hxxps://acrobat[.]adobe[.]com/id/urn[:]aaid[:]sc[:]EU[:]3c8ece00-ccc7-4820-8f6c-b5098937fd3a

Resubmissions

15/05/2024, 12:45

240515-py158sab691

15/05/2024, 12:40

240515-pwppesaa521

15/05/2024, 12:27

240515-pm36fshe521

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://acrobat.adobe.com/id/urn:aaid:sc:EU:3c8ece00-ccc7-4820-8f6c-b5098937fd3a
Sample240515-pm36fshe52

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3558294865-3673844354-2255444939-1000\{A1869302-6419-42B6-BB1D-1FE5922C62C4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4012	msedge.exe
4012	msedge.exe
4216	identity_helper.exe
4216	identity_helper.exe
4312	msedge.exe
4312	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 2700	4012	msedge.exe	82
PID 4012 wrote to memory of 2700	4012	msedge.exe	82
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 2140	4012	msedge.exe	83
PID 4012 wrote to memory of 4408	4012	msedge.exe	84
PID 4012 wrote to memory of 4408	4012	msedge.exe	84
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85
PID 4012 wrote to memory of 2752	4012	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:EU:3c8ece00-ccc7-4820-8f6c-b5098937fd3a
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcb3246f8,0x7ffbcb324708,0x7ffbcb324718
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14751253536813505054,2286617006135136336,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 28KB
SHA256 b36c0ef7a9a7b534ca954155d739130410d6a5912822c5ccbbf4bed022990e10
MD5 44ec97a0385f9e5d0979274d94fc1b2c
SHA1 c4b4d934977fea589dda34bdb4ac20a86984ade8
SHA512 8f3839befe5b3003c123259560c7e08a30f24bbbb5c758b89fdd9aaa914cbb53884d46dc39d920ba87904cbd424ff78e33aec83b4b5b8dfb7f3d5e0a05a66270
SSDEEP 768:5u7YwhxOp5OlGUlGgpESKZu/xiY872DJW+:50YTGpLKA/xg7GW+
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5b1d3830c127d614ae21a99bb3e7c8214832f850e3b7e31ebd70ea6e497210d4
MD5 8d99a3c7c7264f029c2b41b1c636b869
SHA1 421931172cb36412c19e72f69d0e6e9b4c22dbc0
SHA512 e1ab4ce3659615b318d6d290e69372fd80130fa639ae63cef0a3ae03cfb2858471eed59c994c734c2695d690e7e7dec9f8f0f39a5b4bd135da1349659216fcbc
SSDEEP 96:UK8hM8bvk23y2boc9Tm6XIT+g+UDMwPCmka4uMg+jaxaa8P:UlD8GlbhW2UwTmkN2++s1P
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 3670d04b75e625af89d9efb2393f1493538038a36df438e187add6dbb65ee101
MD5 c67c18e2cdc5f3b38727f3ec5f57d39b
SHA1 53cc9c9daaf26384116e45ff9cc57f5422cd3ccc
SHA512 cb5d16e0e8a0630d6610584281106d11047138f3f873ee589fa15d4d7732e49cffb73703039d6569379a37946ac4f828ef577e5fdb5b0de965e1d618a2283a6c
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_acrobat.adobe.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_acrobat.adobe.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 3422801d31589b1a6c7e8ca69ca50d180e542c2f084ad2cd47722be417e2824e
MD5 ca4dd7e3c9a2cfaf25703beeefe511ee
SHA1 d471a326db79c3d86b32c854fa30f9bf03e8cde2
SHA512 7accdeb7b251895b636c2fa2c40a3db5c13e2da0038e30ff5ca914dd9d24a7409875c839d27e23e1ada282eceab434f3c0f5f35d9018da65727ca07e6897c3b5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 e1732f40f9a2d9d98aca945f76cebd2eb35f1305643a491a3c474e3f949ad8d2
MD5 d2d87297de87e23796bc95cad60bd2f6
SHA1 fce6652d796618ed0093f332ec0aff3995dc410b
SHA512 e55a20ec70300ee4c4d12315f3c6dfd6573566e92cdb0b0635ee493bb5c676552c18994f55e9a139d51774ab4b87ab8319cd669aa6c907f08015f67db192cb42
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b1cc60bd1e33b580724c4557d144e2615b27869e45b61132dfbc9178952d439a
MD5 b96641491303c3b34517d09dcbaf0135
SHA1 ec2c6df2794413efbad5aaf7010e703bef5513e5
SHA512 06af814ab10fd2cc4439ccadcdccceea299d0316a8a83531ca91ea2a3d21c634d781f4661fe6f0185e75b3686fb97ddd852c4d76d2bc14893116a96febf31863
SSDEEP 96:nZk3xm/pQYmqJ1tT0wpvWMoiVmdeH/zJ5UWQyV+VDCziEwb:nZkcCyzgGWMXTro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e5f2d8b3411829bc84247a3926e72f6a90a621c133a6dc6a04d99c29856f37fc
MD5 e310d6dff359473d6c7c8ad9194f57af
SHA1 509a91f2dc6a5c04e436e61a23ad8f6cc25d3f21
SHA512 12d5dc1bb73a307594bf80eaa32b0d4755691f504e9060a94d68d680db2f207682d366c91dedaf13a7675451625dbcdd6d4f1389de85f1bfd911cf3f913c400f
SSDEEP 96:nZk3xm/pvmqJ1tT0wpiYfWMoiVmdeLud1dK5VS2/XJ5UWQyV+VDkMAiEwb:nZkccyzgnYfWM7udbK5VS2vry
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c17e12e032a2dc01c5cf496f3a11732ad5ebfe544de5c677a2009520311990e0
MD5 3a52203b3d0d2000a72090f1766c8ca7
SHA1 625951119103dd0469d1a8f1a75872a25a16b6fa
SHA512 0cc89e9e7f788588b4626458dc261e69a92d69d0af50a7605d90e2ace3a93fc1137293f9f27efbc25092a2afbec34554654bab0a9923ac3d97c488b60933c302
SSDEEP 96:nZk3xm/pQmqJ1lT0wpiYfWMoieR5mdeDwrj/K5VS2/fJ5UWQyV+VDkNAiEwb:nZkcJyvgnYfWMeZwrTK5VS2Xrn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 93a243d97cec1ed6765172493fa715b095350dbe140ae47f10a1ec28ece88977
MD5 d7c1ff74c0b0130c095f13c4d7f946ad
SHA1 7518ecbf72429ee3fc9fb718b15dc0cd7c9a7d38
SHA512 c6db133f138ff2300bdb609a5bf39e56e6111f35497afce34678478b2c05abc41297f8d47ca3b776526960fad45da4bdfea530f78bd5eddf2ad055012f5f363a
SSDEEP 96:nZk3xm/pMCmqJ1lT0wpiYfWMoieR5mdeDwrj/K5VSK2/fJ5UWQyV+VDkNAiEwb:nZkcGpyvgnYfWMeZwrTK5VSK2Xrn
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\025b6f77-d7ba-4252-854a-e2a22c785e0e\index-dir\the-real-index
Size 72B
SHA256 701305e5cfa96ea7e307fd4d0ba7ec37e895d6c842550c5b0d89ba8cc99957cd
MD5 4f8f4a36e526af2f76d5c31d25e0a008
SHA1 394fe46def7047fef05b6e608b6368df9f1e208e
SHA512 3b61a0e94084e29a37185b187d8c2ce1f18e1b30520c4222abcc509de6ae3489ab85af1bbe7b042a3139a76f2a10b2c724b242b2347db2c332af2a4ad252f388
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57b362.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\025b6f77-d7ba-4252-854a-e2a22c785e0e\index-dir\the-real-index~RFe57b362.TMP
Size 48B
SHA256 8d47d7cd30ea4ab6499533b7acfd360cbdb3a6359ebe206d03e454b10184142b
MD5 55b85e64bd4c36e93f1dc2da714592a4
SHA1 bf689d3e11a21bd211d14c72b48f53675391ef7e
SHA512 745bcfc99b69dffaf0b896c2ef55ee67dd6e51826b47cf99bb792c58d4d9dc72154df8c8cf406fb1d5e3d8300ae7e033b8bc0634a90dc00a749d60385373504b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt
Size 129B
SHA256 894843293d5f2f4cdc19e4829ba88b66c9331c1769e51dbc3ddfe1fb50c61a66
MD5 e6a0b95bb6ef9ea7eca542facbed0c3c
SHA1 6db535319bc77726239c3fbcdfa0051e990c8cfc
SHA512 9ced7cd6cf4089b055c628ee428caac651c8bb4a0dda218da34968f41a32c3fd6b48bf8bc84a8c3b0aaa06a19f741f24c501f040a76bf15347356facb9cfda81
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt
Size 123B
SHA256 932600c5d3e46fa2752774721ddc579d03d91015173464ab2508d23834d0b493
MD5 1ac851c77d781d1c894f70166de79d98
SHA1 f4547b43f10c4b6dbe208c7e79207833e7427503
SHA512 59d44afdac451ef799ea6c704a0be373b9b3d018ac79246248e5f91aaf349f25beb2ea839772ed2c9aef114bcf89705971aa297502284208dabaa2b3b19005e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 eefcef69162d3706fb1ca4424cf64482b44726519e2e4ca91ceaf2bc9031acc4
MD5 9f45c8b2021e12a27abb218f6d2f9933
SHA1 5e6e8131f5fbe401ee6c5871abfc1a5ed7699097
SHA512 2b7cca5e43fe69a76ba7669e13b001e1cafd64b3081f5828741a8746849af7ab480c75719dd2e9a0c645f2e61d7453b07953b87b3ce0917e219c44eb2821afc2
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57b2e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b2e5.TMP
Size 48B
SHA256 061171a20935b7845431b33b4fa2da867cc23ebea41edf7e1208ff0ccc44ea23
MD5 236b27e18f1bd9c324fc7574b02fbf94
SHA1 ee7480f13cf2d8e8a7fd69a05186f5c136c58501
SHA512 c0c15cb26841656caeea37ec33b3a62a49e2375868b0b38d91b2d602f41a49664185da6192f042b6de0a49fe50c35afb220e6896f5985f46e33e73bdbff67f8f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 4b2b406e4f402bc2e23551d5dddac1eefcf336ef3b6690d64d8a1f1629d7354b
MD5 b83a2a7daad3668646389565bd84f650
SHA1 dbd1b94862959b2a02a312a14bfdb4fc53156ce9
SHA512 4ce9fbf7001774756818b3db328656d3046560ed9afd3c0dd7cf7844ee1ec1b512213581a8048452569fc2e9d27da40a1320bf47f3d4ce03e22867c832ac47e4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 5983c3191b6cc3525157155fdcdb3d5c27692ecc279571c3a1b11197f1b89f8d
MD5 148d006fe795b1a549f4eef8e6fecf93
SHA1 4dc27ecb7ef3622e650da537d984ee728a43081a
SHA512 7cd80b24d9c94881bb8846dcb9b9e72f036aa528dc4ef1408d633212b08bb768f3bdee7a3ba8c653004b039199a6b16d3525d68dc7d820973c99d3a6781dcf97
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 3ee08e54c08c6e5c3e2af42ea79a31c19e4964ad4332ec1baeaed3b0639120da
MD5 8f93f51e41bd2380bac6551ad79b72b5
SHA1 37bb086feaf7f196bf15da19b700b83cb3158101
SHA512 c691c65e25f5e01e27d5b3e4721e3e48ab4e3ac9daba1f5d0728b91230806365900a029ac98c39463c326ad216936491874997d819c1703273c173f21b59d1aa
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 6e0b7e308f952e956c12e4802b74f9f55af66b57bcd4dd51b2c7872d718c4132
MD5 b376c2f9921492341e07e5d15772dd38
SHA1 2330dc545d367906157cef3262d0184966679890
SHA512 c5358df829cb8104f1252f5b169351c177b4329002fa4e3998a4ddba9ad647c14bd33f89d87c5a2afdf675323e5800b05fdfb91427c6bb6cb78aa99a7a096d7e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe579b94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579b94.TMP
Size 2KB
SHA256 2f4e14b93e67a2831d550eec406df0db25bca25e977c51ee7c80475966b2e621
MD5 14fd6de5231917e3d6f0fe35b3514823
SHA1 c09effd20146e692d92eb5c8f3272f4b03d0de0f
SHA512 58bfe17fb967511677b5208ce7b0e3d3775051ae5e424e7ee032dd2b8f190bf0515cbb6fa63d99bec7dff7ea2f3bf833d83682654318dafb8022c17894f5cd87
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 42d345025dba53c7e8dfeb5912102d320b1a2c71a36cc3255840ac369ec4caab
MD5 664af8339e6edc6f6d6dcee1a6c4fffd
SHA1 36f089e1ee0433dc11fd4eef62c8c1f35ab074f2
SHA512 83ec4edde4c594256573f912b12d030a1f70282eafcc194b80b11e10a12586f99732b287a8cb2fa2ceac3e9b29a22c487d0b7ef31ea5817e09f41e706fe4db99
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXv4e2RUJmy8+OblfBhDaaM:A9iIxuERzA83h09RZxYf2O8/XDafEBTg
MD5 SHA1 SHA512 SSDEEP

Submit Download