a5cfeec735d09fd33add755703ec247cec5cbafe0ef2f5a62f0799a9fe09af0721e4605fb0576e394ceaeab844b49b3ab4d0d65247bb5a2ba187bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\af6d079f-f294-45c4-b5bd-85df54b2faa0.tmp

Filesize
9KB

MD5
e35be3dfc2542bf6056139d44bee8331

SHA1
181ec16349b911fdedfa7877004f14653c857012

SHA256
6caec4a9a337ff8d477212617c524cd0ecb814cdb7ef4bba7671910dbc7520bb

SHA512
a7f5dc373575726f6696012658cc9ed327945d6ec89a543555263510850e219d7e076a79bdbc53f3b741cf700f2879f1bac3dff3f1c1be29460eb79f197fc998

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

Filesize
1KB

MD5
d6258be31fc2e17747900ab553fe84d8

SHA1
e955f5ea12b76e8eb5be7860ab860e654d85f28b

SHA256
72605b30cd32d77e165eafb1f5d9c15f331741a48c8829c0f7e8bbca1914190b

SHA512
f9f0d930c718c3235a9373033bbf648e1bc1d1ba18744522d7ba55fd0627787795cd3fd1581c9e21d38e23afc1551604a2e12b38e3ca1d83ac5ad41d94c8488f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J8YPISFM4LKFXNU54DHO.temp

Filesize
3KB

MD5
eaae3266f832807e4b9b7c2e92ec5399

SHA1
66461b100df01a4be1fb49dc22f2f6c0dc4a86e2

SHA256
7c663f2c517c45b63e5435722cf6f0a97155918aa67ca65aaf6748794d75d57e

SHA512
c94c311bef2649986e64bdad6459c5944afc27ef5919d623ddf53159ab2a58bd33d8f016428e5bb689086b70b1a7c6d537529e7812369c1d86bc2e91b42ac02a

Download Submit