587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
Size

896KB
MD5

4d58a1ae27c8f25df51735d34e45e6bd
SHA1

0cef0154b2df879a6e3568167c3100aae769c207
SHA256

587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7
SHA512

95af01c906dd8548b7ddc88a42860561cd29a6e717ee6371e045cb2702a91ec817ba379350d5b8f500909d0695da40563720883c20117d93428a4b3405a33f06
SSDEEP

12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTf:vqDEvCTbMWu7rQYlBQcBiT6rprG8asf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
2260	msedge.exe
2260	msedge.exe
5728	identity_helper.exe
5728	identity_helper.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
2260	msedge.exe
2260	msedge.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
2260	msedge.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2260	1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe	86
PID 1664 wrote to memory of 2260	1664	587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe	86
PID 2260 wrote to memory of 748	2260	msedge.exe	87
PID 2260 wrote to memory of 748	2260	msedge.exe	87
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 4584	2260	msedge.exe	88
PID 2260 wrote to memory of 3668	2260	msedge.exe	89
PID 2260 wrote to memory of 3668	2260	msedge.exe	89
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90
PID 2260 wrote to memory of 4184	2260	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
"C:\Users\Admin\AppData\Local\Temp\587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb022d46f8,0x7ffb022d4708,0x7ffb022d4718
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:1
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7844 /prefetch:1
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,374152675204526539,7442675205951806471,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8076 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
e71dc8b76f1417ea17baec0feaace784

SHA1
b0fa1948e798c829818ca00fcbdc437ef0ee038d

SHA256
731483fb4e713831350c3ed1552b1a3c8d51d17e05911edd30dad67de6b8377f

SHA512
09e75f721f0a4455e7b3dbc84f3df2b80c811b4faa212983876200deacfc436814991b751f3092266c0b246cb1d8808eede2958ac754440bf642c4c9fc849449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
f0e6e857e851b1db5c010fb82db9d854

SHA1
8500cf7899dfb0c78adb9cb339658262e73ee53a

SHA256
bbfcec65e8ffd5268625bfd4f04234a2420734d2b1c058a159d57899086487f9

SHA512
c3bd75ed933a6b2f501fafd865c83d32ffa8716b29f6f90fdb79e2646edb7ddb74f0d1ecd5dec15858a955fbb350fca37e1e940f80e345a377ac4bfdb293c08c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
1ad46d204cc5a574a3ae61fd17394e6a

SHA1
e226c55f33b0e29c3831645ca67961c89cfcfbe9

SHA256
4be9ba9c10f597411d24b0de55e04bc348e95c404f6f7fbd6c7ca88e44c1ab34

SHA512
b883f67c2b6a27c18454c9fff5dbaed20e2e3bf6f844dda90a51d253d49faa4fd29e15a556b81ea03a977ead5d555b038211e7983104e7f9e00b3185015b0b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\9a225677-2ef8-4c64-ba07-1c39c2a39c41.tmp

Filesize
4KB

MD5
1c5786718e18fad26eccb2c99b3c11d5

SHA1
5c33c28bbd7cb3bebdace1666f17078b3c46c178

SHA256
7ebd6c7b44cf0c27d270c3d45323652df8875b320b9a6905737311df252da328

SHA512
27bfe386c2a37204e1427f70096dcd9f55f02b84bcd13c6261a3d7629563c937f6c6b347c644a983eeb2e5d1ee011a818d1809157af0b7399be88d223e03ce9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
933874d018ded61773a1e369e0d37704

SHA1
271176097704294f2343af8ff05683ba160bbc9e

SHA256
137ae35d82e2ccdb640ab4bb6f08965e79fbeb64cdfd941db61e8a40eac5dbcb

SHA512
44e32419ddad40947437c0072ba44579839a80609244f133e9eaffdb8874a7202136d3382ca8d151ef8b2cb24fbf45735f8257b41cb8aee6672ae1ee6355bddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
b240f85166073a1d1458d581e4e105f9

SHA1
cdd6407400f770ea8469d0e3b27b60813d61d500

SHA256
040fef5c2be327753c6eed1ece0b4544d0a032868840e147e21ce4a3357e38ed

SHA512
90d108f7e7ef6938b7ce3e5c394ed41df793da2fd24e789fae92b50372142419a428937bd28ce3c7bc21a4e382a5cb313a58f57c1b6b09e58d47c28c1850ac2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
cac75c01d36d077118436cd0ca259631

SHA1
b960f8dcc136b07fa1019215f4325d67a82d8749

SHA256
c703c22bfa00e146b220b21881bf8ec454eb356bfa16164cffb849cd758a9248

SHA512
5270ddeb9c5d3687481bd78b759f09882551830c6a7b273baeec35d72042c9c0bfab76eb4cd9ff6f9d5a000e5e2620f11898033f995f843a025ac8d791190ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
24KB

MD5
446c0fc3287435113a9e131f70abb32f

SHA1
03c5b409ebc98036b8c0d361b7e1497b3c16d988

SHA256
baf9016d216a4efc3fcccfd21eb53e128818c7847366f0969e9cf8be23675133

SHA512
4c2f9c2d36e3cbfca631de84f77d50fa762d502fca7974d07b51a98df18be634ada513979762a37e1e79f560f85a9196b2b87700f17a69395d6f1257721731e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57af99.TMP

Filesize
24KB

MD5
d64a5d4117be77b838f8a0bd15165e19

SHA1
b4c761620e46baf71cf6a0ae78a091da92eff67d

SHA256
28756de4b38fd23b73287e50a88ab629096a9f83248a08a617740b40c9d99815

SHA512
273fe3d9f04f37052e7f98081b6bf5890551fe83931c92ce5b1a4ab773161f817971ff754e0a3807fba5833e1388c2e1cc04c09332bc1f0a7df12e4aeb732d62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\a7183335-1a57-4949-8a0a-b6bceca4d18e.tmp

Filesize
9KB

MD5
eb1ae43b6875701265aeb4e5667bd473

SHA1
15e8f5f27bcc313384846220ec8222f302ccab8d

SHA256
4578e8b40720498f9842a5f6b0715d977f50548a15996a3ba4cdfcaa208cd89c

SHA512
16071a9a6c5c6082af8119ea1ccc5a753658039a1cb280c6f54a164fda034586d7e7479bf07bf5baa9e25af76bafac6e4e7a6d9894fd1b463f2f1b1f3d590744

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A136MK8140PETLHPB3OM.temp

Filesize
3KB

MD5
fe7da8b493322387293da159af4a02b4

SHA1
bb36bf800e3f1ed7ebf5c3a88fbafb53c7487fc6

SHA256
a5fe3be69251855070e7e510915e9e1b032e443e25478575308f57fb9ffe6c61

SHA512
527d051ca051b2758f5ba9796aa020292443d8700947a2eac9a95424fca4c94076f9e00b49939685097f66f6661efe09e8723d232c526a9b7bcecba0c0e4b9b5

Download Submit