Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

5

cryptolaemus

windows10-2004-x64

3

cryptolaemus

windows11-21h2-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/08/2024, 19:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe

  • Size

    896KB

  • MD5

    4d58a1ae27c8f25df51735d34e45e6bd

  • SHA1

    0cef0154b2df879a6e3568167c3100aae769c207

  • SHA256

    587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7

  • SHA512

    95af01c906dd8548b7ddc88a42860561cd29a6e717ee6371e045cb2702a91ec817ba379350d5b8f500909d0695da40563720883c20117d93428a4b3405a33f06

  • SSDEEP

    12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTf:vqDEvCTbMWu7rQYlBQcBiT6rprG8asf

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe
    "C:\Users\Admin\AppData\Local\Temp\587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      2⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffaa9b63cb8,0x7ffaa9b63cc8,0x7ffaa9b63cd8
        3⤵
          PID:3776
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
          3⤵
            PID:4468
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2024
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
            3⤵
              PID:2640
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
              3⤵
                PID:620
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                3⤵
                  PID:1664
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
                  3⤵
                    PID:4348
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
                    3⤵
                      PID:4400
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
                      3⤵
                        PID:4648
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
                        3⤵
                          PID:576
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
                          3⤵
                            PID:2548
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
                            3⤵
                              PID:2184
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7260 /prefetch:8
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1220
                            • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7532 /prefetch:8
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4084
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,828639575860990407,6569853018714169689,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=880 /prefetch:2
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4728
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1296
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4696

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\9aecbd56-8455-4c5d-846f-84bba3e4a504.tmp
                              Filesize

                              9KB

                              MD5

                              53a30f985ce56e3d0815c160724e4c63

                              SHA1

                              71b993f66728560ebd109aa3ac21d62b067c2130

                              SHA256

                              97bda0978a2f2220bc03df14123d280b25b7afdd4d9c8767b4847c5c7486da7d

                              SHA512

                              a81b0201b3572e4598fcec2eebb536a9f2b47cd3d7919681281b842eafa1dd5a79c73221a8f7390ff2b78d1334dc50a6ba5a20ecbcf040ae4c568f00fb420f3d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              5c471b14116577706e510961fb767fb5

                              SHA1

                              c2c808e7c2d08f56713e59a4d33ae3ef58589bf6

                              SHA256

                              6419176409311c75786bc47a0ddc5843514ff089db5889b45555b2c08ceffeee

                              SHA512

                              eded2378e5ec5cff3d0f21eef004b4765e1479e73cfd7cca3c9c901e0f533ac94a9e582c1b1f08f247ac59bd57b4fe16d7118d614fbb50fc116629e02ec71a0d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              355f931ab70dba6dd88504a8b74189b8

                              SHA1

                              fe45aa87e8da283212d390fe4707010b2926b290

                              SHA256

                              dce7f11ba13536e855e4bad7b26a990c3d94100d570c9e1c5fe0417c74797e87

                              SHA512

                              41b0818638f8efdb2538ac73e4d3540bb9288866d76e7058dd4aea77bc4b494e70634dddb4adf96c9aa21adf8b250a89b998daff16817559122fa66de5be3096

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              be7d6e450342c5ce62fca2c617ef7a16

                              SHA1

                              ac65883d796c8c2f13c0cb6eccd12d9455e7e878

                              SHA256

                              46947f284065ef6bfd1135b71e84623b4dd14cd563b022f2e96d7ff231d6bbde

                              SHA512

                              8c8d5752211b06de1b7d9076af868a7ed4c78dd2333982d19fb9072fc2e89bb452d90022c9073ad4527346fb33fc72145b04c78a66932ff3ad4d402ed68c1842

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
                              Filesize

                              336B

                              MD5

                              afb0c68f1326ed3c97dd95366c1da723

                              SHA1

                              5838a0107e575cfe53ae89ca1a20f88aa34de3be

                              SHA256

                              24da376744b55c3e7d0a5e5f8319a334aa310fe86a62eb82dba07f6e0c514a11

                              SHA512

                              178dacd36a2218cde091567179e39f0e24d8b92693ff83c5d51d056fb7415a459ad3424a49719aec148e8b0de7f955ac196cc06afb87b5a6f44b36e17cfb6633

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index~RFe580625.TMP
                              Filesize

                              48B

                              MD5

                              adbdd5e09f06861e3225f7c8322d31bc

                              SHA1

                              fd08e1cab332d7ac200cebbc3d8f91bf4fd9b2f4

                              SHA256

                              1db9f6da698efd04c5d73463879b2cd870e0806a30a15639bb90dd586ab6b34d

                              SHA512

                              408d33dcb480a35eb0928a6c30f34b850acd44ba30b629421bb3d2b4c811d47f8c27330df67e9c15c668d9b641507f2657d06043b3c2e90b3cbc57412d08e055

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
                              Filesize

                              1KB

                              MD5

                              5b0a0bb414f5ea21b6d17177120d0d73

                              SHA1

                              4b37751a1e065ae0d388e1da43d5808fde4534b6

                              SHA256

                              f7f4641e005977c244ee77d598f97cb7babbc262c0c6d17f5b502e6642a78e19

                              SHA512

                              078f9118c0d46b6cd0ca1ef868a8115fc62d3be7a2d81560d8979e603de917208d2938aaa64c37f31a753f3eff534cbcd61ab71ee8801c3825ce82f46af4a9ea

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
                              Filesize

                              59B

                              MD5

                              2800881c775077e1c4b6e06bf4676de4

                              SHA1

                              2873631068c8b3b9495638c865915be822442c8b

                              SHA256

                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                              SHA512

                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
                              Filesize

                              1KB

                              MD5

                              6cc47120b81f8dd64bd07e612502a7d6

                              SHA1

                              06028be6007685873ca64927c5986f77789bef99

                              SHA256

                              f3ff65a41bb8708aef2d094a87bb566613ec5aced3712673aaac40603cc9b071

                              SHA512

                              aa9d379db32e65e53561dcfb1be5dde38710855a24fc4edf1f3202a7a5d55a7e371539d5ea7cc72aa556f6ff26b80265b313401d326a732c438a9bd9b8ba6531

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
                              Filesize

                              1KB

                              MD5

                              2c31a6f759ec733cb0e8b45a3dd35bb8

                              SHA1

                              aa8eb73efdf8335c9b510fba7e3f4ec754d54c2d

                              SHA256

                              627fdb1529495704cc689300226aca7dccf76cc848346ef6e8bad60dab5df0aa

                              SHA512

                              2bf2064acacc5405b21c64d12bdd3a62ca630ae46e3d1da9ddcee4c2d32c70216a4a59ae4cd7e3cf2a1b52b395757fabd6de345fadd08634b6515acc62cb3117

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
                              Filesize

                              3KB

                              MD5

                              8d251f0432b07101ec81bd6146a18583

                              SHA1

                              b0e7941a0609f35838878d9f442f4a9f6f12be63

                              SHA256

                              856eba14cb50c7870cd2ebccc8617f375dad583785db2e5cd9efa16a50fe3c2d

                              SHA512

                              fdae5c4009621f5b93b885f1e3bf8b350f199557dce3a113605cadf4d91095eb3ce58ebc896088490562a76b828c9b57f6e50fb55eb09089e39da04d57b6d087

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
                              Filesize

                              4KB

                              MD5

                              0b0df0adebf58223a6f3b9f64aaeb008

                              SHA1

                              82a07cfd421ee2c9c5dad18c3719911bdb890eda

                              SHA256

                              d43baeb4b4a6b827b7b2b338367e647f3a0035dee899fe8457f7fcfb2a67db11

                              SHA512

                              f23135aaedefdf8291660c306f0c6d1cb597e796725f81cd44bb05cf390e7b80d4f6dffaeb1c4a67ec0c4eed0e3c8c099989640c13486223cd235aa54a4a8317

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
                              Filesize

                              4KB

                              MD5

                              b7cfe6b244ac6451a8e2589242a0ce2e

                              SHA1

                              a3339e1c18fde420fdcd25b5eb715d09d64f4499

                              SHA256

                              55f667abe6c755d59d229c4d631240fa0cc32887c36aabc3054290086530c2e5

                              SHA512

                              5ad86016f58cdbf321c0c46f70388b27a2ac009da7f93ed19a7600292c2d533e9a15e299510a576889c84b258556912cc87906b4d930e0e1e02e8202a1bc9cd4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57af99.TMP
                              Filesize

                              3KB

                              MD5

                              deac00a582f1f2591f773bffb2ca1165

                              SHA1

                              f3a74faeaf97b8c4a499616ad96ff78cb4da57df

                              SHA256

                              5ffc6096953278c7b191a80cf4af0e92776ddf045ed2e06d3928ab4e876ea179

                              SHA512

                              9f42117812a0e2c28e8463d5312601e9313e1fe207a28d99b3834785d125804252660f1672764523de4c278c6f046b84d104736d474ee26c20a68738a13bd144

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
                              Filesize

                              26KB

                              MD5

                              37e5dafe9e53433207dbd0bd31bffead

                              SHA1

                              6b03fac33c1074641b1cf81c2c91d41755cc3972

                              SHA256

                              814b7b056b1eb2f74cfe0eadee6a7d9db23159e8aa23169575f813c160f82fec

                              SHA512

                              fb1ecb122cdf850875a6bcb1bfc75afda62396a799b69eb57781bdfc724ab5c4618ec3a0516da112edd0508d1d5869d23237f0e3cc77a047743bbe4f187a0640

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57d784.TMP
                              Filesize

                              25KB

                              MD5

                              9b14ec28506167aa35e1c970eeb0ceb6

                              SHA1

                              876451f8bd445e3db226bba070b1ce9f50c988e8

                              SHA256

                              462fa24e978cf53593df605b249acdd56e481f496f1ef0f98ef1b46b91e78ea6

                              SHA512

                              c7a544347217d385c55dab9cb24a06e730025074e9f878f6f1ddc464ee8f77d04423a0e4de8fd298cbc0eafb5b3215964286f4e35d37721c2ba0fc89590dd76a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001
                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
                              Filesize

                              8KB

                              MD5

                              41876349cb12d6db992f1309f22df3f0

                              SHA1

                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                              SHA256

                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                              SHA512

                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
                              Filesize

                              203B

                              MD5

                              834cb519fe17e30de6f73587145a976f

                              SHA1

                              ce3234fe6c77910e01ff2c63ffc08acb5c7e1cb9

                              SHA256

                              8ac1a7b16409dc95bc7f8c892eba2d2171c78d5c2a8af600d83062a17090d604

                              SHA512

                              160e14bd887e3388fb4480b6afd34f0dbd171f36054d6b89714d797264f4e093129731abd4f2b164db24de55f889476cf142565460ee9f51dfafd059f1facc29

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58c7cf.TMP
                              Filesize

                              201B

                              MD5

                              69be4b1362229d69554b7de86b44163b

                              SHA1

                              48d3703dae8ec5136675f996d4cec63160a1a130

                              SHA256

                              a51ee308ff9be019658a76c46f0b0b832da6a69ebfe47a05f5d9d4bc652b6ec4

                              SHA512

                              69695b254877df0a48ad0e42db1ce012ea15a2d75b38b6fb2567939e2b10eec2f61c00b9ebe5977fcbb5f7d0c1782ec2012395ddf4b9abf3605eefe2ef0f61f1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_0
                              Filesize

                              44KB

                              MD5

                              da116b093680f8fd2e8b0eb9286c8f86

                              SHA1

                              672eac3b3e43982e58c2d062c340262c147f1cb5

                              SHA256

                              ec2f027d25dae540a1f60f7a8cd7c21a35a0757e5829db921c848cb99699cef2

                              SHA512

                              f81dca8d575b223149f17651e32e3835b748d0a2f6e3f5181b8debcb1da7c3a655b8f1b1b56828fb0513b1f92817f96e76efe8b61a1a66a7156bacf9e47cbece

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_1
                              Filesize

                              264KB

                              MD5

                              f2fa2d7c3a13c0f5bfe258623ee95823

                              SHA1

                              821540a63dc76f4f4a1ed1b8f4bd10bbd9e07d40

                              SHA256

                              c948f2bd56b0218deddef140776873738d87872fe64233fecdc0896ed5b0e893

                              SHA512

                              f392ea03a7a70ebc0d9a8849fbfa4ede22c7320551aaf89a3d1191151151f87560edf4a7a73b4916be6bbfe7af3ed8b5a20c6d7927a9c786907968c4cd55fd07

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2
                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk
                              Filesize

                              1KB

                              MD5

                              44b0812fd47432555934a5171661446a

                              SHA1

                              b4b2d5d9e22d710c68736b469e670242700ab984

                              SHA256

                              5b86c015d53f722b1cb99abc7a667eaacf35f2249a459cba8828e695abc8f5f4

                              SHA512

                              91065400187ca1fa3160a0bab548eae12aa6a220d99afde57b072dd237654a1b108cd86e7ac256faebf88bbe64ec5814ea75f7dec2c61ef86430752dc93b7d33

                              Download Submit