88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
Size

896KB
MD5

722a21a12025094cefd6de00ab539383
SHA1

00c7867204dcb23a342cdbcb915d042919569a05
SHA256

88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038
SHA512

58282b83bd6b647508834a7c4f47ebc5aa684833732bd6f3225b5aec362bb687769132cbe3f9be6ab7e176b8d66a20df8f8bfeb4d34f9541fb0281a24fe882ef
SSDEEP

12288:YqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTu:YqDEvCTbMWu7rQYlBQcBiT6rprG8asu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
1420	msedge.exe
1420	msedge.exe
5452	identity_helper.exe
5452	identity_helper.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1420	msedge.exe
1420	msedge.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1420	msedge.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1420	1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe	83
PID 1216 wrote to memory of 1420	1216	88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe	83
PID 1420 wrote to memory of 776	1420	msedge.exe	84
PID 1420 wrote to memory of 776	1420	msedge.exe	84
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 3224	1420	msedge.exe	85
PID 1420 wrote to memory of 756	1420	msedge.exe	86
PID 1420 wrote to memory of 756	1420	msedge.exe	86
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87
PID 1420 wrote to memory of 2704	1420	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe
"C:\Users\Admin\AppData\Local\Temp\88327e1bf9762bc4429d9799ada169121b27b1e59c4f3d7fcfda877065bf1038.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff914d546f8,0x7ff914d54708,0x7ff914d54718
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7784 /prefetch:1
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7864 /prefetch:1
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6644302374172650048,12256096521263895043,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1288 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
dc16637e573d72d67e718d7bad17f060

SHA1
e62d7fffddfeb8c894431d515a1f4201a8fad42b

SHA256
c2db075769e30628c2f31fcd65d29902f28b28e163e14e7d028c3e43ee6bfd89

SHA512
b64f775bf73a3d7afed9b0588d01f7a875d8c722461180ca6adcbfeaa4ec764b0d33a88c39630331b0d646c1a3b0e94f3eda7c45fff260a5608d6ebbdc588276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
7f6455b8735f521616722bef0e0e6967

SHA1
f2404621631d6a6e163a29c8cac9b43f9295fced

SHA256
c881b50fdb746b4528c7f8533921ab6956ec87416d7a685f49e57df11828a67b

SHA512
69ccbdb1e3ec3a7499cd57093442e3936f358e27dfbd6122fe783b0cbe9c161c7740550ae72b87b04802fb29bd209c9699720922c7c804f391b64c382ae20eb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
fa86b43e7a041b8ff4950825ede8a59c

SHA1
f0665f13e12e189b8e3c809527e42bb1a8545d78

SHA256
10a91207d032881556b3ecd71281aa913dadf75e7ce60726f285e3617752cc8b

SHA512
a6c912df4c277e4f44e6f1aaa3abb013f1508c762da2f5840ba2db9303ee0940bc104fef15b302054ccb477cf2a3eaa3b4ce17b53cda4d3110bb4a9e308c8c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
e88771ed6e7aa082c1a9b99610776f80

SHA1
8f26a8bffe1437f246fc9834f783f4ee8044a77d

SHA256
9f4b086861d8394f7f623debeb96b1a5dc2eedd15b6b43f98bfe09566d9c9f64

SHA512
09911efbbb39fbf4020b1d1d06771e6812b21481c73218e0fb792f2127536e372d2c3cf30f48b333d950e8d0251436ef21bac72ca0db82b59df6428e337c2d08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
855d6c4dfb4dda1ac85f5c39700f5c90

SHA1
437b6d62b18a86a6588d8bb1f338e44464feb7b2

SHA256
a89a7a59d3bcaa303f9108ed515995df2617681d42cbf675177c700c61e1645a

SHA512
992f7ab4b9905ae7f41d0ba763b075c54d9ee9cbe34b870550a1a839483d8f94d1f441d10bab1ca095c75d0c08cdf83ab9b32553c39d582be1009f8870366fb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
25ce9fcfce46b7d7d12962d5b5fac414

SHA1
e37772faec25f997e6f5e62d76bb8583bb69e328

SHA256
8f00cc8b958278cd27ac3c4a253d42c1cf9ece9fc5b73d1e747146ad7fc9d735

SHA512
1e4016422bfe0e635afcb55bb92267fab91f1a22446e61afba856fbbf2b839d919a371fbf5cd6af04fcf48ad7d03002fc6de466c58368313ad342001319f9646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
24KB

MD5
27093b5a42eee22234e704d94b6b2d4b

SHA1
99eea137e32887f2a572e9b2f9d9dd29bfb2b2a3

SHA256
5199be58e0e33939d90c06b66171ce842ad0159527d2ba621b0e0bf8138608bd

SHA512
ecb209eef9da3611c9c345b5d1bdad1ec39951d23dacff1fb9b793d5138c2c5e4336f57690f98ae944fac86ead7e1b24f44142a4f7ff39d77ca61cede0091df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57c44a.TMP

Filesize
24KB

MD5
f5b0940187a0eb5d49641891d4050e19

SHA1
166786c99da48a1e10ad1440c045c64eafa38633

SHA256
f423fb79ee4d0e4f22251d0d35c87fe72c4fd01a163a73f86e4315902495ffab

SHA512
6f9d0cdd193c3f38e64d0e37d0160e47eba3bab5b35c5acd341bd5de598a5b5b3c30396342c212686cea51569134f1eb6cf0139ec3d49dffddf37ff38a94eba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\cc3c7021-4515-4833-a536-5715483ea4ca.tmp

Filesize
4KB

MD5
6dc7b0b0a1b9707287ec2bcb86cce52b

SHA1
d2a199d92d84daf4ca16455cf9e995b29551c057

SHA256
5d141b7510e408501aa6caf09707f17cbb03ca927bd155c8622c0b3d26e326e5

SHA512
baaa4ee68b11a60ef20d7297ff5020d4368f73bfbcdb6a91d73e39dc79b5ec5a49676b26ceb6e915723e068fd9b728fdefa8f27db7dd5c85dc7b8fee951631f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\d6a15c4e-d310-4f18-b585-1f04702b7880.tmp

Filesize
9KB

MD5
66bdc5bbeeebe0d6d84f5a4b0906c377

SHA1
c6af2c11ffc71a1abf7e2d568b9a0979f900df77

SHA256
ee6eda307661e9dca9b096a7cb3d2b0c406b010b3e2c38541f26cf0b081aed48

SHA512
b4e5ba90d9e5eecccca2044fc0c09be59379733cdaa11f161b97e2d2de9f7edd264cc11b5ec57218f508251cff3f62e803da106e7dbd8b96fd4c74e22aab611f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NQ60KJKYBTKCANRT04KM.temp

Filesize
3KB

MD5
765940b34507e446c3474ea56a0db07b

SHA1
7e91d0dca30be0a1b35d771cba84f72932899f68

SHA256
73707b998c9bd5890e95ce75686845b500aa54a6d7cb0299a4182e308f164b06

SHA512
ad408be0467759ad3578465a11525d0751a4ecc2d9150e809236147c19531fe77f76c7fcf917b5a02153d755f0559111babf2d39388fd82cc44f5dcc588a0171

Download Submit