d0ebfd1c8a5d59d4c9bc5523323081989ec016db65bc158bb81d5d967db24e0d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 896KB
Sample240908-m7zbwsvdrg
SHA256 d0ebfd1c8a5d59d4c9bc5523323081989ec016db65bc158bb81d5d967db24e0d
MD5 1d1ff0f6cf043e6f11d696b9f848678e
SHA1 5299b085ef10092460ebcc67375e17cf6ebe1d0c
SHA512 0c5f74632b00f6c5f6332523dee7592abf7ba920b0d79b18dad143aad0b37cd2aacbb91618bf0a9fe15d05dc662f56f1478257b516ff2b61ce7aab160114bdad
SSDEEP 12288:uqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoTQ:uqDEvCTbMWu7rQYlBQcBiT6rprG8awQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
4840	msedge.exe
4840	msedge.exe
5872	identity_helper.exe
5872	identity_helper.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4192	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4192	file.exe
4192	file.exe
4192	file.exe
4840	msedge.exe
4840	msedge.exe
4192	file.exe
4840	msedge.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe
4192	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4840	4192	file.exe	83
PID 4192 wrote to memory of 4840	4192	file.exe	83
PID 4840 wrote to memory of 3848	4840	msedge.exe	84
PID 4840 wrote to memory of 3848	4840	msedge.exe	84
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 4620	4840	msedge.exe	86
PID 4840 wrote to memory of 3676	4840	msedge.exe	87
PID 4840 wrote to memory of 3676	4840	msedge.exe	87
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88
PID 4840 wrote to memory of 3084	4840	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ad8b46f8,0x7ff9ad8b4708,0x7ff9ad8b4718
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5529560626302036984,17638245838055137656,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7696 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31ec6f56-a554-4dd0-bb22-2689c5dd30a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\31ec6f56-a554-4dd0-bb22-2689c5dd30a3.tmp
Size 9KB
SHA256 f6cc449a1e6b9e88f05c8b429460c02c122831ccd914c0503963079b948f7b86
MD5 223a1b8d94528a208ea4f0aa17be8b25
SHA1 b51002a05a3d9219065ecb8e23012f47a7f5284b
SHA512 c3cf51d6a7dbcab70f85c1ed66ce30cc65b4ab5a73c9b70becd09ffa598e86cd35883c8d5d5fcbafaecec6f78392dd5cac27c136524ed65ef826467c1db220e7
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWCeMRUfLsKLQOl6feAO5:N9iIxuERzA83h09RZxYWGRKSc
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 29a20b26d18b950300f9c22a70b94699330d702ef806af51f0e14e9c610796bd
MD5 d72cacd0b001a09c7e1d08ebc8221c8d
SHA1 9c090b994311de0d2fef64c9787e9770ed05c562
SHA512 42b80b75479d3b63cbf44c9f610dc317b9e5d11fd1739a8d2672ac4791a414988ecff24b82fa2c8abb83ee2e35253706f891ecf86f09efcc0286ad9290513310
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 dbefe6123084e447379f4fc941081c4a43fc59014e41d5c4c0707d0a54599db9
MD5 8e16a200b0b6ce2175d8af4f114e1be7
SHA1 058e1fb0c8d4a591f9bbcabefc7d0d2c78d4a9b2
SHA512 4e5bfab5d0f631d1ce1f29bd1126826e7a5ae86c26e39df294c1107b5d4c8ab620dba9f86be9c6debce73c529c82cb40fcc60700381cb812e4c044351fa83b09
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 93ec5189f4ee92b851924ae5a121e6f139ad5ea40bfee97240de704350c91a3d
MD5 b1b5f94f9ef5bd3e1cf6c045ff85ce23
SHA1 caf53b7fcb8491e1bfaadf69784faa7b28f2e454
SHA512 6183cef81e64045f8be9ef639953c160da14095e0058b15cd5c3410ab722d4adf65baa720f6da40747ea62d3da2c69b230173320ed072f5edcf678a9021851fe
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 34beb5b782b1c8304033ea2a1e5be7eb1a231e5db1f5e5ca2e7721b3ca7f8fe1
MD5 a4b4c9ccf584f1c99a6c664d6dd4b73c
SHA1 ac18466d7412ef0b8ac372a33d3d56f4f8d4868d
SHA512 9c5676d7f973bc648b8069823e0da7e0c11e34d1854e6a0abb90130fe6581401aec72873c6bb2c48047175e9effc95576d7a9f8ff954f53bc64cbc309f038ee8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 39bb37da3395370df53a8707dbcb1e4015f774c48d4d4d295a46ef90ed1cbce1
MD5 c4c2c995857de2a915dcc7a73f21d158
SHA1 5705effe6bc53ff352e4f36fa964f1d6d4467a88
SHA512 04ee9d59cad07f82f120e4c31ca7422a21e075ebffa514df7efbb28170f784b83a81aea55e94f62a2c06bb4bcbc305b8f8924bbdd7ef7b29c02d29c7fda26356
SSDEEP 96:nuDxK21xtRKpvWMoiVmdeH19xhUBKVD7AiEwb:nuY2jkWMXTYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 7e3227182d700ac8792a25763f07ebf9dc3da2414720f7e6d7b0759c290c0482
MD5 6725065539fe7044cfc46aadc52e7e2b
SHA1 34012f7399f7be4c3413aeb3f4a5aa2e09f73e8e
SHA512 dc575666ef97eeb5ec3d875e97009ebaa042950ea87554331169bd4e4fa96a251fa1542517db4ab8c08275ed35c35955818cf87b2700478050157cad6a8aaba9
SSDEEP 96:nuyxw21xtRkpvWMoiVmdeH19OhUBKVDCzia:nuh2jqWMXaY3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 97f0dfe51a47e2fdec53f5dd79fc8c2736c3cd6e135abbadd5c1cca3ffc818b0
MD5 85098e923dea3d3d7a9bd4dec8c26577
SHA1 c21dbb7eab8bed92f0cd459eb544af8f643887b5
SHA512 81b6b5ac090435750b7a0fec704397e97472fa76a47ea44045b663bbff8fb5d19ce6a3459e6074b10dedeecfa3e39b1652e45df37a3cb9792cce67f4222503b1
SSDEEP 96:nuDxK21xtRKpvWMoiVmdeH19OhUBKVD7AiEwb:nuY2jkWMXaYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57808a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57808a.TMP
Size 4KB
SHA256 6a62c156c78581746dda027ec3b739b087fce3c36a82ccceece2366416fc2850
MD5 684a4b911d66391d793c5db7c6c06433
SHA1 b185dc1415601e7c6a4f5952a6324c4fafcea26f
SHA512 9fd6130c822df74b4ed5bfd6f40ec7efaac49abbb39d774484de1292d619f4af418acc37169cd24cd92c6c8583d0e237b45b594f02e8f17518410f4dc89a81ad
SSDEEP 96:nuyxw21xtRkpvWMoiVmdeH19OhUBKVDCAia:nuh2jqWMXaYS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 24KB
SHA256 15659b014c202b0ac51ffdeb26a6988590c6a54b89b63f55edb845762083fe7c
MD5 9ac557fdee6dfb62fac388d35937a540
SHA1 13269ab8c5e5849e839ff2fed54056f039acc6f6
SHA512 73b96715e3d41f419f32057fafa74c5a78b38d91c01dd4aab45905ea710a273f4c3efd0a0f9db4a4efc7a9d6848871e17dc4f1e6b843dd0a4a2b05fddec97d01
SSDEEP 768:nVOWH+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCLluarU4dA:nVOWH+u1jaBL4iA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe57a99e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57a99e.TMP
Size 24KB
SHA256 369a301cadd940130282ab343dc6086b6b2138f552ebc036116884d9811cb823
MD5 f53ecff43858159231f1eba474c02ca9
SHA1 d394f2f116b8cdb3914fe6f63e4f2c566a70b92d
SHA512 678b9b7db02939b44eb3ebcadbd825cfb7bb91d8be7b4641f88d832b18ea6d11f13c20645ce46e5f36e50225e2fff1ffb9df9d4551253694a12e0d0a5e5ca3e1
SSDEEP 768:tOWgE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeLluorUJdh:tOWgEu1jaHL0zh
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

P8WLDQGM158NBNE0QUXK.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P8WLDQGM158NBNE0QUXK.temp
Size 3KB
SHA256 69851f4551246754f2385faa4995fdba214ae1002df06277ae1718613805a7c4
MD5 bd42c009d6acf2fd714eb58d6c040f6e
SHA1 517de9f5062e66e832427176aa15f175c367a279
SHA512 88320fbacd67db2001fcea27230ed5461e6f3d56f45a636b1d8dfa1e96e9aab7a2541d7665eef330f89f828c8fc8f7934e2fb8269b3cb61ffaced6bc9c062c5d
MD5 SHA1 SHA512

Submit Download