115d42fde8c0fde6ade95a36fa29db55a2ba9fb1dcd105501fc39d0b6c1bf1fd

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 896KB
Sample240823-mbyeqa1bpn
SHA256 115d42fde8c0fde6ade95a36fa29db55a2ba9fb1dcd105501fc39d0b6c1bf1fd
MD5 300bfec6e18ed712d6127c83e577657a
SHA1 844e28c788a2d9c232e330ad29558bfda47f5eb2
SHA512 1f2606f3fb0cbebe0718d6175f83476c4732179802bf44f916852ed65f8b83cbef2b6e84d4eb014655761e6eb90dba0e1f99ed1d57e238fe5339b5077ee3f247
SSDEEP 12288:UqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTU:UqDEvCTbMWu7rQYlBQcBiT6rprG8asU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
4580	msedge.exe
4580	msedge.exe
5484	identity_helper.exe
5484	identity_helper.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2372	file.exe
2372	file.exe
4580	msedge.exe
4580	msedge.exe
2372	file.exe
4580	msedge.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe
2372	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4580	2372	file.exe	84
PID 2372 wrote to memory of 4580	2372	file.exe	84
PID 4580 wrote to memory of 2660	4580	msedge.exe	85
PID 4580 wrote to memory of 2660	4580	msedge.exe	85
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 556	4580	msedge.exe	86
PID 4580 wrote to memory of 5024	4580	msedge.exe	87
PID 4580 wrote to memory of 5024	4580	msedge.exe	87
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88
PID 4580 wrote to memory of 3580	4580	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8cd7946f8,0x7ff8cd794708,0x7ff8cd794718
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
    3⤵
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3968 /prefetch:8
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3968 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,9172822509628172564,1286311420607433850,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3116 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9a226764-c1ec-48da-8ca0-c2e8a44294a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\9a226764-c1ec-48da-8ca0-c2e8a44294a7.tmp
Size 9KB
SHA256 6cfc00e0152a29d5463008f249faabd174f86db1db09d8c996b0798887bbb7f2
MD5 fc824d5559363fff749a1a81e2b6ec6e
SHA1 1e32475a66f491d514d6721b2f44b367b0304cc0
SHA512 a6cd00d148892ecd455778b0522180d18e6b351bc25d7999fac6abf0c20421408d5b29c6924284758b00543302fe40b7f83e4b156b005c4c70adc847748be4b8
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6z7+eMRUUwhzWHoxRw5Ytb:N9iIxuERzA83h09RZxY63qPwx8oqkLs+
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 d5873f23988479d96bbf7e871f9dfc9c8b791c69dba8db0542f9e5bfe9313513
MD5 99999675ccf98c928852ec408bc871e6
SHA1 82faee8fd78872eee49498aaf9f1477ab3f7b787
SHA512 48728d69056b16dc5c7bc0815a3d11ed36b1da01886b62b017748588f0b9ce2f7ca37c1616a122b877e54e49682ff35d523f027c223ca86eabf68731dc95d5cc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 bd48d600ca20315f0f284c669d93fefc5162bca2d4e955ad2db87dc6c7031320
MD5 68178f69bef69a83430135ed73e5c325
SHA1 b11496aa52ba0ca6aa6dafbb6bb4ee578b2234a0
SHA512 d59b9173779b41106e1a76de466a7fa549a9c9f361c35190f32e0f13137d7de834fca82505d9070a56a4b2aa598dd424fb28bbf87495873a635e928af8f2d903
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 a296950465032a3be29aab8d74c369af43bf5c30665323ff95dc9b48d5722bca
MD5 268331e42f2baac37f1235340b72d04c
SHA1 6d4ddfe0841973a433c02a1fff0c4c87bd6f9270
SHA512 341b4c2423a662a19bde117406d6130b83fba7bc07544a247af467d5e1673ea92b68dd7ebecb902fdd8222328db2a9dfd34ea8e2c3d385e556317abb3921d3b7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

03586c13-9c03-452d-b0af-46fc3d8542bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\03586c13-9c03-452d-b0af-46fc3d8542bc.tmp
Size 4KB
SHA256 ac3d6a9a8727359816eb76fc1bf3c0b3b812ded809586dcc6bc5da9d2fa2467f
MD5 a7b809001f8a63e1b80ea0ae393e4238
SHA1 fae4b5cdbfd3769af092267e41f332114974007b
SHA512 fd1b7142d0216101e2169711f8f7ac6d5d292e87f189904c85a718d221dbbe0fd8cdde492d01a9e7574778bf8252e9ec41180dea2bb23bf4766bb0d601332c88
SSDEEP 96:n1BYFIN1JtqJpvWMoiVmdeHQq+ehUBKVDCzia:n1B6Cf8fWMXQTOY3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 e6ae92af561779264498e97cec32c6770ea2966d620718a25247a9fd8cee686c
MD5 a8c62d3bc3490152e3d03683483945c8
SHA1 b0db7033917c1af470b00657b55faa83de95104c
SHA512 0586f230daf0ab5b9d86aaa8aed41e205750df80bc3cfae88ed95ca07336ef32a392403ee7d6bd0ed363033ac3dd714583eb2a6559d6842680216ce62558ed9a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 7f84b64a39823a1a9b2a4ea7f3756fd3592314985273c4cbbe6b05b59c4ad5af
MD5 56262bcc4744eadebd78e5bffb288596
SHA1 c377d184c7048d6d3f6dc5d7fe487a1c31199ca8
SHA512 0ae28946cbe6909aa9ec426eefc12988511c591832a1b60292456a47f33eba931baf571a8ec70cc624de29068dd3f3fd01a58d69891a1c462275502954c32303
SSDEEP 96:n1BRFIX1JtqJpvWMoiVmdeHQq+ehUBKVD7AiEwb:n1BjCf8fWMXQTOYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 163e9fc576b00dc25639788129259a160e67753e61d89a5a0a93d901b6aa5851
MD5 d0d18d62109b3d3adbd31207cedaf238
SHA1 947c536b9c3199ce8eba1fb090632ed1a88a666c
SHA512 dd09c22b4012a66c6f6e9804dd017b22610e031510d0aee082eda53872701e85126956f82db3358c9c8d4480765e77a528c3161e913b6993f0656d452ddbeb04
SSDEEP 96:n1BRFIX1JtqJpvWMoiVmdeHQqmehUBKVD7AiEwb:n1BjCf8fWMXQXOYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 24KB
SHA256 9e16ba7c7de446002dd5ecf9bc7ffed2d4c189fb16ef786374cf9ae89249cd8d
MD5 1cb6b4e4ebfaab1c56dff17cc4383526
SHA1 2aa4aad279e43cb262e2ca9c5bd6ea835d70886a
SHA512 268d969f23ab25d2ee9a4e0d83a5a48faee7e450bf7d94f371571f8f17868a91f4b42ee1b1f66918f35e453368babd971797ee3cb01fe90e944522b88e8fb24f
SSDEEP 768:n/MWaj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnLlzgrU2a:n/MWaju1jaUL52a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe57a901.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57a901.TMP
Size 24KB
SHA256 0053fcc44e335ff8a9a75056c38b729eeb6a12d0a01f71f3b616ce4ddad6ed67
MD5 7f164a6bacc7d6ee272f265b32b05c0f
SHA1 059186816d874a32766d7d92e571ece3bebd456b
SHA512 028ce4b1093dfdc47197e72a3dca7a3de388ca36418dd5ba0a13506dba03f4f4d1f0bfe0f67648f148139609f9a09e9ebcdb8f75fbd67cfb9ccf67379ce35b05
SSDEEP 768:XMWlB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjLlzsrU2e:XMWlBu1jaaL52e
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b4548855056560e3f1bdb1c1e13ecc0cd291915e7baea1c21620a7fec32a5dcb
MD5 386e8a4673612b173cec591e0caf48d4
SHA1 d4b9200aa904cefe2bc9cad952dba07d7ac4e9dd
SHA512 a862ea8d2af89c872c0a1d4749b6bcfee82227e7185afdbee3d2b8503d60450279404ae538a56aef59a6fbc5e58b63a78cf0ee0a9c3e16d11876da08a4685651
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

FDZZVRSZLKQE49MSZ0I5.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FDZZVRSZLKQE49MSZ0I5.temp
Size 3KB
SHA256 6ec4cc18f9d7b0a5ae3e1f1fb9c83d09e20b15d31470d485882fda5ab5fb23ee
MD5 87c8ac68dcfd34c1575e865afc962366
SHA1 a9787dd64a0e7a5a0144ea344756ca307ae27a07
SHA512 3407e16b8dd1084f6b9c95cef2ebefe08562ffc21cdec678a2938754c4afdaee258544452689a8851d5e8d0fe1fbadeee6996e37610a1ebb386b7dce29ff3754
MD5 SHA1 SHA512

Submit Download