39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
Size

896KB
MD5

0141575a8731465fa16ac7178b3853a0
SHA1

2e67949ca574942d0ba17dcc79a468dbb4ac62cc
SHA256

39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb
SHA512

776d51f2c387c4424988013bc17633eeb5fc61680ccd7cd6aca57885540594573ee9888b52f3ae45dee72732b7462a0e99c518ce5c950416be23e76c7933234a
SSDEEP

12288:QqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT7:QqDEvCTbMWu7rQYlBQcBiT6rprG8as7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
648	msedge.exe
648	msedge.exe
1324	identity_helper.exe
1324	identity_helper.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
648	msedge.exe
648	msedge.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
648	msedge.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 648	4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe	84
PID 4620 wrote to memory of 648	4620	39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe	84
PID 648 wrote to memory of 3924	648	msedge.exe	85
PID 648 wrote to memory of 3924	648	msedge.exe	85
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 3720	648	msedge.exe	87
PID 648 wrote to memory of 4136	648	msedge.exe	88
PID 648 wrote to memory of 4136	648	msedge.exe	88
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89
PID 648 wrote to memory of 4556	648	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe
"C:\Users\Admin\AppData\Local\Temp\39944fc6bf2518bb70ccf313ecacfd18aefa425eca80cf3f21962f596963c9bb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce21a46f8,0x7ffce21a4708,0x7ffce21a4718
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6441604579551598596,6849651393320612147,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7932 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\9bdab2eb-fde3-4698-af97-759ede774b3d.tmp

Filesize
9KB

MD5
14b658e89ecea8bc96a18a274a96042a

SHA1
d4097c0ca00fe42ae4eabf4329977c1377b5d433

SHA256
2e1d3a366d30ff691068c6bbbb80df18ae9cc5379a3f3d5b834cd5cfc0d44f58

SHA512
447f7beb11c5fcf553cddf07c2b5a2031b10484c2f2b3a3bdba39f2a62d9f597b3e9451fba35ec2a0a4654ce368530a11fad8a57a9458fa15b83c1cbfc91adf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
63090170eef2de4352be670ce4ce03b9

SHA1
3c3fc5729c3cdf209df84a645045077b9dcb5b2d

SHA256
b3e1a73b8e6cdda04d64b1f0e46518e17edba788deb788b479fc0642b2513954

SHA512
84c5a0081c69603aee484e7003d94b35c6f510cdef0b6c49e9538da743cf4ff7be61b252da66402a8fbcc3c35c7d17676649318b7b72d5620f94ad510d9999c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
d5961b38e1e566ddd5dad8e9d5088aa6

SHA1
5645d4627e2eb252cee8d632573b410a4d1069f2

SHA256
67d15bdf79af27d66f4d66c1e2c73675c10d15dd087749def1bb1dd22d0963bb

SHA512
beeb0de4204a51a9de0687863bced712b24440ffcea90786ef644a3a8b6b035009f876abb1a96717094d3af4bd46b5bb104a7e3133c5821bb3a6e59bab0f9fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
83c20c46d425dd4baf555447ab0cf354

SHA1
b0e6c987cc5a3227b15bb629717e525bdeb67eb5

SHA256
6079427a7634e6316b76cd9d123bd9c6455931ca992495b9e8db23af0cc1d21a

SHA512
745f3c593fb86253dcc9e749f98c2b15351d68fcaadcb4d95b8a0dacdfbbb041d91887221bb281a7f027043e331877507f2ff5bf4436bf99f91c37fe1a6f4373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
389a96ceca19f833ea7034d4311da234

SHA1
c6b50e22ca861ef6bfcd3185f3d2bcfd5f7db9c8

SHA256
515c01361238147c18d34cb4800ba154984a890b1f4a7394c0589215d067c2eb

SHA512
1d45a3b5c26b110126a5108eaf9dc95c0aaebd41b2b9e3f89131cb9d86cd9d18c26bd57e08859534d2accc77c6106ac6b527550c2afa62768a3471520313089e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
b2b86162889db96c481290511964c716

SHA1
d6a1f5590e30cbb01c81baf90a8368b5652c6289

SHA256
85a27f49dcc2eff5caf92b48381f701bb0189790f6cb4b78f293e4620205311b

SHA512
e267a4bace8ca138c4fc47c1fdd52cb1b392d90f359dd9c0c95aa3d3c2324fd6fff74819ef6fa0fa9bf172cf9cc3b0fdfa39cfceea107fa196586a81b7ce899a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
151d26b4be6f87e2ad235b97da5abf78

SHA1
9b604ae5a32022f1371007da6dae56a67f154ff2

SHA256
b9de73f561a706038440a614654d18c0c63dbd8cca00d19aee974b2ea9b93285

SHA512
c539e71016fc93e3b744f0aecf886ab27af5f45c3cc55527a8a13fb3d4002338fa7536c9af8a12e79ab0c0905f934a90091a95239ebd544a69d1737f52e675b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
24KB

MD5
11c2d7115059d79406c2fb4a97bd9df4

SHA1
8bc22b5cd1c41d75d87c67b25e95de772ac63665

SHA256
ee3c414d1b50e010f590f6a366a2235a4f0c5bbe8df5a390624507616be657d7

SHA512
a2f0db45f0371e6d331dc7108ed5df61ee8b08e8c0cdf4641869aee3f81376c39e064dd4b77cdb5a38e16513e1886032b2e4163d9c059640673fa9e53250838b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57e55f.TMP

Filesize
24KB

MD5
d9fe444ae088caea23745f330bba578d

SHA1
49cb936fb65167e1d9bf09badb7d7d50598f2b60

SHA256
1f1cf1dacdcaea0eb1a07c2b0ed004da81d385e84f4e2e6ecb66aab0c6b5546f

SHA512
3865fc6222d24e4ef7087615fc31fa90ed5f6d9d7423690e571219220caed555b992996442a0a5d242ed1a0dac09d3b586b6acde4f83353310faf420d325fc3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\d0fa0731-04be-4f46-9f51-d4bd3f14d2c0.tmp

Filesize
4KB

MD5
545d9e113baf99375a61108041ca3804

SHA1
becb4485d18cd0efb00fd18041ad13f0a9616af9

SHA256
c8e3c5aa1932beb6f775c709b1ee25b2a01f77e2af10cea69bd9a83a88662824

SHA512
7d6c2442a114704c278d49f8f5333f3901b5fe3339c065bf50113750eae0ffe34def19b4c3ff8b09e5685610cbf656bd4a7f0a1cdd9e7e4e0390a5b486a00e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7IHMPLX6D3K9CPLIEX8Q.temp

Filesize
3KB

MD5
f12a2c9725a671780ca705e842f649ba

SHA1
84d6e5946770e1ee0fcbc2058edc437a81d32a7d

SHA256
41fa0619f34d5f5fe42822f43a66ea7379885245879e0f67be3565b88fa89877

SHA512
8ec199aff96b4bd8077bc4c9b075dcd4af6655966291e79b057be19bdee65980de7fc6416d72ef9147c8a414fd53693b9271b4fb3dcfa35225bf80cd0cb5847f

Download Submit