hxxps://www[.]dropbox[.]com/l/AAA-t0pYSi6E25vFlsort4UkT8lp8DYVhns

Resubmissions

30/05/2024, 22:44

240530-2ns34add986

30/05/2024, 21:06

240530-zxvxyabb326

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dropbox.com/l/AAA-t0pYSi6E25vFlsort4UkT8lp8DYVhns
Sample240530-2ns34add98

Score

6^/10

link pdf

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
22	dropbox.com
24	dropbox.com
27	dropbox.com

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral2/files/0x00070000000234e8-275.dat	pdf_with_link_action

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{B57ED644-AD62-4267-8966-94D8BF0B48B3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
1640	msedge.exe
1640	msedge.exe
3008	msedge.exe
3008	msedge.exe
3044	msedge.exe
4280	msedge.exe
4280	msedge.exe
5192	identity_helper.exe
5192	identity_helper.exe
5208	msedge.exe
5208	msedge.exe
5208	msedge.exe
5208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2596	1640	msedge.exe	83
PID 1640 wrote to memory of 2596	1640	msedge.exe	83
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 1172	1640	msedge.exe	84
PID 1640 wrote to memory of 2524	1640	msedge.exe	85
PID 1640 wrote to memory of 2524	1640	msedge.exe	85
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86
PID 1640 wrote to memory of 1928	1640	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/l/AAA-t0pYSi6E25vFlsort4UkT8lp8DYVhns
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb61104718
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8249672019836924834,7524033150347378843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

75bfd5f9-1910-461f-baf5-b150ade17cc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75bfd5f9-1910-461f-baf5-b150ade17cc4.tmp
Size 6KB
SHA256 d9a576198885d2a780a0ac14e1ce50e464846c1eed5350c95efedf4f003ea1a4
MD5 247e3ca00a8bdec8e86b8106efee47a9
SHA1 a51dfcee40c73905f12a1ecff1a5a3d1f339b5a3
SHA512 3cf5c06833871681cd6513852ca9e51f244d092d11946878f4060004ac82624c7037773a0d337bb16c67fbbf22ed9e15fb08bf0aef4b3fd667710dc02230dea5
SSDEEP 96:nKk8sQCH1ThwpvWMoiVmde2cb/HHBrzwF2UWQyV+VD7AiEwb:nKk1VhGWMmcb/H5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 23KB
SHA256 3338deb2a55da297e401a5b295e63c867f767ebcac869f1ea790dd19e3f21e6e
MD5 c5b50314740101fd93ae3b8da1c7d792
SHA1 d132e0a56659d5c2e8ac7ee13adb5c0222e38857
SHA512 b5e9516d3ffa8eed4b006cf7a849e46431a447866483d690d51943331df7114e35451c1a9c84375e3b71c12f423198aeb03a5a6183bd88189cfb9a8728aa6848
SSDEEP 384:We0n9azI8yckNbbMhBIFXpU+9RAselWN2pSXo8lUR3i7Bfp5NDQJrcm3QVDbmNej:Wrazick9bMh2XpU+zPySXoGa3uJwrcCY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 25KB
SHA256 0e3c6b0ebd35a9ce9dc81ec68e31706fe09bc2750025f3f4111efd9e0b2f05f9
MD5 e4057d1609b638bba6b0d918da48a8e5
SHA1 830958c114339414dacd38fc69259a0892396ac5
SHA512 6b0c52cb76f03deb25b3a7474c2b1a5d020b7d750db19d7de682928e42f274124a5847e35818e89d1fed4f479ab67a1f27ee69c7c2f7a3ec78c632b13fc9266d
SSDEEP 768:MDqXTFLdi4a9X/xJeRrc4VT1YV5Q9aG59G:MeXTRdi4WX/z6rPpYvOVA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 38KB
SHA256 e470fa52dce6720f6025cc0a254d85d9bc6f0696cfa94693f6708f00115ded96
MD5 36ae1c51a28d6e28d3eac6d8483ca1a3
SHA1 dc9b117070ce6da82bae84c0e5fdc337ca4180da
SHA512 d31d9069675b510e13d6b1d414cdf51b66aaabb34b24eabc908d3c4965e971cec1676f865759977e4ed7fcb7be0610a0677f12ae337a1d670cb02c7d300a44c2
SSDEEP 768:EdftmaLZFxrYw3kHcwUBlqF9Mg55i9UEt7PUmGOoGI2l4w9TsVQU7g:OmaLZfz36zUzqFv/iUE1DwGI2mw9H
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 81KB
SHA256 853b938b9312a37c2cd8b594f5077396af71a08c0ce2f4fff777c7b4726765cd
MD5 fa7dd0abacfc51b2ce015193ab5319e7
SHA1 91aa7bcad39444e97db8703add09731ff451c224
SHA512 3fd703fe81162c5739efc52f331543387f04b0927dd2e1a3461c722ca3d7680fb785b61dd4f7a49f2ecf3fe22f3ee7f9e16c24eee4e32a7e2775e7aab588f9ba
SSDEEP 1536:Cr6muzhHR/Nj5FdMszt/Qy+sBm0mZyWtYzPND1gahy8TyOJQQOA8qzINHtY:C2mShHRNjHu2t4+BmvmzPND1gWJxJQQt
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 39KB
SHA256 90a76b4264016bc43ae283984e0c6375fc2588b8b0772c586508eafc2674a2c9
MD5 8b031739fb08977af8fc16f488a62ec2
SHA1 a028a253820d63998f0326f877723eeed9ad5bce
SHA512 3cb801075caf466518711fdae064ab611f5fc54dcc930a45042f6c83f2ef818854076fb1d22fcb44c43e1b2b49d8ef881c12fb795fa191c6de0b6aa463cb7d15
SSDEEP 768:Z+c+93lehTV2ijexMyMww35VidKdl9ypLyVO1DBk76O0uDDECAbK0DNpY:ZI3lehTVxixHWfl4pLyV8DhuEGGrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 37KB
SHA256 c34b280ecae48a894ca86fa2144ae37e866dc04b2aa0eb991ff41bfe1425a177
MD5 0431a1348d337e76287b135753bdc633
SHA1 e905f3221332b9ab0b9594f21af183ae30833fe4
SHA512 f3aed41457c2aed54e872737c8711bc174a45f0af070449719ea1278e647b5c0d09376a29177b9de90a235e697eadf470a30a18173f5f149cc3d0f8818cbf697
SSDEEP 768:P1AATMpBtzDZdpjAfg5/gKlRASBwnZrSDBqrT0nh72Obp:dyBt/Ig5IKfASB9ET0nhqWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 121KB
SHA256 50fe147b50500697a308717f4b708746e6f665bd8688122a2e1716c275f99512
MD5 831792b42126c16713f4f050e04c8605
SHA1 61646769d6fbf5f2b55fdbccf394c5a873f09825
SHA512 2a64d876229d2b2dfca179db875f410e23aac5fbda8c9d976ed87f423181bd48a4a4804201c46c2bd6200b104d4c61d7bde04127bce16c798ccacb84de782373
SSDEEP 3072:2SI9wbaZ6dIoKaTlqbV+iH0VpkwcKUKdK41e:2SOwbaZ6lK8YbV+iUVpkwM4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 16KB
SHA256 67233f00f8aa4bc3c3f24df1e41ef9be14afbc4ff130802c8b58b22c95041e81
MD5 575636002affce6a562ab1d9e0084f10
SHA1 3f20d734d1505f23df4e7a802d530be8553f92da
SHA512 5f54e51ee1df039ee7dfcb77170c8294459f9286e60d54425ec042d8fa314fb62dd6b03df710db8b433f85e85f615cb34b553f9a055b67915e3a05194fe580ab
SSDEEP 384:pPsdchEL4+z65r+azPkuiwjW5hpjefp3kgYo4I8g:Z6T8+66Gs7wjae9Nig
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 34KB
SHA256 91c42b89c7581eee7f6ea274a76e4991a1cd401b2336d98ae5d6c0a32f39b3cc
MD5 d2b92c406d961abda0a12ddc36f844a1
SHA1 b5d1251b9cacf267e2ef6437bbcc5e04a0db9b2c
SHA512 5d13fe969514e9f31535b6d4f338a99fccf8eaf2c6747a130ff22cfdcf87430390626c6156182a89c20dc53a81fdc883feafa3fc43ef3e85e525bb7eb741ba03
SSDEEP 768:ZjTcmeE9ktFJjT6kwRz9K4dCmGLOTiIu4ShCfqOe2vfRG9eDfh9A:SmRchwRp/CrNEyLWRNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 17KB
SHA256 0166dbc919a6752b041f4f3ec1d1db8664ddeb7f58440a3fe9fa3734144e3799
MD5 793d68e713f3c20ea48557637e159f50
SHA1 471daef539ad29e17a41179ea76a3cbe6926a80c
SHA512 8243231b5bff4eec9c5114134c8daf1a20c24a63d48bfd1e052a57da65724d497f6bc8a285ba171cea84a964d037f29e88f77631c72dd4c4a3abc1556c3420d6
SSDEEP 384:GWgfX2bUTpLuhYkq0ddz1JL7lm2ZMWOO0EjufXGmXNRgVm1Nimt:4fXYUTeYkhddPLJUWOf8uOk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 28KB
SHA256 912d271b1714573eeffddb70d964203974802de03eb265a551ad7e21fcbf317c
MD5 743c16b527d30baa6f4a397dfe6f69e0
SHA1 3406b46df14caad096c170f0d8d744817f93768a
SHA512 47541c87925e2ac0acb757e35827a68c2606912a7accd94fa6c97758adc8a4d5c8c9839fd917ce432353eb5ca71431d2f084c025a4ba598c7149da2671b53ae5
SSDEEP 768:vzsmv+xTl6m8K81Qv8tYnakxsZRqeU4kj:o6T1+8Kazmj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 32KB
SHA256 a048c071989261fab1766010cb4f1a2c510a5373788477851701e3f112579ab6
MD5 89e86ee09601ec40e86cb01a56b5f68a
SHA1 5eb953348a8f5ce0414c090d7438eca92ef5629e
SHA512 93ae8ac046f9551534cfd79bcab1ca5cf76d0c5f76087ac1691b11909b74fe62ab1ae6d114b98996258cd3e5f39829abb8b54a16cd4dbb1e6ca3d827396c4247
SSDEEP 768:UjPKye/uM4uyoU10sW5AqdEVoXQbWbsSfgdlPsqXwrVH3gTAFL:0o6rWtdE2XYWixOhQ8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 30KB
SHA256 3c48d6aaf17bc6944576b3867c432ed9fbaf36d8606e5630efa1186c8e153a27
MD5 1f4bbc75575ada810ef2cdd27976e49d
SHA1 d0b2a32fa14c278748eb2a9c8f0f5956664984ef
SHA512 f1406881d8dea98b22afdadf137d470d851b540e083989ef95449e3389304dedac5c1c99a7e08b071add8c895f58cc7dac98ce211f0bf0afe47c223ad23dcdbe
SSDEEP 768:T5EPIkzb0TwytkqxfqqunkcFbeDhiTzjk7KALMN9MHj:lEtzwTVF1qtk4UMzkWALo9MD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Size 24KB
SHA256 ead491e0618f1988dc2b8f7224fd50f702f7d21e453a6b4e446db0e30c38fb73
MD5 ab675412ea878ecaa3e1ad53392150ae
SHA1 044f38836ae85938184c3647da762dd3e379dca6
SHA512 5277cc02894b69ddda61e24a47ba55649fe81d0c55a3b3f0588b7233febd8502ad0553153d25977e004751089ba258ec6017124458fa029c3bef88ce1310f9de
SSDEEP 768:M3Cv/1ZSf+TXM0CwmvM9nEgeZFDQRCPFw:M3K/bWwEcE1IRCtw
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 17KB
SHA256 6ff5c3f16fe8d12b17b6e2f626a922c5d9ee9d4e10be2d7d2f4a326db11e3fd1
MD5 84b00620be964603e62fd0d1ea614384
SHA1 0b171aea5349c47ff51bb9a55b31a6d8458ee187
SHA512 7a64bfb9a9b4fb051e39a6501ae3fc2bd6254dde0b456b45da12c28b79eb91d2ab086a4a5354efa6cf58f207394eacc851ff1ddfd2d245d8dba19952868fe6da
SSDEEP 384:C1t6vR4W6+CYXdBoA1kJQp/VmEwInTvADYtEDi3e3O:C1t6vR4W6+CiZHBw6TvEDR3O
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 25KB
SHA256 f9bd417c49b877a5233d6fe931da22d98da5a4806615bffdda518079fce9c42c
MD5 d59dd8664dd7d1aa083bf7f7e94b02a6
SHA1 3238702e0b806f69af2a9c62b084bd0b26d6e583
SHA512 5b23466d7e898537dffa1c3f5b9d1810f3f738b11cb06e03fb1cb355823c588179c9e36d688da8335f31fba9fca4ea48bc078218f135bb7f408c696e7b52e9af
SSDEEP 768:OIGDMS6rMFedTzeS8G3TA6tzpUEzWhrhK5aul8:oWXt3jttzpChrEU
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 30KB
SHA256 8f4ca4353d94a4a0498fbc53b6e9ed9328e5720ee9c3b7b8797307c5f49a25ce
MD5 69a422ff00177a060b4cf8fafbba1a7d
SHA1 27b371622cf3b585ad29c0a5973cbd8c851e8cdd
SHA512 604a952ebb4b6994556ff1d49b5458cab7f8258a024c541435157c6e9a1921f9d90499b137aa736f23c2cb43432dbd86d11c0be75949fd1dcb7133088aeeb86c
SSDEEP 384:RuKYkGem1F/X/FFOYURefZXjHWvV1c+hebBloAnVeTSv2NZuNl9banZJeFXPiUv:RuKjC//FFNzZivncEellTeo27iMZJU/V
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Size 19KB
SHA256 8bfb84d1e471614e925e7ec210fb1e49705772564bbb7326199127c7a8515d91
MD5 5e6a8982634081ff4da63be8a5763102
SHA1 f3a1e2e594fb85a11e2036a0271653bde8117160
SHA512 56cd4b84c7eecabb9bbc949fef063e6919640f8bfcac25f7ef4af95af263264dda467d963890975da5b534927e5af7dbde87f0c9f9683aa1db64158c98d00b6c
SSDEEP 384:TFuToz9HcMtmW11bIXD1lhT7Yyc+KPRo6WSc5pnkWkt:CoyMtmWfbIrhTsyctPmRnkWkt
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Size 34KB
SHA256 96c81835f706c7444be423f05da828b185c36e28c228385aea556aaf12965e5a
MD5 9fae39d1ccb2d910de96ab97549b221f
SHA1 2cfe2c8c3262faf2a41824c7fcbab69823392b56
SHA512 6b4c29cf6bf7751eb468048f0a324fbb4b03434e610c1dcada40184233acfddf6b5682943bc9100b1fe1e7ce31dabea60333aecf2acc9077bc99e357729222c4
SSDEEP 768:15TTAQ2B2A57vTf7P+0P/3ku+5z/e2Y3JDVM4JYa1W9ZCqbXhFRP:15TMQ2d7T/P/EzBYJ/JY7ZxhbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Size 70KB
SHA256 c5deb782eea01f9e991ccd10dde3e30350bc8549c062037618021e5709f0be0c
MD5 f00056645db5cdf0243f897160edfc9f
SHA1 c5d6435f5a4475b09563b3ca2d3485a2218a7844
SHA512 d789c64a2b613a9e24a9d02706ea7efba7e75c2be13ee029f69c9d275ceecf07e5a2d1bc820a9141c9056307a96010f777c3ed3496dad4b893438f2139d3009f
SSDEEP 1536:mf7YA0fnGtGYLbnThur+2s8f7+4+W1vrPpuDh36d1mV4gZ/N7X:YB+1YLbnThkhs8fa4X1TBU6k4WX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Size 191KB
SHA256 a56c90203f2eda5328d2986008cf98462520f2ed50afc28a44bf23331c313afb
MD5 b910dff6adea626be12deda513696968
SHA1 48fa3c563b8af2661e4f2925e2b52cede0dd2c51
SHA512 557dcb34d3d1485943cc3de378c61fb73c9a09bcdae47065fd1c4f4d86ae514516381657020e9c9e6ac9149777d1b134a591d913bead56a729167e3dffd89de5
SSDEEP 3072:AFxTHmpZ8HrY2eJRPHC4h98kHenSZjnB54ZRg4jeWtNYgB7tNZ2eaHoMnZ7Z:AF5GpCrY2eXf71eujB540YeWdB7d2dZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Size 18KB
SHA256 8555950270444fff2bea4a76c0cb14a24399896b1c78ed3650bdb36ade9b4129
MD5 7ca7fdef77660c49bfaf7f927548e55d
SHA1 aab109155b76cb53409bf3506ff81decb3d50c41
SHA512 71f1e3968378a00ad1b61afdbdcbedcdfa85e199d8059f7c1078292e959700142f85a477915f738adfd2407203f90cfd9c1bb0a4ae21beeb0083c0d5bc8c5192
SSDEEP 384:ZDGVM/QfqKJ/xYoFEcomKHgS7EwEM9mzcE+nDIPErhbh:ZDRKJ/xYuzomC4NBcEXErhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
Size 19KB
SHA256 33c0cc5b65ffeea05e2acf7e69f9d7bee7cf5d9475e3993ffbf5824486546875
MD5 dd128f25a46302e36fd4348e43d9ec2c
SHA1 99aa9bde13cc6c81be9beb28c8aef4bc4a9ba4cb
SHA512 eea7f9f447098282932fa23624508ab5b985badaae0cef0a97d046dd86ebefd32d2b766412db6d170db12927f3349b09613b8d91c033502094677cf905d5f2fb
SSDEEP 384:ekTpG2uXHUFkBJDc1z7CvBGkKkNkA/GcvKKxgvwhRO24G2fKTcd01ZtSvhnCBy:VpG2ue0JE7wck5eA/Pvtf94G2fKTxZtO
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Size 57KB
SHA256 990835e162df12bb41c7535f4f0238486da5f3ef0cdfea1b21165e3de3eb2569
MD5 14c97c404a16d2350cb61b4c6b2b1e0b
SHA1 c21d21db484e78515b69610f7451bb9210b51cf8
SHA512 53535b234fd0ed0b2faafde789bf961a5f8baeed253acf9bb79f1c0478d756860e157ef74919f47f93d9693cbdb3879063b5816ae3f93c4fdbf85de4ef2c7c03
SSDEEP 1536:YcFwYPt778CeoTwSOAmVjQq7HUGgAsFqnQ:Yc5PR7WoPaBf7HVgAOqnQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Size 81KB
SHA256 abfd99e47a8599bf2d35635e08fdafcda06d9dd2b6ea9291af42de220b3cffb6
MD5 16b6642836adbb1544fc6c52f7cb5d84
SHA1 7558febb599db52bc73bb390876e0cbecca7f288
SHA512 f025ba2a84b67cae66cfbca10e00428da3a5b251c0cb2b2bcdcc67d477fd980e54d9e2e06b7dc6f4884c25c5512bccda5e2b1af01ac9a1305b52a4d9fae5b47d
SSDEEP 1536:ln0SYtkJlJpOt8Y5TfrqSJpNDWV54HoPDtmpdkjQO9TLFPT2VYt4IXighF:l+kHJpC8Y9TWV5YoPBcsP5iVC4Ii6
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e
Size 78KB
SHA256 e720ae3a3e66ae6b68a08e4cb6b12ae89afe7ef9694e7705d308f8ccb30c319d
MD5 54f6d17db32c5a25d1e566c6bd761c6e
SHA1 ec1844dcc59d6136cb53c8f3a6e082d406b32e35
SHA512 8a1fc5e90a25de5cac0d91ea737e32121b50325664deb4e2ea93f3095834ef77336475af65e40807708244404a60e2bbf45a5e7578d9c7ab2e0574502a1ee141
SSDEEP 1536:v54Mn5vBsB8yffWmkY13PToAH6Yo1RhC/wY80oR4q/7AMWklv/NwPR/qF6:yM5QfffcY13EJf18BBk7qkt1wPR/66
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f
Size 36KB
SHA256 da0f26a52f95585a84691188652b1529705fd7996913d07035e28313ae9d715c
MD5 200cd59ecd27d6747d525cf933aae56c
SHA1 8f955527e5a43b96861b9d5d450de693e92e8b40
SHA512 b7f7022c9de36743b7fe0d855d52def6b152860cc442f50ffca7f7142749c88661710456c26783219e08fc65711dee66775d792cdd929ee6fe6a048e1630c8e2
SSDEEP 768:Hm+cvWAVgoBzaXGRD0wDPLLQrfvvWzrZsTNws4ImidADPdf0pX8J7SCWDb84:GvvWfoBzpRD0uwDvWWTesaiODVfJodbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020
Size 16KB
SHA256 8fa4b3f0efc4fee85d8dd27e0d7ca6ef0f08576b897933219a6968e0bcb9ddae
MD5 c19c1919d31500d1957f13c88209c880
SHA1 e10b0018d7a020de144cbce7557a2c75b4ae4301
SHA512 37aac2d757d954af6f5b94542f2c82d61d97b3d6ebd5495e96a4c2bcdfea6ee88b1064df28c3ab0e8aa6556781d243397e00d9f289eb58863d9c195bf4616e7c
SSDEEP 384:F7rDQteph/66zf296KGzkJtpCsMbUgToDhVmPIYJdsjsN2dhfkP+:5rDiKhbf2okKpToDhVmPD2t1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023
Size 28KB
SHA256 138d0a55989a81aede9a115cbbf485a3d91140cb1cb98480358d17c644d2c8d6
MD5 8b6a23605542aa5ed08ecf170cc061f2
SHA1 be7a5b58e9aee7eb2d36927b4dc2f0610c3c2cd0
SHA512 27d0a5687b2e3c49337d6bf7a46aa46e48d72a4c3e6f5ef810771217bda4a2feb60b002344e26cad2f1700eaddd92f41439a04858822617ecf77b176fc27fd13
SSDEEP 768:04CafqBaEbR92jGWze3e/QXcFeS+vTMJodyGwkexbNO:ZCMEaUDWe3IFOTMW4GJv
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 19f3212c2dd0f7855a68233705d019b5f77c2bef10d65eb2542a740592310095
MD5 9a905a5ef6cb2d23f5d6279576fd60da
SHA1 6222c0b50306c25e87a75834d9122630dd0342d2
SHA512 e9bacf46767aea2aa5f22836a16516681730d80eacbcd143e7fbfe997c96f5a49cee7d69dafbc5fa3681e667e33b1adad5a882e0cd95a77b72714bf209670fff
SSDEEP 48:+69t6UmtWbuNbrzMBv5DhdvHmUhKWx3R34Yth9vP1VFoCJ0yUkfc/oY+RTi+H:jt6hHYBv5DjIWxBIOh9vPTrJ0yU4cY2e
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 f3b926fe03f3b1aae4654d634d27df40bdc0d125df6105e9e1abf474eca6acca
MD5 055fb87a4e3125bc0d862faf3f46e3ed
SHA1 59e2916ee66e6edba3c29d4e88aa544bd11562ae
SHA512 583d6947fc81c3cd9fc65c31bb7129ea40fb9d8adb3402d1da382e8244bc978919f9b537548393e410b0a4edcf81351561cb15ced80d624877101b192e1e7905
SSDEEP 192:XcVf+zyzQdniswxSBNUlppbKYhhrsivyIr7AyIvAiCxiL:XchHzQdnisKKYPrLJ0lvVCxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d9936773b58a9fd6fcdd7885279b2c42acb8c2bc7ac04be1352752bbdca24a31
MD5 ffdca8df826ea2fea4eda4e323bbc044
SHA1 e9bfab86896ff333a4e6e0d2233c0705b59c45fd
SHA512 23eba02b1078a8221656e91272d9412a3928effb29d4a88fa70eea70c2e077e87738aaef696582dbfaea969f00b69b3edde6bf51e4db5ba7b51547da10ac6043
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b59237bf6159bb7cbca837fd461e4f34ff4255db8c169439ac570c6eddcf3bc2
MD5 594dfadf461ddc4f3512819fa16f75d4
SHA1 570ee05bdaf2d88e3d9df3b49333490635a9e863
SHA512 57363743a4b293a1b466841edfd7b319663c31de68268ebbbe07507279eebed34520e9ca6eb4541517c0f2ed7cda0ed25b7f9fb1232d1ca255f35ebeac70d3bc
SSDEEP 96:nKk8sQwH1fhwpvWMoiVmdedu51/qBrVwF2UWQyV+VDCAiEwb:nKkz9hGWMNu51qnrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b92b12939304adce12838f1b8e3d80b4a3e5e0613196de1b478c332e1bb9f3a3
MD5 c9e7fe524a61bf43793c5fc1e4661db6
SHA1 1f6b18d39d1d0ec20271eee43bb8b3d6bbe1a4c1
SHA512 84037e75cf75b8ed7b4370e0ad8f0e160292698771ab8d530f16de165d5f2a62e84e1fa44da7a17d2be78a4b1ceed7a0020fce3e84dfbc597ac0ce3513588bc0
SSDEEP 96:nKkTH1fhwpvWMoiVmdeHBrzwF2UWQyV+VDCziEwb:nKkD9hGWMXxro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 470493800f81e5ecaf4636e19df807cc2432ed3a4825d5edec02ed9fea9fe5af
MD5 c712096de779c503d8381674362d4c3f
SHA1 51734764874be70263ec8bfd6f204796e50781a4
SHA512 f4b45898e38848484719e004c99f7596117c977e491c1c5950143d47261162543ce8a0883ce77a2cddadeec1529832b8f5b6a00b477992c2c1a60012bf038f23
SSDEEP 96:nKk8sQwH1ThwpvWMoiVmdeVw0j5qBrJwF2UWQyV+VD7AiEwb:nKkzVhGWMFw0tqrrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b74a9fac08f00b9e17887cd0ef364b0fe21a6ca5a1597d8061cabff232ec5c22
MD5 97646349e591cac1903490be271d7e08
SHA1 2d625f4027b4d14bea904ab7bbd35c7b634c5266
SHA512 db91f2ed997ce9aff53d5bf0a60c7cf679c1b5bd16f1575acb7c7a8a8dd771e4edd8c12508c84ef99c8cef4c3fb3b2156f5e64c4232c13ac92ff6d88295e5a09
SSDEEP 96:nKk8sQPH1ThwpvWMoiVmdee7Q/mwgBrzvwF2UWQyV+VD7AiEwb:nKkyVhGWMO7Q/dglrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 c99be3931d67238b3d047d79038304262efdc790cecb62fbc073f4bf917eeb4e
MD5 8c2607801c12fcc5baac1cf5fa520d14
SHA1 ea83cae217602f68e5baf1d1208ebc3c262ad29e
SHA512 f9a9d7cb13506663f7feb2606a3f25d77a8459b6522ca962b3e8bdc857c9e319c4c468bab6924413f56287cb37c23bd00a33f05b187ddb6b33d228c7c1704a9e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 516a5930e919bf6292c6b6b57753969f458b8ad1ee184d3a9c302a2f3892a66c
MD5 ab3564e25d18ee28a20358e91115802d
SHA1 c213f012b963d5a80f75e39d08f4de49b09f4bb8
SHA512 086609b709c46449abe184fa9117a2017a5184a8aeb455490e6424050a2a43741c9196f5674b739468b2c746618128d1b23ef96faeec27c3725d0e75ce12d144
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 90b6bd43d57bdb6ce9551e0b211f8c5e35d486f8f7758618cd8022cf486558c4
MD5 a6c0af71847a05dfee92d59aaa48c1b5
SHA1 6fc39f488a5af876b2bf58e1e055e2010b2e5c56
SHA512 3b065744711c25972e84a398b031800ec0695078cb27cd0ff44ee6a33ae3e168fd22a9c5263261d496d687a6297dbb394b3167c616494f9ebe6ed620632cd969
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 e1a79aa39f210cce85c6d8e7945c9e9a7c9bc822a0eb90832668ba506f51a9ec
MD5 5fedf9ccb2fe6b039ba8c6446b3ab6ee
SHA1 df483b1816333890425548e265edd1b0836e36aa
SHA512 c7b18e1adfd2b311a2a3ee92692c5b5e17bef362e542d9c620b03ecd6f8cfc5c9901931a3ab60a7e302f5f3bd460fa66e7348b61c3322412983aaf8de9964863
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 57f2e0e4e89ac65942a83354f81698a2b81796551a0ee598113a5718ce8b20d9
MD5 8bea03e9926f240711d3494a0fae4734
SHA1 8b548b8f40f3e91b093c99bb8b3616dbac5b0759
SHA512 89dee4845384cd8a9593514790fdf51993682753d9947dd9399abef867e912028fa7d34f7d4dbbb230562d0c6c4a05212980cac812a982cf03549df6d83a2b65
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 5663c411ee278758a8d3bb65fa0e410cb623313109ad05c938e0114192bc1a3a
MD5 7a243cc6a793fb8308b285f755e6b361
SHA1 b9d6ba66ccc567fb4130477030aa1be171c80dfc
SHA512 ad197ed099952aa01600b06212b4015e819a4e3679340ae652a8b27a31ef559fca5cd7e0abaf5ccb493f663ceac26af2bd60a7841fc6b2b21174c48add1ca275
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 1fe5a4f2515881db8306e2328d34fd694730848286fe30c2d8863c8ba1276713
MD5 62d51902e200a2f89cb95c36f2d29312
SHA1 79c3c88ac0888cf73946ce52de91e26d1fa6b6ae
SHA512 1b8d64642780ffc229eadd1dd4581c8a369142dde62a448c36eb4cdcd1e8278aafa19213ecdd4c7a872d1760a5fc0e07e63fa48e0d336b20e95dfeaa6386c743
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 22ae21fa7c6e239153befa055294dfd2154d1400d97b6eca0f19702d77df0ea4
MD5 9d8f15283910c0e7bab0db4d698f1182
SHA1 abefb99212e70b66c7bff74f0c3ef13a107c79bd
SHA512 38d77fdca5895e4649e821020836249716d5e5c7676ca91a3f0cb0744b8571fa7ef480ceca684698bb99fbb5061fe6d2bfd0935387b6726775100d0860f537ea
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 67a6cb24eaedca3113cdfd6c339f9363b0ec5119f60fc179237ade4abf79b0c0
MD5 46167b62ecd347c7b22091c1284296ce
SHA1 71b5418655ac0987e690281568545ca0f8c91a75
SHA512 3f9f9cde8e97a3294690b64f7240381674e363860b86c2446c943168db7e1c3f241d5fe99743a7f2f16f1ed042dda50459ea5b094d99d07f9c460101f6c40453
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 c6d030faf746b82a032b737f49552b69be8fcf5d7f7a52e40eda7752464fb8b8
MD5 565e8f50679ac65969be7e2a6d8d8291
SHA1 a20c87b6336de7fa394663fa7c2e096d3fd04ee3
SHA512 2d67622668c93318b1bdb45a3c25588f895f21c2c03bb2dae84316da7e2fca8c0424a980bb4eafb141777ce075903bc34e04a6217f59b05e57959816aca9a44e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57e177.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e177.TMP
Size 872B
SHA256 8bb905fe7052cf7077a1f0a992696af33753b2e06953c6cb6409485ffe1d4412
MD5 7fadb49f1b61bfa4544add27e212752b
SHA1 af2459247e3eeccdbb4e0638e9b75d824ae689a7
SHA512 19dd094c24a580f8021eb7b7797bb308fccd508180bd57daf2b33103fc96f467116da86257df5d8f398ff9908d774dad6b0c0cb533b10c2ffbbcdbbdbbb45793
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 176e0ece5a5de377536c1e6463297ba2f3f82f8833602c9d4f6b92df4dafbd33
MD5 e842ec4202d8b85276dc1815b4ba2cda
SHA1 e296712c420b0c91ebc39bca0addb9a3638e11e8
SHA512 a8ac1a9f3a90f5d170396e7cc52156797ce3ed022683e4758ac1786408aaf7f5e032ed55897325055d05f51476533e23972cb220901b92866ae591d5bd1d339e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphHEe2RUUCMC2S3z2OMDCRL:A9iIxuERzA83h09RZxYhHqnhdSaOMWRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Skogman Insurance.pdf

Path C:\Users\Admin\Downloads\Skogman Insurance.pdf
Size 48KB
SHA256 b48222bcf05b54c96762328336a17c1aa5ef10095fe9b8a515a252fb0a439f1c
MD5 48bd86f30cdb859f4e9b89054c524852
SHA1 4c4175f4128207338600cd6855c1ad67bede1954
SHA512 4bd6b2055a796047e2674189e99f0b6ffdaf0ad73debcf55fce70fdc6e2e24e143d3f47c154915570335b01ca83bf70860ab07bc47b1232f5d45b302c52233d7
SSDEEP 768:y/IhU/yrJ4xbWELI2tXvaGgysIKvTjViDjXoeWgezuavFm/MyOlgE0jVhXCSxwLn:y7ghIKcDc9gt/ciPhSSxwL8r95s
MD5 SHA1 SHA512 SSDEEP

Submit Download