hxxps://www[.]mobily[.]com[.]sa/wps/portal/web/login-page?account_type=personal

Resubmissions

31/05/2023, 12:41

230531-pw9dtsfc7t 1

31/05/2023, 12:35

230531-psnyqafc51 4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2023, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.mobily.com.sa/wps/portal/web/login-page?account_type=personal

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230531143635.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b572d510-bf96-423d-808a-a0863568caf2.tmp	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3348	powershell.exe
3348	powershell.exe
4548	msedge.exe
4548	msedge.exe
4264	msedge.exe
4264	msedge.exe
4776	identity_helper.exe
4776	identity_helper.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1724	4264	msedge.exe	85
PID 4264 wrote to memory of 1724	4264	msedge.exe	85
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 3708	4264	msedge.exe	86
PID 4264 wrote to memory of 4548	4264	msedge.exe	87
PID 4264 wrote to memory of 4548	4264	msedge.exe	87
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89
PID 4264 wrote to memory of 1148	4264	msedge.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://www.mobily.com.sa/wps/portal/web/login-page?account_type=personal
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://www.mobily.com.sa/wps/portal/web/login-page?account_type=personal
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd9fc746f8,0x7ffd9fc74708,0x7ffd9fc74718
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7500 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0xa8,0x228,0x104,0x22c,0x7ff70b085460,0x7ff70b085470,0x7ff70b085480
    3⤵
    PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,319892181763044596,12058775417880633933,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\246b0a5b-9f47-4377-8ba9-44f995b8be07.tmp

Filesize
7KB

MD5
a30c10405b7331f9efdb2749c045a2f5

SHA1
9f84fbad853390f3175e4d4c9eccb7d32b627a04

SHA256
de4a37eb3e53cdb75ab37b65a6456f6ddb5d8e7fd4721401e007b88a909f2c78

SHA512
8f1e02c095d224c81490cbbcfc8fcfb8e90377c1dc1729812aa926a881ae91033cc81bc5b6c669c0598265cf62692a1a7064f4593c09c3bf6c1e8934c77df92e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
162KB

MD5
44ec03cb3248c903b67751ea27df310a

SHA1
c57e9cf90caf30457e9d57db750b8a0eb8856770

SHA256
d4de4a836d11828dd561db1eb8d7fd48a7e0ce9afd8645e2eabb19a1267b6894

SHA512
657e8958d97eab524224bbd8903e0bd7d0c2640805f77da7546060164fe03f7b6ece99a005ef44e41b7233a2e24ffc63430b2fe3c87f61a1b26e0d7c7e52c365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
a96a73a5a64365c1d1f5e16586e10641

SHA1
17bd5ad315243b5950589fe3ae61c15876e8a56e

SHA256
d9c19aa2f0b4e2d03bf0cfdc9c1e52ae24342691957f0c9dd1323401158d17fe

SHA512
f9074f64cd4ed372ec3d59c76b7b57f457fe6404aedd6554d39fcdcd735746e915cd71de8212272b7a14a864467e9f71f2288f49bf87fc9f2ca700699cba028a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
86c65ff0f93d889baf37a807ae7d6a1e

SHA1
25692d080ead303e48d262c28dfeed2597281d4a

SHA256
2dcdc9e80b7e8e437478ae6368972a246a5191150f44d69237697acf3f4cd24b

SHA512
8af0b8cfd9d3c6c1a45e8a2db2011c72613dadf054a2637092f44d53f466acbab6ed883954b72a4626d172d27e248ab414a9ae24d6101e2aefb75b68a93fce39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
8273d85a59dd9d866050152be0f05b12

SHA1
75e106309998f3cc9b51c255c5a954fdd0e46415

SHA256
521ccbc6658a4178f7b16f70253c8ffa551474188e0aa873d7c759d4933064b3

SHA512
7754fad340c4f503223d3260ab17fcbb4061288537571aaeb184aacc665cba2ad751bd0732f96b0cd600f8d2772210a22d1488d281a8d16b3ce1a9f7d866b242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0608d90142d18a3a3f02509f2570942b

SHA1
df29e620d3d6a09c434d760e4fae4c486ce527bc

SHA256
025af8f9d8bae8689a8979d7b6687067743885283bedc5333f4229350c07c369

SHA512
f2578a5c3098fa1271dd1d2baaff4d92d93d7f3bec4373bc336e5b5f592666764d7fdb7250c8f0343e8c70dd3c80286b7d765640c68a17975912d5bb6aac763e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
252ab0f6cee3bf9e35a8339b89eb3019

SHA1
2a478fcc9e8fd712c84eaa623f6f1dbee5dae13c

SHA256
2ae0951e14f89e69979a91244dc8c3ea04a114c44c100135db8670451c50b1b3

SHA512
34b966fd7b184428fccb24f1712091fabd5e00ceb509ae6854fd8c40a558f5c2db4184bbbee7623c8a664acfb3b23cbb8deed6b4c72475783a6c343a0325fe9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
332b3df92529e7733df7c92e440939c3

SHA1
91f1e53c240fb6b8dc745f51619b8051eb655045

SHA256
9b94bdc891245a7258d1cf612cbb0c09262f4e958a7655cdd5ee88d8e210bd8d

SHA512
6fa8b5e0efba834a2e341f7fc024093467d976bde41f6db81e98bdd526e1ab2f233c771419c950277a18aeb09163db15d1049938c5b12f764cc37bb92c7a33d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3966348bbd403f0d73c498b32b42c474

SHA1
e831a80dc7540db9afced875d230530380ec5119

SHA256
85295f1484a81c8e36f1287dbb3d8c2ff4f80a5b2dc0985b88abcf49850d7542

SHA512
75a7fe567b809507d121ecfccd5cb85d7dc8e64609f916a450345a1ba959f7535767619970de25f9474c498666ad1b08250697222d5696f7a589f663a035c41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b73c2818-c986-4786-befc-6efb455a7884.tmp

Filesize
4KB

MD5
6ab9c667a63f1781984e12d84788e3e5

SHA1
6044697828e609ad1d418e45977443143d1a1a11

SHA256
762545b0c99fbd1818009c3a4e00b64d9265572636a45183b8a18a521ecf20b1

SHA512
851ea66a444e875eb1f4b13d568a3afd112b71667229497790f2e99d06f9eaf401af5b84147c2385a45a3aa48576bb2857c3ac52353964bf8850de4421ac05fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
301dc2bd54a78a6ba8b4a84e811393bc

SHA1
9afd19e7d480b6a02175952370b5c91295c91591

SHA256
db7c99799fd0c1a620d72467f2a661e65b30d896894253ad45aec5b3bf56d2cb

SHA512
8792453f8a0ef00abad392125e4f2e63fbf8cae36624e36eddab066d53a13449b948c7324c1fa0ce6bab875a206d157457e26ef4e4dc6402a8ac65ba37670f2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
eead280dc34d88f2bd70c2784b429bdf

SHA1
dd277e16948375683a92f21dcce95bc443972813

SHA256
65b5b3a982e192ce806ff583395cc7977fb64c27b7c84e744263587eb3127e8a

SHA512
b12ae3131cc6d7f1ba7353ce707efc5ada7180b88ea0f3373f6786316c7ed507147e4bb9ae7fd11ec05095a7ef3874bb61da8064cb247f0098e7e58bb0ad4c13

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_arph3v4b.god.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4ecee7e09e4f9beeec8d8d03a7ba63b5

SHA1
3cef109b52d21e125da840a2c8d7ee9d66bff8af

SHA256
d852dae09fa3bd5212a87897010910ff6895975b1ee87d87e09c28a3dfde9ebe

SHA512
9938a88528954ef4cfb9531f1b0981a529a928b6fd48bcbbde85e799a18bed87c4f0185521966295f10e019224a7140983989b5844b3463ce0bc4e5df1b078d6

Download Submit
memory/3348-144-0x000001534EFC0000-0x000001534EFD0000-memory.dmp

Filesize
64KB

Download
memory/3348-143-0x000001534EFC0000-0x000001534EFD0000-memory.dmp

Filesize
64KB

Download
memory/3348-133-0x0000015350B50000-0x0000015350B72000-memory.dmp

Filesize
136KB

Download