df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
Size

896KB
MD5

6ca9ba147fcf085d7f828da983fd946f
SHA1

e7fedc40f0cbbe1ba28d52b4c25d2840a0004002
SHA256

df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8
SHA512

626c5f47f2da8bfcd805d0fb510beb1800359596b304a90afdbc2f7d381c2df42751f3659b12c30d4e430c6e46ee1ef9be2c2d1a6779dac13399d7511b2121f0
SSDEEP

12288:7qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoTy:7qDEvCTbMWu7rQYlBQcBiT6rprG8awy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
4340	msedge.exe
4340	msedge.exe
2868	identity_helper.exe
2868	identity_helper.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4340	msedge.exe
4340	msedge.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4340	msedge.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4340	4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe	83
PID 4144 wrote to memory of 4340	4144	df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe	83
PID 4340 wrote to memory of 3864	4340	msedge.exe	84
PID 4340 wrote to memory of 3864	4340	msedge.exe	84
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 3168	4340	msedge.exe	86
PID 4340 wrote to memory of 2964	4340	msedge.exe	87
PID 4340 wrote to memory of 2964	4340	msedge.exe	87
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88
PID 4340 wrote to memory of 436	4340	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe
"C:\Users\Admin\AppData\Local\Temp\df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa928946f8,0x7ffa92894708,0x7ffa92894718
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
    3⤵
    PID:260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7424 /prefetch:1
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8092 /prefetch:8
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8092 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15350066371201566016,3719975826803962660,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7816 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
e1a65b0daf9b3647f6bba5b6eb9bd2ef

SHA1
1ca48827f2f540dffaab34a59bfa1709cb521fa5

SHA256
ac2ef1a6d76c76b0ad109fbe06c4e05ec714d3d8fd63c558a2207ff3108234ad

SHA512
e7a7349e026841456e20c3f7ca6f06fdc6b5f643a77a3f511f6b0fb0d38fc127f6cfe78717554395dc11887eefacff7db82a1de66a528872d785829fa2c2cb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
fb6c4f54effd772bcebd91b832b09afc

SHA1
ec9c94453c02fdebcc13596712769fe1316bab8b

SHA256
9b3aaee3b0d1c7caa1449190352c46506c4bc07860cffbfdd4973799daf07479

SHA512
fbfb75fb39f40b1d5ec75d4c291a023ca7500cb06e00e25e025ecb467345b1409cda81ed20f475b2c049d41b50537c1d6a06aec77dc123675dfc6cfe75c73747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
b4b01352bd8c664bf3677e4102bc6b99

SHA1
71fabee3d22bd065f17452e6249f97fa1f03f779

SHA256
f16c276c1ae2943ffc8018d7f039f9c5eb26a809ca10d04403cc46821e2e5bff

SHA512
3adb39dc9f21d3a0790b6a2049eb4777ad2761634a12ca90f7091b0a601ffb2229a5028de8a404e99f1abaea9c96d9bece26e6272b28747814b8ca26274c9b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0d0c8534-82e3-48fc-bb23-2bc59b8a8682.tmp

Filesize
4KB

MD5
2aa8d64489214ea7114c36007b4834f0

SHA1
39f5af25c8b9039abe058f3c34fb8e1d01de84ae

SHA256
718ca75f84109d359e2920631897d2b400940e8aed5445ea3fe9f26506f8ec19

SHA512
b285d5c5990254ccf54e033ebf450ce285db2a5a44fef6a2b415ff50aac4578aad969e3fc1e7b34de26a9b34aafc4889447ba3459e314a4a3fc454d20c6b04b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
531b1632a9f67a2bb6ac5c2975a9c116

SHA1
97a8f2b4c1aea948c4ec7415247050ebd333a722

SHA256
4df1fa817b10cd7a13f55443f4a42730a64ae52f41bc8012f87f87a1b4f4aa2c

SHA512
6b708328098b469fa85e961766cdaef451fadd48a44f39f948bcff5b293734f8112918ebeebb3bd49ac45372341949405aa94791b4f6b31acc71cbcdce36c65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
0b6cb6835146ccc65b81d4f90cc7ac07

SHA1
cb11226d4b40c8198feeda14f992ebeceef47730

SHA256
92d363e83fec1c92dd1cfe9e7b8dad33ed380c75a71fd107e69417f5ff93e0bd

SHA512
feee434367aba692932531f383a3266c8b88a763f571de03421832737331adc4f2e7d09485ae938016f77eb8cba22e547b43a52ab51025448a1bf410e7dddd3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
aa18140841ad59c7b7292e5922fe0d2e

SHA1
63b0a0bf584f915482635838aedbbda7e0019baa

SHA256
710c235414ffa367c6441f1b8cd738c2f4ff7f840d8821a7041f90c0fbb83fac

SHA512
85e703be3c038ebac2230ff2d54b21d764bfb1d5937d1b4872758f7c33379a260bdc59a05b20c63a95cc6e3c9092ab1404e7fd878e062b6c570f4b76ea91e23c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
24KB

MD5
2aed4f562055b15edb5b1a6c5c424dc7

SHA1
82a47a7931a9623d5adcf306ba15605b7d3cc5fb

SHA256
2e8baa09ba9d2ec9307203cbd196001a7e3fc2d05a9647de47b1b4c4d1ac71b3

SHA512
55223cba877beb79135c5366521d59ba17faa2735adbebec4eb0ecaebf771d88da7096f1876e796ca7db718a11641eae42789332756618e2652b42138288a089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57b0d1.TMP

Filesize
24KB

MD5
9dec703910f3293b49c75ccd87df6d86

SHA1
aab2be7c5c0a30fe21c18967ee900e9e90463495

SHA256
8db1d75f8a6ea1f91c096b5e3cb0daadae7a9f2ac6bb2077275036cc0725d16e

SHA512
327dae33941e605b673e308b4f63e284312e6e5f4e15fca0fe9cd3ceddffa9b4a1e33953c9c286c5f0edd2c79489e9437071d9353848de85b2438adecf445504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State

Filesize
9KB

MD5
c66f90ec7e5984c8580633800054d5b8

SHA1
ffa7d8ebfdfe1abeea7462872d73030c9ac9c4b8

SHA256
b47285e01b4a13471a9485cb18c87180d3798bf3be7a36ad4fe9f28d4126c527

SHA512
337db736d5cdc9afbbb28462f19bc6e00bd54058d9864e9d242e56760d7d5406564eacf5294cae82cac4901629a3e565fff5ad3b321b9cf93d609573447e595a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CTPIZGMUJIKHSQPTFAQ4.temp

Filesize
3KB

MD5
0fe46e0da25315f95ad94679ecc67d52

SHA1
d247e90c3a6b7f4a2bb673a55a4644e3ed563953

SHA256
73aecfb26bb65a5cd3a2c00d546412f3d467db46b348bc5c643f52bef3602c22

SHA512
df165125a53ad807987bfb66a8b6afe6d2633e30bba1dabc08b7ac6b8e22cba0f4cb289ac84b8abe47c96ade9f380e78fa736c93af95dd1430dc176b1d93e888

Download Submit