hxxps://www[.]dropbox[.]com/l/AAA-t0pYSi6E25vFlsort4UkT8lp8DYVhns

Resubmissions

30/05/2024, 22:44

240530-2ns34add986

30/05/2024, 21:06

240530-zxvxyabb326

Analysis

max time kernel
148s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
30/05/2024, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dropbox.com/l/AAA-t0pYSi6E25vFlsort4UkT8lp8DYVhns
Sample240530-2ns34add98

Score

6^/10

link pdf

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	dropbox.com
17	dropbox.com
21	dropbox.com

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral3/files/0x001900000002ac57-306.dat	pdf_with_link_action

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1474490143-3221292397-4168103503-1000\{DAC9925B-5EEC-4EAD-949C-C7563D6DF517}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Skogman Insurance.pdf:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
3440	msedge.exe
3440	msedge.exe
4640	msedge.exe
4640	msedge.exe
1576	msedge.exe
1736	msedge.exe
1736	msedge.exe
5024	msedge.exe
5024	msedge.exe
3096	identity_helper.exe
3096	identity_helper.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3984	3440	msedge.exe	78
PID 3440 wrote to memory of 3984	3440	msedge.exe	78
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 2884	3440	msedge.exe	80
PID 3440 wrote to memory of 4936	3440	msedge.exe	81
PID 3440 wrote to memory of 4936	3440	msedge.exe	81
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82
PID 3440 wrote to memory of 3764	3440	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/l/AAA-t0pYSi6E25vFlsort4UkT8lp8DYVhns
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffee7483cb8,0x7ffee7483cc8,0x7ffee7483cd8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,6854305142799161153,11601805072094675821,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5
MD5 ade01a8cdbbf61f66497f88012a684d1
SHA1 9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f
SHA512 fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c
MD5 d0f84c55517d34a91f12cccf1d3af583
SHA1 52bd01e6ab1037d31106f8bf6e2552617c201cea
SHA512 94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2637b49097f636651373a52887061a92fcefcf05e156e87157cf47cfad262dea
MD5 e91822124fcbe14f9735b460c3335664
SHA1 1026c739e685cf1333f6d250939ba3010c985981
SHA512 d3c2444fe523e6903fc47ea87e05308ac5dce3697704adb794d82bdd3044fe680988f8e4baaf81d917f5618c4043ad6d92b6783a3eaa206431adceb3a3ef4104
SSDEEP 48:gXrEDoNqXY5/jyXb6Cc+eRHHeIY0ar11XGygkb/cQrNfd+i82p6:gIsAXY5/mXmCcjeIjariy3/V5P8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1004B
SHA256 76af236d84fef8bdf0aebcccb355f81c4f20b8f76d5815f2c1d7f536ac06955f
MD5 a672e8e206027dcbee01dc047c257401
SHA1 b120c2115d99d57191fbbf288b052926654af868
SHA512 8867c6d156b1917a67d55b3e436c707fbe76a7994ce4b29272a638cad8d9c405e1f91702aa5afb97af2d5e160ccd5f0f203c2872a76e492d857bef81d27f873c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a535a5f3a5939e7f98437e7e2c0d41ee0877acf0a92913796608dd366c922a2c
MD5 0912e7acfd7eec5b208a057a27a8a5c9
SHA1 fb1d30ec2f64630fdb9f445e1eb36b60a9af7e76
SHA512 44b4e021a9f049dc4255bc03b72829979d369d1bde0aeb892295109492bee2584b43d3f082d5f347da7233a5a780cbb5ce04c098497f131182421f18c7171dc5
SSDEEP 96:nbk3nicdkR3wSv0MoiVmdHIqJtu0WQyV+VuziX3wI3:nbk3JdkR3v0MAIgtuLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 be93d81e94cbd13c67ae4ce8c08b577f83c00a47c06e8d52e85ec1f9977d0f98
MD5 3e9632f383206e029067214fc08cdf40
SHA1 213b640198cfac0dcd31e20f7d3e46da5032668e
SHA512 1be7d105534b0cbc13bdb3510d2d88e90fa086ed8e99bd840bab3c617bbced8179e5149cae8599859f8487b9997c1771a6c5ba8813c7058bf03e1e20b9859546
SSDEEP 96:nbk3vcdkR3wSv0MoiVmd7uK1jIoJtu0WQyV+VuAiX3wI3:nbk3UdkR3v0MEuKhIutuLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 bb95e79d5c36ab5c4febda839cee7ae9eec971efee7189807b881ecfa2c0e3e0
MD5 9a41bb32c4e4a30d05f897b0005ae6a3
SHA1 a1f3ac047ed94a9e1c95da0c9dd799a8881128ff
SHA512 59aae228ef7b1719cff785b5203feda239e13204f004db7b81e3470c3e9f016fecd73ccd3bcda1f14a4816bef19d0e2d3fa90939989c4d9bb5574f0257859512
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 5283a4a3afe58754654fcf88228542746bd1707a867f7d8681819c762c8e009f
MD5 e01c8eddc339f41822521e7db2a71453
SHA1 1e4375fd922690d8b28dfb10a8d6440bbeb7a599
SHA512 b4a0fb7a327bc5394cd1ce39423ac41be0c3265fd48c2231f3f2b6bf47c5aeaa0e1b10325173dc65ec5907aaf55388154675fc2a889cebdc09da87b02b58841e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 f15019d062c053d18d4a3c0ed2838dc4da363e89928f194f9e6b9373d9be342a
MD5 7fe250a0dd6229565b33917b2b378927
SHA1 352d5a3d99769b2151fde9caf35fd350054a6d27
SHA512 84f4f4e33d9cbe80d67ddadc9c3bde873791bbba892ac6a14056440f04564646432f92115f1811722045aaa5ccf6944a2aae65fed4992bc99fd2302a29f971b8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 43acdef423fa19bc295af80fb2d3b7f7ea2cf8761a387353c983c0890355ed95
MD5 0907deae2ad5b8bcd34f257c09392307
SHA1 c606ce92553482f11e850ebaa23beb0ed504aba4
SHA512 4c2f8bf112b722b3335ef492189b3f46356e5679dd059d927cfc09a6911cb42326f1e39e3fb3a8fbc1143cd1bdea5158facab5ffba74e63c18b63d1abd6c3034
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 8ac06513d43c02899efcfd1a3ac45ea964644fee6d9488c9b90556b0568778df
MD5 7223c84facfa9579436c0531e0d41e10
SHA1 f05b88e105ca03b231c8ec79d1085bef0c7829c3
SHA512 d8ec5280f7c51bc4a59783e2fe6f53bd5ea93ec5244b8e17bbd949fc829417ff8cafd00c07e0288b260f7ee3560b07032e0a4fb48525337b0176e64a7002129f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 58446b54b6baf5cdcd7a8707075575058759838a1716eb9ab414bf2ca26980e6
MD5 9e9cf53cb930cf0ff966f6c34e95c6d3
SHA1 958bc825023f428c4422aae7e067be5f031564f0
SHA512 77319a66c5efe21666d9e276d2117d23292b3830c37b95a19e2014ecb8ddb4d57f722ea51adc55c113792378d96e061d53d191dda44dadb17d63278529f3cbc1
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 5b0c085d8c64295c5bfdff8d28c7382b887250b1253d9070ac82a698fb0322b2
MD5 9e52877cfea76d1254ec369c35289dcc
SHA1 1c48750820a5c5ba8ddc983840bf4dbc189cd05e
SHA512 f6a9bf66c0eb178b4ba290ddf0a2ba6081e5fb8f1d904bd6dba490ddb0df5ca5328012dc1063c721c5bd9b3eaca6d5b67ec250964e23acd1a6e5a8e9d4903efd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 fb56c7c91692e1775f6c77e5c7417f596c180464c0dd2618b8a8347687f5798a
MD5 d8ee71d773e69cce67081dc163af50d0
SHA1 e6634ef0a5a011f91f973016bd2f7a6c6d16b0ea
SHA512 94bc374792b4845e8ad7f0107a7096ddd38fd883b2d8ec63c16108a5fc4a31f4036d63a110647fd123e2deb7d549df432351b84b19e6d2935f68a07f5fc94f13
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5793f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5793f3.TMP
Size 872B
SHA256 c5ed687e4742bd75e38b584fa9cf901018bfd950de286f242e516fbfca6d195b
MD5 fcfddd324b6944b90a882b1a6f2c8865
SHA1 2a2ee4458bc4fea62973e76587297326e7d21078
SHA512 a8575bacdd9a821291499a432c6f6be32f9afef816cd6d4814140acecc480edb1cc28f54ed6e78c7d7295f87fbd9e4b27d3b190dfd34253e3131b1e93b6af4db
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 482c284f799ab9f1ea1b2697aff70e32ec1ef6364b4ae5f16ff0c7098054e343
MD5 90fa907454c064e05801e1a937a9cf67
SHA1 e0e301a62183776bfff4cae3b05d42046010db19
SHA512 0395a742f62839924f55d3d9ed3d19103b1424de8e3e76a157a306ca8bdfa7dae0be1e2af4ba4da307da3c5f85d69d3c486ebe5c9b5aaa87c2d16e95e2577b43
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3SJZe2RUAcRULCAkW7YvmljEWh:M9iIxuERzA83h09RZxA3ONdXLCAkW7Yg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 89c8f92c444b8f8b7bc96129a81df4d9a3d5ab14bcc066731559554cabfacd38
MD5 5256c1ea1f0a4444839e6b083317d660
SHA1 ed484e143622c5f29897690b86ea5fce19f88965
SHA512 5d5ab68dca828c498a6bc21a9c8b003025175b8939e810dc9f7f0eba9d52047ddf030c6d41a06444bb8ea0b3fcf8011c305ae91bb4901da00f8658cc66820f17
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGqJZe2RUAcRULCAZA7YvmljEU:M9iIxuERzA83h09RZxASGWNdXLCAZA71
MD5 SHA1 SHA512 SSDEEP

Submit Download

Skogman Insurance.pdf

Path C:\Users\Admin\Downloads\Skogman Insurance.pdf
Size 48KB
SHA256 b48222bcf05b54c96762328336a17c1aa5ef10095fe9b8a515a252fb0a439f1c
MD5 48bd86f30cdb859f4e9b89054c524852
SHA1 4c4175f4128207338600cd6855c1ad67bede1954
SHA512 4bd6b2055a796047e2674189e99f0b6ffdaf0ad73debcf55fce70fdc6e2e24e143d3f47c154915570335b01ca83bf70860ab07bc47b1232f5d45b302c52233d7
SSDEEP 768:y/IhU/yrJ4xbWELI2tXvaGgysIKvTjViDjXoeWgezuavFm/MyOlgE0jVhXCSxwLn:y7ghIKcDc9gt/ciPhSSxwL8r95s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Skogman Insurance.pdf:Zone.Identifier

Path C:\Users\Admin\Downloads\Skogman Insurance.pdf:Zone.Identifier
Size 416B
SHA256 0cf6206393c323561069755f44637df60e549940c851c47e94bdc43a3ff30602
MD5 6a75baf7cbf292575eb0adf4aa8de542
SHA1 1ef95b36ac1918d2b5d3e24123a1fe1934f19a09
SHA512 89caa69f6efcce7185999b8433f1110e5de398a9a231a0dc1925024146d3298f402f2229f4bd116561b5f1d2d817a44931cc316a10d12d27c8823dada34950d1
MD5 SHA1 SHA512

Submit Download