hxxps://texasdispatchers[.]com/PDF[.]exe

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://texasdispatchers.com/PDF.exe

Score

8^/10

collection discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
82	2420	PDF.exe
88	2708	PDF.exe

Executes dropped EXE 2 IoCs

pid	Process
2420	PDF.exe
2708	PDF.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	MSBuild.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell = "explorer.exe C:\\Users\\Admin\\AppData\\Roaming\\64151745a0664297be205a3502de2a87\\exp.exe"	PDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell = "explorer.exe C:\\Users\\Admin\\AppData\\Roaming\\64151745a0664297be205a3502de2a87\\exp.exe"	PDF.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2420 set thread context of 5352	2420	PDF.exe	118
PID 2708 set thread context of 2784	2708	PDF.exe	124
PID 5352 set thread context of 3152	5352	MSBuild.exe	144

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_506055980\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_687498380\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1622900357\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_506055980\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_506055980\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_687498380\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_687498380\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1789424117\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1789424117\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1622900357\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_506055980\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_687498380\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_687498380\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1789424117\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1789424117\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1622900357\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1622900357\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1622900357\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_506055980\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1789424117\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1789424117\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	MSBuild.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	MSBuild.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133872500283196324"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{7C2FD471-DDBB-4245-AEB3-BDF120ECDF88}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2420	PDF.exe
2420	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
2708	PDF.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe
5352	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	PDF.exe
Token: SeDebugPrivilege	2708	PDF.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe
Token: SeDebugPrivilege	5352	MSBuild.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
5352	MSBuild.exe
3152	rundll32.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 932	2592	msedge.exe	85
PID 2592 wrote to memory of 932	2592	msedge.exe	85
PID 2592 wrote to memory of 2024	2592	msedge.exe	86
PID 2592 wrote to memory of 2024	2592	msedge.exe	86
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 2228	2592	msedge.exe	87
PID 2592 wrote to memory of 2228	2592	msedge.exe	87
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 5452	2592	msedge.exe	88
PID 2592 wrote to memory of 2228	2592	msedge.exe	87
PID 2592 wrote to memory of 2228	2592	msedge.exe	87
PID 2592 wrote to memory of 2228	2592	msedge.exe	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://texasdispatchers.com/PDF.exe
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x244,0x248,0x24c,0x240,0x254,0x7ffa6214f208,0x7ffa6214f214,0x7ffa6214f220
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1808,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2236,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1392,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3516,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3536,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5056,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5624,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6220,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6228,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6040,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6212,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5760,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4876,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5764,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6772,i,2080627418103024726,3376281085540481328,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:5860

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:404

C:\Users\Admin\Downloads\PDF.exe
"C:\Users\Admin\Downloads\PDF.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l51irq0i\l51irq0i.cmdline"
  2⤵
  PID:5196
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES974E.tmp" "c:\Users\Admin\AppData\Local\Temp\l51irq0i\CSC6426E47A4BEE4F4F91B2B43FCD2662B1.TMP"
    3⤵
    PID:5460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
  2⤵
  PID:6040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - outlook_office_path
  - outlook_win_path
  PID:5352
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:3152

C:\Users\Admin\Downloads\PDF.exe
"C:\Users\Admin\Downloads\PDF.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tpz5o2tq\tpz5o2tq.cmdline"
  2⤵
  PID:3832
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEED.tmp" "c:\Users\Admin\AppData\Local\Temp\tpz5o2tq\CSCDC8FC830BAF4416EA191844E67979B80.TMP"
    3⤵
    PID:640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1622900357\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2592_1789424117\manifest.json

Filesize
119B

MD5
f3eb631411fea6b5f0f0d369e1236cb3

SHA1
8366d7cddf1c1ab8ba541e884475697e7028b4e0

SHA256
ebbc79d0fccf58eeaeee58e3acbd3b327c06b5b62fc83ef0128804b00a7025d0

SHA512
4830e03d643b0474726ef93ad379814f4b54471e882c1aec5be17a0147f04cfbe031f8d74960a80be6b6491d3427eca3f06bc88cc06740c2ad4eb08e4d3e4338

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2592_506055980\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2592_506055980\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2592_687498380\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PDF.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1afca246-f576-4632-bbd2-2c76d5cdb929.tmp

Filesize
49KB

MD5
58954d2e7e22f75a0202212e4b78ed8e

SHA1
ca1cccb5f8888e0a70b2832991359223fe63dc65

SHA256
9b104dc88e80307b6af42ca0a969b611539b700e83c60e26594eeec716ccc951

SHA512
08d60ad6f801a05f1c0a924bf3cf0c3612d39be23b5437f441e38a238c88bc1e253b0ea5e2d0a8e983f276152074e54d5320054e4e69557160a3e82a23239eb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\autofill_bypass_cache_forms.json

Filesize
175B

MD5
8060c129d08468ed3f3f3d09f13540ce

SHA1
f979419a76d5abfc89007d91f35412420aeae611

SHA256
b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92

SHA512
99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\edge_autofill_global_block_list.json

Filesize
4KB

MD5
afb6f8315b244d03b262d28e1c5f6fae

SHA1
a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e

SHA256
a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742

SHA512
d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\v1FieldTypes.json

Filesize
509KB

MD5
630f694f05bdfb788a9731d59b7a5bfe

SHA1
689c0e95aaefcbaca002f4e60c51c3610d100b67

SHA256
ad6fdee06aa37e3af6034af935f74b58c1933752478026ceeccf47dc506c8779

SHA512
6ee64baab1af4551851dcef549b49ec1442aa0b67d2149ac9338dc1fe0082ee24f4611fcc76d6b8abeb828ad957a9fa847cbc9c98cdf42dd410d046686b3769b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
60d40d2b37759323c10800b75df359b8

SHA1
f5890e7d8fc1976fe036fea293832d2e9968c05c

SHA256
c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0

SHA512
0c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067

Filesize
916KB

MD5
0ae85dc8f2a72f54f5884b1165e5910a

SHA1
a0010e52c6cecd11a4242802a92ff9d991b2ef0b

SHA256
be8956dbd9963c3aa59f51e81d39408e3f811d42059907f5c3045784155ed0a8

SHA512
3025e5cb43820ffa93cd2e59a475880764b2a2670aa35df35662acd6b7f2632294e2d8dcae362b8e002d81e596139e85054f12f9bcd7d18b82e0c99acaa9d258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b3b54dd05725a727aee9ca2378499e1d

SHA1
8adadc12854e60e7f80b992219f08543be79ac19

SHA256
3f269d7f5b116fd4cd2cfc487e7099254b1252760256fa333b562c82d7360f54

SHA512
3da7aa8b419817da4bf883b6bf4592b6329f1ebd704cd2a75a4854e3b7ab88f6806030723ffd6d09b104a3520f6eb5e8b12389f6672c056e67c39ab6f27903d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
701c51478d8eec71eed4ab017fa7893d

SHA1
3509c0fcf57093fe3409f283ab0450b1c770b0f2

SHA256
bcb3e8f680dad5bd27ec230e11b74efef61825ed7fc481d626c59529383faafb

SHA512
0e0ad5e620e1abea01864ca262d2adbf307c526ee372c95f67d55f8852c1166ae4e8b0cade27b36e9c16209539cf7c2b73f97af08d17ab0a8d67cad01466e900

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
bee75808ff66f9ef963b20da7a132b20

SHA1
b6c670d29a7fddcaffca2d5b7cce18c36e45fc50

SHA256
18f392eae1b0121f58c28fa97a5f5afcef78128c9a100589b69be6aa64c9c7d4

SHA512
df0e5f12db19d8c03dca79a7ef5d393cb959ab8cd167bd92792bd593b60c3c2e7c208b4e141962e05aec51cf62568da15155b34e2dfbf57a5009d42f167333d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
116a4de7527bb5c13e46079a78277deb

SHA1
561c800f6cee83c7ac1baee78a8c6cc23f67749d

SHA256
3dd9a3d9b169d53d8c438498aa8d74eacb2b52e57106447dc20c6633722bceb7

SHA512
d6d2569d69cfcadfd48a093da072f8a784301e0599e0ae24208090053f7d0edef1ec993eaafff227cfb731e1434f88f6cf70e5961407ac132d5aafd8b69fbd65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
5d1a662ae11758f3a57c5fbd56bc292e

SHA1
53d44678c22d8e9a8417c7dc3899942bdf3c62be

SHA256
470cc69a014c463d287617d55f1d077894bf57fd1c323fa09cc3d4e262f735a1

SHA512
950d14e92eb3a62c9aa7271dc964d34e833853e5884f40f1a92ffd8c04afaf01ff6713fbebad67fcc6ed0803b7046a3ed80b52fc3616a042bdb5e5520705b35e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
23KB

MD5
984f0fa41a41d1beec956362b2430e60

SHA1
4cc4112403e1bbc630e27c3e997d416eeda7c7d3

SHA256
92465fb37dcff3d816ddd8c3e6d438cead0bc07c032494e06e754c5266187388

SHA512
33a9e0a46fcf3b29dd8dece3aeeb38dff83bdafc197ac57603e9b9fbe64f74a2591eef173233ec404e62e3febf2606813d901296bb0fb6ed5b9f13080990a25c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
e47459e395f357a0daccc09ea6fde2ec

SHA1
cf707087b449a76fa2bcfd98032ee79403b76a11

SHA256
284a459b5694a74d6660382d63bc09cc3af6d4a155afc8e4715aa01e139026ae

SHA512
a50cdd88ed86cdaba3f891a6f2f4fff1601d3c0bf4523d1ebeb53331ee0fa39a14ee8cf85ff48e74b7cea45cffd6d88e7f78b803dc49797e65c9299cb3fd65c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1c886398-ad4b-463c-959d-abd1fabadd60.tmp

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
b6129d643e5776ba8a7edc2ed5dffee1

SHA1
6acec82ebff4186cb0319b40bb2d2b4e3a632dd2

SHA256
74dc08885825ab3af82ca6984f08c7b3e59d873aad698a2a730ec6e59eadad9c

SHA512
8d56ba04f9539086ed673d9db3991c28811f2a873b362d625d661a8141175e0457807bfec2e6c3df1dc1339de0fb7700e94f6c7664c50e9e6764e30279bfe7ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
b85b28a9cf7fbd62c9814c830e304e7e

SHA1
bbaf2e82e89713ad2efe33903cc949d568b0028c

SHA256
a7ec2a8291efc4c09f77e30b381d81c02ec442beb05fc39a5c8efee97f470d89

SHA512
09df8db20629715406f20de44cfeb0a77bed4856bde4c1f20b50b55fd68d3c430e77a6df9224a9476b4bde6994c151a543c830cba6fcb428acfc93b5b33e4980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
9c62285c2b6701e070f22b17521ba114

SHA1
a6f1ab60ae2c575620f787cba47cfcd927d933a3

SHA256
da776ad207f39a5ef3cbbfba5022fce17bccccd5be5f9f67b722136c98d95df0

SHA512
f0d062f2c4f00915a9d459da5a12fdb4981f24e16821b7ad533a602c3a81188f7fa8a624a0671095603abe2bc8e521d35a8b31c954b01d7692ea689417491621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
3af625cc17f66ba460cbdeefeb8da1a0

SHA1
28eeb5656b8f91b7260215569fb28a69c836ee3f

SHA256
734ba132f4029dc154b7c9981338b4ebeaa74f1bf38344e2317f46eb75ca19bb

SHA512
896425a36b3a0d83110c8fab48dd7522151f76732c1f0d659ead31d3ff55f8eef0c9016b8d938d0f2684cb144dca69b53af17d8c43e115e9b003d2207118c8d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
7fe1d53963c84c6448d5ea8014a6d973

SHA1
201a14e2e399dd9617324ae51d3e068a59cc9ac6

SHA256
dd3efbe3091046b103d9221e4288f8b8180245b07e60597501d9201d4713efbb

SHA512
ce341bbf430c2e12aa81d788913b30b63c82f0706cd21c3d110079ddb5e45cff984a42f5a035592a8ba2e6063e053c39da68bc4d84b039284233173592aeb916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
8f7dbdc13fbdec75137f661c284eaadb

SHA1
f906f0b5a6c689a4a26eafb49f26c070bb99c42b

SHA256
6fd6eb0e9703e2b52f9f9faefe52cef6257070bcfecd280f551a9e7e8168d6df

SHA512
c8d7723be9e76d8a388d0014e49f1e423ba613cf14c71a97f0f91a63c9fd09ef0d5b18cef7578a521be7a99b898adb56515396427c7e1f4487c0f4eba3777659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
cae1098f7a3ee80d343671a6baab965f

SHA1
72a31461d19e7134fd63370e39f0ca68d84d337d

SHA256
b1d5b74805f8c05849f1e18cf642d5f966675c30553d37160481494473862dfd

SHA512
b9f90634ed3c50818076626f6bea68520af805fe235fe79819007ee1a6efcbce7b3900d2aa6589ccd0b29169eddf1bce54d8705ce340409053aff3ac2240c505

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dtyteesue

Filesize
40KB

MD5
ab893875d697a3145af5eed5309bee26

SHA1
c90116149196cbf74ffb453ecb3b12945372ebfa

SHA256
02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba

SHA512
6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES974E.tmp

Filesize
1KB

MD5
39a158dbe55fe918a0463844c20eb07b

SHA1
aa4eb24696ac7c4e45c868cb62d8b48d91e14d27

SHA256
eb5ce4f54d81d372cfd5a5ef7aebea98e59691820de53f1092174d264a859c15

SHA512
2508e9f3458c801f22363d005564f80fa8dfd66c66f5f6ab2903b486afedb0e6752cda9eb02b01a691835066e4bebab51769447828026f0b1e8d87b345e65706

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAEED.tmp

Filesize
1KB

MD5
4ecd7997739cabd478b318bc2d72c980

SHA1
1f4dd2e9a5e40e3f4ac5d70f3fc5bda373d81041

SHA256
f052d82f5b36f9e2785e652780e2a4b10d54f4aa4c993c6b08c180ea1bbb117a

SHA512
d91f6d6fa2e61d46bde337382c03d052b36235c8e2e730fbe33ae9cd40be96fb3ad9ecb8a936c1627e0af860778688aba8d4df0331554b91fff92b5a2bbcaddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\l51irq0i\l51irq0i.dll

Filesize
8KB

MD5
bee7db1133a84ecfa8e1de81920e07f0

SHA1
e447dbac0c89e13926f4241ea41ec5db6e3db136

SHA256
90888fe39d2947728e78fc53b92c9c7ce423d45596a06ca939c85e7b6ceaba6f

SHA512
72122ef64a88cec77353abe04fb961d756b0c654ac6a88a3d99cbd78e526e0b7fa3ace6682a7c7cf450ffcd5bb0831ff433173ddbe978521481453803c3831e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tpz5o2tq\tpz5o2tq.dll

Filesize
8KB

MD5
3324a979008af6f41f945a5096a53768

SHA1
6abf0115b5ff252ae4b2e14eb56a69ca622d6d8b

SHA256
2ff6b07f3371d8af3ed50e51d0e38c10c1bfd4def9664b99a9559912c6c626e3

SHA512
4ecde21d814d6451377033934115a506d877103ed5ef3b3a23608b44ddd1cab6938a66e2d123b499558dfb97ac7bf3f94743df269342425cbd4d44c5b246c352

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l51irq0i\CSC6426E47A4BEE4F4F91B2B43FCD2662B1.TMP

Filesize
652B

MD5
43988f7ddac2b54993bdec067a7d627a

SHA1
0fd029483f99eb629aab22a0ab5969b33dab998e

SHA256
5b668abf9ee6dd5224a025af3b22058e877ea8a7b41199e03dc8987d82e00d59

SHA512
a8564a49bc2cdc4c09544bea21ec1c19a669517d49d181a57fb5b393205db26d6d56a32cb8157e629d4db10f9bfe87c42a7dfbc2e46e406568ae8ba5b495a452

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l51irq0i\l51irq0i.0.cs

Filesize
8KB

MD5
644d7bd8ce8a53d8e623d5242fe4fc96

SHA1
3f78e6807394ee63dfc324118dabe12a59e93121

SHA256
c022f0c4cae953088eb265ad507dfa7e5d65d9ce795280a10c209d5d64221b05

SHA512
5fc3fb7e5c6add1c2228dd17f1887082db0ae104ca8e38ae94a95378ce147aa030854007a3b9a3074efd434c4374c99a05f3ab1359b9e5c9947518cc90a5896b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l51irq0i\l51irq0i.cmdline

Filesize
204B

MD5
ac7a01526a5842ec47ff2d82896c88ab

SHA1
987ccf0ba7cd75c7d12adf815655500d023d859f

SHA256
b89d0e4ddd30ed94ed824cfda6e5e1ac2e76c11368d30fcedbce4c31b35b4a7a

SHA512
cd3207858c79d1ac4b0096caa855d7945371b8b02d85b66e2473875d638fb925f202c236f07511c908da833ae78e92c200d14cd4c53afe544c8fc0604af345f0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tpz5o2tq\CSCDC8FC830BAF4416EA191844E67979B80.TMP

Filesize
652B

MD5
13eb0f794ca9b8c8b1873491007dc602

SHA1
6b41919d743d1eaef48ae48c2b8fb5374cd5ddf9

SHA256
b4ce3c63b5864ffda48d9c1c8184069185f9b5d4874c86927651798019470394

SHA512
f597974fe80a1164084b5009139ce9be60b48aa40af803cce08eb645d18fea1d6ae67092afc2838811b39055d14027cf7e55bb73e5f9ac18cc100073e37cb63e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tpz5o2tq\tpz5o2tq.cmdline

Filesize
204B

MD5
3c395f79710602d7de9364225c728f5b

SHA1
27f1f764e653625d3cde1b445261e2e319bc3343

SHA256
b0d7493811e406769ec2c8194b76cf690880f77a2636d394fe27dced1a94da4f

SHA512
63ca8bec496ff0d2489b296a6d599169dc0303ed54a5310bf91633defa53197b7a256adea92a468fa0c5f9f62b99fb4e5149b50d4835d586c4987b4721ad5fcd

Download Submit
memory/2420-187-0x0000021DA24A0000-0x0000021DA24A8000-memory.dmp

Filesize
32KB

Download
memory/2420-172-0x0000021DA2410000-0x0000021DA2460000-memory.dmp

Filesize
320KB

Download
memory/2420-174-0x0000021DA24C0000-0x0000021DA24DA000-memory.dmp

Filesize
104KB

Download
memory/2708-233-0x000001B89ED80000-0x000001B89ED88000-memory.dmp

Filesize
32KB

Download
memory/2784-237-0x0000000002F90000-0x0000000003522000-memory.dmp

Filesize
5.6MB

Download
memory/2784-240-0x0000000002F90000-0x0000000003522000-memory.dmp

Filesize
5.6MB

Download
memory/2784-243-0x0000000002F90000-0x0000000003522000-memory.dmp

Filesize
5.6MB

Download
memory/3152-497-0x0000028C668B0000-0x0000028C669F0000-memory.dmp

Filesize
1.2MB

Download
memory/3152-495-0x00007FFA6EF90000-0x00007FFA6EF91000-memory.dmp

Filesize
4KB

Download
memory/3152-496-0x0000028C668B0000-0x0000028C669F0000-memory.dmp

Filesize
1.2MB

Download
memory/3152-499-0x0000028C64ED0000-0x0000028C65108000-memory.dmp

Filesize
2.2MB

Download
memory/3152-501-0x0000028C64ED0000-0x0000028C65108000-memory.dmp

Filesize
2.2MB

Download
memory/5352-189-0x0000000000400000-0x0000000000988000-memory.dmp

Filesize
5.5MB

Download
memory/5352-471-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-474-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-477-0x0000000003720000-0x0000000003860000-memory.dmp

Filesize
1.2MB

Download
memory/5352-476-0x0000000003720000-0x0000000003860000-memory.dmp

Filesize
1.2MB

Download
memory/5352-475-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/5352-488-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-472-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-500-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-473-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-498-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-470-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-242-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-241-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-494-0x0000000003720000-0x0000000003860000-memory.dmp

Filesize
1.2MB

Download
memory/5352-493-0x0000000003720000-0x0000000003860000-memory.dmp

Filesize
1.2MB

Download
memory/5352-492-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/5352-491-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-490-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-197-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-198-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-196-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-195-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-194-0x000000006E600000-0x000000006E69D000-memory.dmp

Filesize
628KB

Download
memory/5352-193-0x0000000063280000-0x00000000634BE000-memory.dmp

Filesize
2.2MB

Download
memory/5352-192-0x0000000002FD0000-0x0000000003562000-memory.dmp

Filesize
5.6MB

Download
memory/5352-191-0x0000000000400000-0x0000000000988000-memory.dmp

Filesize
5.5MB

Download