a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
Size

896KB
MD5

c9b1de96f31dca1e6bdf9d3b0ebcf1e0
SHA1

53c43c21de5f620269ea6f7382649d876738ad46
SHA256

a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a
SHA512

8fdff5c2ba5f3f23a8d0623e0c1f4e445a8d82fec601497d23898a96dfc13a4fb70d72a49dca792b812cb6c53a9c95bfa10ab1f5527cd8bdf05530bc7f757433
SSDEEP

12288:9qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoTq:9qDEvCTbMWu7rQYlBQcBiT6rprG8awq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
3704	msedge.exe
3704	msedge.exe
5212	identity_helper.exe
5212	identity_helper.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
3704	msedge.exe
3704	msedge.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
3704	msedge.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3704	1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe	83
PID 1508 wrote to memory of 3704	1508	a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe	83
PID 3704 wrote to memory of 2724	3704	msedge.exe	84
PID 3704 wrote to memory of 2724	3704	msedge.exe	84
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2192	3704	msedge.exe	86
PID 3704 wrote to memory of 2060	3704	msedge.exe	87
PID 3704 wrote to memory of 2060	3704	msedge.exe	87
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88
PID 3704 wrote to memory of 2484	3704	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe
"C:\Users\Admin\AppData\Local\Temp\a47176665c4ffff15503b1d6c5d6d65ad1ac3fe98c3351937bf88ee000d0b52a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee39846f8,0x7ffee3984708,0x7ffee3984718
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
    3⤵
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7520 /prefetch:1
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7508 /prefetch:1
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:8
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,13558370391159524503,5212402067061580626,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\166dd647-1ba4-4540-b1af-45eaaf633f50.tmp

Filesize
9KB

MD5
0b7205291b94cbb15a2d40de2250dcf6

SHA1
4630c60052158c4a6200c5ff835583c29d3cd6e3

SHA256
e4f620b851ac8addc06eeae74cb6ee72c59ba6d6f00c9830ae2f474099855d4b

SHA512
bfbcd9a6b3dfa4c00bc3d5d9a284950aea86f48f2d0f7585fcd58d8bb5749430fba8cf2145307cbb6efbe736a76923fff78c1e079a79d027b453eaa9a8cd18c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
4a383058889f53c4dac54c915ac01c81

SHA1
6d180bd9957ce1ed8aa4c95807eded294729185f

SHA256
254a03662a6ec50236c2b2523c0e4dc81e6b6a6785cdcc473dab174f8597ad5c

SHA512
687cd2cf5f0b6b4f081d0366b723b8a247ad3ad11cb706539ba1858fc5b3cf3a720c41d94233eb86d0991837552944f46cf2e3869ec88216cd8c450d653fdbf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
123fe1a0209352eb654585515c6b5a01

SHA1
d8b67a1ff735b9e8a75ce415daf49648a60747a9

SHA256
646be9ff4370ace12d8ecc4a0112ab2470505b7cafb6630484f4f7400cd41e1e

SHA512
8777376da67948e51c8a6d1940ff56275e14613409ea0c443d2aa5c9e36392c5e0a5e60672274293444c16c94a3c6fbf0164fddda93cad91205354661995da06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
5a776ad522520146e941f3d5b4749080

SHA1
34e4cf6d6fb0116e0f11bcc2476a26e7a5b17055

SHA256
048a58ca37cf2a9a5017d460403afdad528677cc8fb6a76cdbdd217f5c1a5a74

SHA512
28b7f7420f88dc3eb97af84c1ff22de252df58dc307a35618246a2d0a10569b10fcafa95aa98f19fcdc17d1f58fde50d2834f0ec9b2e90f39ba8516edc644d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7ff1174e-0146-4dff-bf1d-7cb39004ad21.tmp

Filesize
4KB

MD5
60125ee41b4ced8d4bba7d3e6646c9d2

SHA1
5b8464e5a076eb6d03002fd6274b5d326ddd31a1

SHA256
7d55a16d2bfacce359ef3bbd11b7b31ab370f65dafc1c85bb4b6bfc83ca549b0

SHA512
54df85ea698d076ca0351e0888c8d70abb0874f5d67c3352369b617497afa490b153d3769f648b7165db0d7e6f94cebbc764196e787283d810f90328a3a22b72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
80013ecaf8399b2170ac8ffeac097f9a

SHA1
25d96ccd96090c476d711bb349d730045543589c

SHA256
023dacf9817d900c96b5a9120ddd5e5f33c6af6af16769b4e8bf300bcf436abf

SHA512
194b0a3f6d8a18e6aa846dd9219aaa13c32a98385c2106c44b56c06913c010ff4b1ff29883d6ea4a0f1f8746c389c9acc99bd09a73a78f80f4da98e13f660772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
5bb7d378fc932286888fd8f7986f20ae

SHA1
a52eb864e23ecc11bcfb892057cec0c847274146

SHA256
1ef7d90d2621dd4a6c4da510275c8f34f690b120353708a7e729879bf10b50a0

SHA512
8551222da8f19fce9a79063ddc06abbd35fecc85a96e26b10731b004318ed531055d815991e2fa3ae86f80324c060e119af2389b2efa97e316c6c199a587139a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
98c03b68bfa170e1cfa9c46dc31c3177

SHA1
f5005dbf63b6253b383ea8d6e136f2006ac92aeb

SHA256
bd2ae0e339ff353060f9efde98a0da99f2a98d51df38009664ec7f4e5d5c9eb6

SHA512
a8addfd9d6bcbd4dfcf22125ecc0f242efdefa035e1d15b26399eb19c8094d7c0a552682213ad5e33de7ca2958b2d7b76cb71f9f609cd139c6e44929816b7bca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
24KB

MD5
449b325118b933f5ddfa2ae515b772b8

SHA1
e5c5743fe57a5e0601ce066c20ace01554cdd808

SHA256
af474fa26598c3f735e07f261e4f9b10da490c136118f3a68a471368cb27fe29

SHA512
20f17b9b11456a6001868692ee3147c53c61ee7aa9ea3ffd3bb8050dfa7bbd6d2d92a0638290d5a867f4d1ec7b2faeadb9442fcc40b50876e89ca5b3a9ffa1d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57bb9f.TMP

Filesize
24KB

MD5
30e6e27d6c31aae4911f87b84d9ee96f

SHA1
ec44d5ce0f3a97fa2ba1064dbd7a1c6c02dbc7b1

SHA256
4dfc3c95d871228eaefdfa80f7542be0f83f2316df5549781da6b821716a5de2

SHA512
4020a10b7ee27f19604f687618a5f039b561b4b8c947f813853962103d495ac89c9aa530289519bcb4381eff5157acf9cd0c98346aa368d68a46becf1a57c37e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EYRD6TV14NOOEL1KTKZ0.temp

Filesize
3KB

MD5
05adf0cf1ddbe23ec0fc60b440ea0371

SHA1
3758c6137d4ed879b7809bae49bb495830f2f3ff

SHA256
0cde401809eb7feae11a44a5dc7bd8acccc9754f57ad073628404ad41519bfdc

SHA512
28f48b39ab0696e6112815d69b874855a7a1bf4cc4fc2bb3746c5a2fd144d9e0fd1bf26f4a7884fbf973da670da5fb5f5bc5510300f111fb9f169d9f5c2b4d05

Download Submit