hxxps://get[.]adobe[.]com/ru/reader/download?os=Windows+10&name=Reader+2024[.]002[.]21005+Russian+Windows%2864Bit%29&lang=ru&nativeOs=Windows+10&accepted=cr&declined=mss&preInstalled=&site=landing

Resubmissions

22/08/2024, 21:37

240822-1gmr3a1grm 7

22/08/2024, 21:34

240822-1ev1nayfrb 8

22/08/2024, 16:43

240822-t797qaxdkb 8

22/08/2024, 16:40

240822-t6nbkaxcnh 8

Analysis

max time kernel
295s
max time network
274s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://get.adobe.com/ru/reader/download?os=Windows+10&name=Reader+2024.002.21005+Russian+Windows%2864Bit%29&lang=ru&nativeOs=Windows+10&accepted=cr&declined=mss&preInstalled=&site=landing

Score

8^/10

discovery upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5128	Reader_ru_install.exe
5352	Reader_ru_install.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002347c-79.dat	upx
behavioral1/memory/5128-129-0x0000000000710000-0x0000000000B8D000-memory.dmp	upx
behavioral1/memory/5128-170-0x0000000000710000-0x0000000000B8D000-memory.dmp	upx
behavioral1/memory/5352-185-0x0000000000710000-0x0000000000B8D000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_ru_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_ru_install.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 739118.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
3000	msedge.exe
3000	msedge.exe
1384	identity_helper.exe
1384	identity_helper.exe
4132	msedge.exe
4132	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5128	Reader_ru_install.exe
5128	Reader_ru_install.exe
5128	Reader_ru_install.exe
5128	Reader_ru_install.exe
5352	Reader_ru_install.exe
5352	Reader_ru_install.exe
5352	Reader_ru_install.exe
5352	Reader_ru_install.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3204	3000	msedge.exe	84
PID 3000 wrote to memory of 3204	3000	msedge.exe	84
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 4344	3000	msedge.exe	85
PID 3000 wrote to memory of 368	3000	msedge.exe	86
PID 3000 wrote to memory of 368	3000	msedge.exe	86
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87
PID 3000 wrote to memory of 4880	3000	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://get.adobe.com/ru/reader/download?os=Windows+10&name=Reader+2024.002.21005+Russian+Windows%2864Bit%29&lang=ru&nativeOs=Windows+10&accepted=cr&declined=mss&preInstalled=&site=landing
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83a3746f8,0x7ff83a374708,0x7ff83a374718
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Users\Admin\Downloads\Reader_ru_install.exe
  "C:\Users\Admin\Downloads\Reader_ru_install.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5128
- C:\Users\Admin\Downloads\Reader_ru_install.exe
  "C:\Users\Admin\Downloads\Reader_ru_install.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5512757877165455782,5810412280916942492,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
b2b8b548a88aa5bad9ec7cf91618a538

SHA1
8b725dbeb3b08cc429003f258da24c9c1ac023eb

SHA256
5ff7a4bbdb03709e6cea2085393340115cf1107f102bb79c905860cb969dbad0

SHA512
925313c32559fc7eff2ca09363b6f7f826914c69c4798334e47b847b7e5bbb8e5b00e1bbdb28693dd3fa7e8660dc7d1c5eaa1424ad061d41c8e1fd5e8cfe0761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
9cbe62bc7ba7b50f56797fe6d0076f3a

SHA1
d244570aa0720eaa914862bfea0e0508101971a8

SHA256
1f04e393f299029baee2782e1fed1e2fe44e419ac4eff8a1872f939635a3d610

SHA512
6850375e566dbfb01571541271ebd6e7e329df4d6afc5a3038d71f17c0363226a93110574798c56ba01253632309255fccb623b375f96285c68c9aec11f23799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
7eab65a5087017a677c31140bba6d45f

SHA1
277f35a162a05999c2d9c83190f0bad242b0308c

SHA256
75f7f242a9c4a474af9c9c3fed731ab5fb99ccdf2ae55c9bfeb233bb497c7c29

SHA512
fc377e0050755149960ab9d8653a105f1799f2712229180632d2763c6cb8b0e6e040b115de489a4902b1376fe57a41608d3b7ed2ebd634731067ed7179e1cb42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
704B

MD5
b41501b0847feaddf1f04652e1349223

SHA1
38c6f1bbba34c752563025a14b5545baecbb5d06

SHA256
d5a9e9527760157bab88e9a768145946e5fa5481f25ee613f799bfd11b2d709e

SHA512
d0481a4d87a4acebfca65cf61fa51db6c6126a8863bd032008b24bf87c054702ad9f9fac625b6370080e27d605f9da727518dfe3f2d6dd505743594b5b4d1ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f97a6074ed5f9b0da0258e81f2fe1b4f

SHA1
b1a1570a30ea5a3e356475d9669c70b5158c2251

SHA256
1028bc2b5611f3e943f96812f19aac901c624c70a14527a811f062843839e904

SHA512
c029eb587d23bc868030fc25ed7245e4228fab5692e8e6e5d8b8538ac4ae65ce5011ffae933217177d427ee7696c7abf903c87d94714fb28d1ecfabd151125f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
263dcd5a5791d1bd5f4c23a0c73359a1

SHA1
d784d13eaf94d8a606fff3e52b50f58ed43adf35

SHA256
76ed556a9ed3c1fbb07aa289afbbc21cd52bd23ccf3bf158b79832cb72a55bff

SHA512
4a820bbf1ef8c9da54fd3ae303f2663a8b74f393b424fa9475e21cf983304d17bcbd898cd84c7286fd900dce2c5ac45c3cae2969c26653d8e9ad7e6d657e8ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fd1a29261171c2266df095ef6e95f0ef

SHA1
04eec37b51360a6c731d8cbb53adb5eb659f6ac0

SHA256
9ccd18cfc0a32b61fce42069a970f95526fc24a13181df3c925c8db418e0322a

SHA512
0255b375d5130194589adf8b73fec14e2cf3a979b41c0d91ed010f986089e6cfadde9d81fe0fa2786c01830c9b19d880f81b27a9b51fd2952478af90857d164a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f29d.TMP

Filesize
1KB

MD5
47398346ece0af41a9434a29101d0fb9

SHA1
da9b5245f69479c4879fd783712b84709197b97c

SHA256
45dbd357e28932caf8a4e947cc05441a4dd427352b6012c036864d1d6ff87e90

SHA512
ae30bc4ec3725a956e554dbed45eb499a6367a92d2999e435eceb76f4c9e1d475c05cfb5d2527aaffc10f8fa9537f42e70ecf00f863f92bb8f4ad9f6ed4b1cb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3cfdd48f3d2ce0e8ac11a0dddb289afb

SHA1
74d27979ff0688f58f6646bab7ceee82358c5a34

SHA256
440aeadef7f0c1a5620584ce05269785ae3c75590cfdb5b9c3569b20d937644e

SHA512
d6109d66176846fa75c715e5853f7f0090ec1c331bcac2bff9473a937ec82adade9d50863d222439401a3f1109b34cb8825a80449e643b735ecda44dcb28c23e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a9080d6791011530621400553a608b91

SHA1
0eacc5562c322aee0842a6236fe6a5d3a5f81ead

SHA256
449d13d0de689ff53dae52192fd2228d06f1ea269b3141f52dedc18dda522a48

SHA512
4a4beebf75a341ddc59ca6953a2ee2863d089e14a40c0591fd7901814082fb0342e44350f32880426a5bbdfd1fe43c7614dfc4f18dd4ef7a145cbb23e57e360a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CFIOOOZS\bxf0ivf[1].js

Filesize
17KB

MD5
cfe609917c9e7d4eed2c80563ded171b

SHA1
2e5bbd88b040662bf8023fd6a9d55cc760008695

SHA256
ad84b43ffd121e46ac4d2fa817b5863e4802c523bc3fb5e864db28b3db0e2514

SHA512
1f600e1abf1814c89589462ade13f2e5399082236829eb45a530c852ae135910cb332d540b228da744b60241bc74e85a3e5eb60cbc65b860e8e9148af79c54d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Adobe_ADMLogs\Adobe_ADM.log

Filesize
12KB

MD5
53252c3e35ae73173f0f90e8c89bbe24

SHA1
51616c19141f603935551e6642d53f2b77ea7747

SHA256
cdaaea8da72a6cd7ad18468fb2296e228d6074a54e8570dd0b07fbb3056605e5

SHA512
cf057e460f340466d241117c0e7bd4237a89f7c7f86282d04c2310d673111e93e9b4bf11fb4b4ffdebc9140a7182a959a8e38f920a38da6b6730ebcff97ca2b0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 739118.crdownload

Filesize
1.6MB

MD5
50663d00f6a49163f1a4d41fc60bcbe1

SHA1
bddfae54aee8d9f85884392c51041166df2279de

SHA256
355cca470f7f207650dc41fe0772a2df6e8b91b4c250474ce883df122f3c170c

SHA512
78ff35df6e7072d911f7239ef6fdd8ac6f9a8585fb9607417619d0e6e07f284cf90efc2788b3f11fc5dfce8cca54cb0b36843acb9d90d90a948599cc66c92f6b

Download Submit
memory/5128-170-0x0000000000710000-0x0000000000B8D000-memory.dmp

Filesize
4.5MB

Download
memory/5128-129-0x0000000000710000-0x0000000000B8D000-memory.dmp

Filesize
4.5MB

Download
memory/5352-185-0x0000000000710000-0x0000000000B8D000-memory.dmp

Filesize
4.5MB

Download