581c27ac57897a3d5e8fc99d3eefd783aead051e050fb5dbf94e41c34976ff1d

Resubmissions

23/01/2024, 16:21

240123-ttwr6scfg2 6

23/01/2024, 15:37

23/01/2024, 14:53

23/01/2024, 14:45

23/01/2024, 14:42

Analysis

max time kernel
327s
max time network
317s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
23/01/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Claim_3456.html
Size

458KB
MD5

9e310a76299c0c8cba40a0bba76bd934
SHA1

7b1507b134ae06ca9182d23cbbd41cffe044473f
SHA256

0d7c8f449cb7261716940fd57bbe6d583aa210cb08440c66038ee83207f9c34e
SHA512

8eaffba06ed0aec2127dd47af3b5e1cc2467b4790f395b1ebf86779a46317dbb9a331d4dc7500cb8b8a50b7ba63ec79ff7aa2c68f8c5b18ff610c82cb1bb1c04
SSDEEP

12288:9UYf1Nq4RLGZtQ9g4fRqAx1GVU8Nk1XEU:JGELSQ955q8j8LU

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\attachment\Claim_3456\$RECYCLE.BIN\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\attachment\Claim_3456\$RECYCLE.BIN\desktop.ini	7zG.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 60 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "21"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1397673384"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "412808471"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000454e43be9fb3dc4d8011b490b33c5555000000000200000000001066000000010000200000000556d4d079f59c53085fda4bc707edcb9eab56108068c4e501f92d946b8090eb000000000e8000000002000020000000eb60fa24e4a93b75341c9be8c136e67dd55643b7c91e9615baac6f89111ffbcd20000000143c715764cf77feba9a4fc10a43db3c74d51a1e555fed26b2a127b2ee7a8afc40000000d7e43ffbee60559a610de2c83f228e95b1df21ae1c775444707ed80f8791703fa1e196c4c0e4365c9bfbfccb5f5b96a309ebf05d8f6dc14ca9a2e4b6df8c4eec	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084056"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084056"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084056"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1397829897"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "412840463"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412791877"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7EE4E480-BA0B-11EE-89B4-5A7AD0AE14BB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1397673384"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e9f053184eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084056"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1397829897"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a4f553184eda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000454e43be9fb3dc4d8011b490b33c55550000000002000000000010660000000100002000000027d3fb201c4e3198fab40bcc3a2b9303f339cf018829d129d06376ce2df1e663000000000e800000000200002000000046825ee16126d1abded2b874c3355b07f2362c53c68424144e0d432ac5c0f80520000000d14ef2727e70d40f682052681aaee70f0775d74c18dc065815f18b6753e9ae744000000077f67997c67beef7d5295e358460bf953b7b1bb387862bba78f518b60f986e1382541b89dd9c69205afac3190dd8e837b7dd8099e0a3c4b528d625a7a718ec63	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a099834c184eda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "1310"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 90540ebf7b73da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomain = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "1419"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = c08fd7ae4a4eda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "1419"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3c06344d184eda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "1419"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d486b65f184eda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "132"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3d3b704f184eda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a2bb7c49184eda01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "1310"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "1043"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\attachment.zip:Zone.Identifier	firefox.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1608	MicrosoftEdgeCP.exe
1608	MicrosoftEdgeCP.exe
1608	MicrosoftEdgeCP.exe
1608	MicrosoftEdgeCP.exe
1608	MicrosoftEdgeCP.exe
1608	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3932	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3932	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3932	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4544	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4544	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4544	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4544	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3620	firefox.exe
Token: SeDebugPrivilege	3620	firefox.exe
Token: SeDebugPrivilege	3620	firefox.exe
Token: SeRestorePrivilege	1164	7zG.exe
Token: 35	1164	7zG.exe
Token: SeSecurityPrivilege	1164	7zG.exe
Token: SeSecurityPrivilege	1164	7zG.exe
Token: SeDebugPrivilege	3620	firefox.exe
Token: SeDebugPrivilege	3620	firefox.exe
Token: SeDebugPrivilege	3620	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1524	iexplore.exe
3620	firefox.exe
3620	firefox.exe
3620	firefox.exe
3620	firefox.exe
1164	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3620	firefox.exe
3620	firefox.exe
3620	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1524	iexplore.exe
1524	iexplore.exe
3676	IEXPLORE.EXE
3676	IEXPLORE.EXE
3676	IEXPLORE.EXE
3676	IEXPLORE.EXE
3140	MicrosoftEdge.exe
1608	MicrosoftEdgeCP.exe
3932	MicrosoftEdgeCP.exe
3676	IEXPLORE.EXE
1000	MicrosoftEdgeCP.exe
1608	MicrosoftEdgeCP.exe
3620	firefox.exe
3620	firefox.exe
3620	firefox.exe
3620	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3676	1524	iexplore.exe	72
PID 1524 wrote to memory of 3676	1524	iexplore.exe	72
PID 1524 wrote to memory of 3676	1524	iexplore.exe	72
PID 1608 wrote to memory of 4544	1608	MicrosoftEdgeCP.exe	82
PID 1608 wrote to memory of 4544	1608	MicrosoftEdgeCP.exe	82
PID 1608 wrote to memory of 4544	1608	MicrosoftEdgeCP.exe	82
PID 1608 wrote to memory of 4544	1608	MicrosoftEdgeCP.exe	82
PID 1608 wrote to memory of 4544	1608	MicrosoftEdgeCP.exe	82
PID 1608 wrote to memory of 4544	1608	MicrosoftEdgeCP.exe	82
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 4296 wrote to memory of 3620	4296	firefox.exe	90
PID 3620 wrote to memory of 3436	3620	firefox.exe	91
PID 3620 wrote to memory of 3436	3620	firefox.exe	91
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92
PID 3620 wrote to memory of 700	3620	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Claim_3456.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1524 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3676

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3140

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1000

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4552

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:660

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3552

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3620.0.1866967463\1222144668" -parentBuildID 20221007134813 -prefsHandle 1724 -prefMapHandle 1712 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {69d00dea-d24c-4a8b-a712-3af6a9233cb7} 3620 "\\.\pipe\gecko-crash-server-pipe.3620" 1808 1c7617d0858 gpu
    3⤵
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3620.1.1743865279\1493769167" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2743f31-c0c4-4b31-902d-696ef7ddbd12} 3620 "\\.\pipe\gecko-crash-server-pipe.3620" 2164 1c7612e5858 socket
    3⤵
    PID:700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3620.2.397977926\1845441131" -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 2724 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b056ee86-9618-4bda-9343-204dce4576bb} 3620 "\\.\pipe\gecko-crash-server-pipe.3620" 2736 1c761765558 tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3620.3.2085756738\1372038126" -childID 2 -isForBrowser -prefsHandle 3488 -prefMapHandle 3484 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6ac773e-9149-4e28-a748-4bf7019dbef1} 3620 "\\.\pipe\gecko-crash-server-pipe.3620" 3500 1c763e95458 tab
    3⤵
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3620.4.2001768194\59435327" -childID 3 -isForBrowser -prefsHandle 3904 -prefMapHandle 3888 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {385012e2-6c60-42a0-9e8e-19bf59a1f301} 3620 "\\.\pipe\gecko-crash-server-pipe.3620" 3920 1c7671ade58 tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3620.5.2098441752\202444596" -childID 4 -isForBrowser -prefsHandle 4880 -prefMapHandle 4088 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {892965e8-fea2-406e-a051-8c07fcfd4b1c} 3620 "\\.\pipe\gecko-crash-server-pipe.3620" 4792 1c763e05c58 tab
    3⤵
    PID:6008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3620.7.1379856767\998911096" -childID 6 -isForBrowser -prefsHandle 5216 -prefMapHandle 5220 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d9465ec-cdd3-4341-9be6-80e90a54918d} 3620 "\\.\pipe\gecko-crash-server-pipe.3620" 5208 1c763e06558 tab
    3⤵
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3620.6.1605869948\1848102996" -childID 5 -isForBrowser -prefsHandle 5080 -prefMapHandle 4908 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26b0b279-b35e-40f6-bc06-babf5852fb18} 3620 "\\.\pipe\gecko-crash-server-pipe.3620" 5096 1c763e05058 tab
    3⤵
    PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3620.8.316847838\811959141" -childID 7 -isForBrowser -prefsHandle 4836 -prefMapHandle 5448 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3351af83-c27c-42b3-9b91-f515a166c0f7} 3620 "\\.\pipe\gecko-crash-server-pipe.3620" 5296 1c76801fa58 tab
    3⤵
    PID:5404

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\attachment\Claim_3456\" -spe -an -ai#7zMap27604:104:7zEvent9114
1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1164

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /q /c respondents\ibidem.cmd
1⤵
PID:2348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /K respondents\suspect.cmd system star exe
  2⤵
  PID:3164
- - C:\Windows\SysWOW64\replace.exe
    replace C:\Windows\\system32\\starr32.exe C:\Users\Admin\AppData\Local\Temp /A
    3⤵
    PID:3524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /q /c respondents\ibidem.cmd
1⤵
PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /K respondents\suspect.cmd system star exe
  2⤵
  PID:6136
- - C:\Windows\SysWOW64\replace.exe
    replace C:\Windows\\system32\\starr32.exe C:\Users\Admin\AppData\Local\Temp /A
    3⤵
    PID:5788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
f3990afbcdf64f1f806d1b926cf35b3d

SHA1
da1297f9ac1e9e9e7e78b567006e9248bfc212f7

SHA256
48c214dd545cc2718f7e844d699efae28f80d683340959e000bb41ad75dd6386

SHA512
9b5bc750b2e1038c82a93d51efe0d7dcf951ca594a62a90bac0ca1019d232afd07f9630e1ba1b609e128a9ba9c23c1ea8f1badd9e6b25f3eb591a936c89ee939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
198c9ccfee4925e9410a9e275a64d225

SHA1
df2ac2717a4849e27a5c18ceb494334d170c9b85

SHA256
856f2f4e73c1a21201a9a1aff8943014ff8d36625104d2a6ea595a3de0f80326

SHA512
51e5de5c133ebad211a47ab9f3a1fc218d29ef8aa6e93871d34783fbbf2643c3706260ac94de356e2149503df373f3ed3782417363046239c9e16b8da6bb457b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
a3dd80ebbea4f5c3646d0bc8318f5dbf

SHA1
545c78a5b36bd270349c3a3b8fe1df00803040ff

SHA256
6bc4378a19803f7881321b9f604985f7b6fd792bf64e3117c07554dcc7cb2bce

SHA512
1a7a5146ed1bc16b74d7eb1c6b4763215fd96d2f4de322f3e15f4ba1903227c34f0e4581a14ebc56492551abc2d63ae1899b7b1e14a65127c106bd4dbaf766ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verECE0.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVCMQBFA\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YLFDN1IZ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WHXPCKUD.cookie

Filesize
541B

MD5
27d376193c519747868dd395a6ba57ea

SHA1
f5d4c49075676f9066c4aa9414bf3b30454ac65a

SHA256
c683beb3bb63dba66a08bd61042b9265f373ddcf9332fb15ab4ebbb1d3287e3f

SHA512
d6824214dc59d6943c09dea7db9f43ecaedc868efaafbce9f7e2c7bdaaa4de68faa6c2209dc8ac1ed9333b3e4b0c44634e39e06ef8657af1ea58d1b923c058a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\cache2\entries\77FB5EE92C576E2505C8C9FF2EC417D7727F401E

Filesize
13KB

MD5
ab94bf628e826adae510ae27708ce62a

SHA1
40241725eb5c7048d54919e2e0b3bd6a61cc9899

SHA256
2d6d8c251ced23287badb348f9c6b390cb7738d10608f9d77f0160890707122c

SHA512
a55a0cfaf0cceca492318167757055145154486823d6145690d69838531bfb18d7910b5d167475ad10bed5be2ce3da524af4b644f83e64feecddb1b0cf6fb949

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\NVANMQ1V\instrument22[1].htm

Filesize
2KB

MD5
ec098d4e1a36718ea29833d4af0f011b

SHA1
938c8a202fd2710c4f1d0792375c47149aa64b98

SHA256
bc4163aabf74b8fd1eb2cbb57255869c815f9bf9f01ea1da5b3b66adaed34dca

SHA512
837bbd530eb2d1e75d6048abfc15c398016a8032331fd8740634b3d7cd67bcb7d9a11e78b6bad6496678639fc816223bf9c90695e3e81fc11683bf65f0bc07d4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\SZONDNRQ\rules[1].xml

Filesize
1.2MB

MD5
a87271512937a308ca9442032a0029e9

SHA1
bc5fd38d28683bfdf4556a499bd8184159d29301

SHA256
70e8f749d63636609f3d60d85c00e7a1230faccc59adcc9ead0bb9101e7d53a6

SHA512
d60944a41ff8969de33eecb68dbb02e09005922b5eae87e39e28e52669edbc65c605f181a82f4eac58b4fa9b0f64669d9dfc3a6e052a9d873c02bd52a821ec83

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\UON0YFYA.cookie

Filesize
282B

MD5
2f1576134cc6a6c6dc9031e6675bf068

SHA1
5775b5936dce86d63f1a982b172eec52d591f686

SHA256
9f9004ff12940ed633779ace0ac8d437b98a6739b86cceb760275f05cbec1f1a

SHA512
2cea309cce814c994d7c1a16f375468375c9ec591c8d68506a4efecac417d47d3eef4da94e3fe47a0cb7f3cbae1d81c149408af54493f4f5bcf2d5011b789582

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\VF0XMTOD.cookie

Filesize
102B

MD5
5f80e560c75208a2dd8c57d4a2da3f3f

SHA1
d1ac158e3a07941dda73fccbfbde48a1da5ff58d

SHA256
c5086abff1d7af8939e1e56d95b8b0ad3ae5ab28d4eaf05da99ea3f3a36461fc

SHA512
a91bd2fa0d6d3b2aadf99265b53078dc08d1246bb1322acd9c32cc084643a4b80d0be1e6de2cad1e718454358dc633acd2c4c01554b83032c1a5502a46287b99

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
1004KB

MD5
74dbca452c3db420b81e557d329ff190

SHA1
689d44613a21cbe9a10e908e3cea055e004e3f14

SHA256
de021afef248bdec5616fc9503a0124c079377928ac71ca1bedbbdef62870f3c

SHA512
fc550e585cf614907107b3debd6e7b454ab9389942b2ca703185451fbf9e924d69bb67efe6d228a5b90775a3fc5b7662a98b25a0f171c87f4da428300748cad3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
7b4e3c5d94b4785dffb3b720971f6fbf

SHA1
d250a2e9123eea512c22188bb66b6ff5fb3a5b62

SHA256
a7eba6a31905f9088216d7807959651d8a4599f6a686a04c02c3bbbabde3628a

SHA512
28cf9e7cfd333497b27fc5fdf538bc10d5d519b98d887b1c8a288dd9b00a3d962aea16fa17cc5cc8453841934735d58e02eda7c0ab5a5a7bcf91bdcd4b6181a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\datareporting\glean\pending_pings\04f4fccc-ab38-42e5-b3c1-87d32342e0a8

Filesize
11KB

MD5
a21af8fd468c19d1d672da87cc50a312

SHA1
2bfc0248b807766174490466ae83aaabe7224e62

SHA256
92eca7380b26d93e1a03090467c4dec45c461ab2ecb696a5eaaeab0a31dd303c

SHA512
08f1b92547b87de10474610698877a65b6568f904769a10758e4f68272f4d63259278004808e0cfafccce2dc8c2da030fb4243e3de7f52d348293f05ce20c22e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\datareporting\glean\pending_pings\b85524b2-2998-42ff-a403-e327b9b68ddd

Filesize
746B

MD5
0b41456898122d5683c9a9eb16c42707

SHA1
b0c8de97fa27af55035fa766bbd7a1a18dfe2665

SHA256
e7e62e516d772c4e0b5d8e5b3252dda5afddaa1ec0a213cbeba86cf425338d86

SHA512
02a108f41176613b6ca8916c913f0ceb70e6751af98a094cb9edf3224181fb136ccede2f01b793dc4be8a03609e9c7cd13291039d01954dd5ee29780041a7dbe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
1.5MB

MD5
3fd35d189fd1443a3a2e959fe6cc24b6

SHA1
44ac12c32008b9e620a7b5174ad6b0450f945248

SHA256
12799abc340f0b4223097862cf259ac96644c21da445d966310b48b9c7c82d9e

SHA512
c16d94baf9e80116b772bf292b6fb0234d026786718af125a475ba3ab03992ae8d9ce4c34b4c4eea3f0666271dba90ad57c714a26371f92d9b527581404ba24c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\prefs-1.js

Filesize
7KB

MD5
fb652a713d40e804f941660ee4186295

SHA1
6c443d9e2f1f0d508f8628cf95201e76479ee707

SHA256
15a530b4c20f4ddeab0a4b68bbea6dffd59ff56cb8e2e20a81181d61d486cac9

SHA512
0c437d6006c7e0228170e5c286515fa7e15543e0d9606c7a59c2b8202231355e0783abdb866e0bb4aff30c8696ef07296dced2b8dec60f1c885a656b1750ddc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\prefs-1.js

Filesize
6KB

MD5
5947dc1ddfe81375fc1ca2e37a9686d3

SHA1
7b39bbb48ebf17ae2aaf098deb45f5e422248e50

SHA256
594070186bd7da2702b7f40d71d0adb41f49603c64937ef66e21b344eee92f34

SHA512
c79d0b82584433b9b53fca4d46d0bb4623bb8c0c891c38274fe897766a5196b42e3a7b16c0ace8db031d6e42faf6cb0b61366c5dbe6fb641da8a0d9531fb3a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\prefs.js

Filesize
6KB

MD5
8a15b03927e717ac1ac4bea70e86fdd7

SHA1
25908de94c0b9fbf22699f72b09a600c362e93e3

SHA256
a52122c415ce40982b08a92013c38679ec037758985f0604b5603ac2789c1a4f

SHA512
1a26a0e1242a490dda47d14e9072ac261f9ef9f43b0f18c47bf2f61374cf1aab735dae37bf3a71d17063f36926b7e7c33c552d82af9b8d518364b1d563a14eb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\prefs.js

Filesize
6KB

MD5
1c5b56b82db3df0074eceeab26572226

SHA1
74a0222419771ec21833e28d7381f3c95785e0f7

SHA256
0b4422d4b902c6a0bb4ef01e22da771e7d223813072b87a362bc958115ff7e06

SHA512
1d2f982b1322e56e3f2c27e2dd63b75b534f9806896732a5dd418546b85bbf0a5fa0075fd9f6ef1cb04c99ab8ca267691486e9780788d64d4d4bbb7b0ecc167a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
57043101bc196fba57065cb942b859ed

SHA1
2477c113179d7fa0f272850e936959f7ba277a4a

SHA256
5b00558d88abd24fd0a987885c34aa984bf1ad2e4eb1788879518a7c88118573

SHA512
175984735f092badfe1e9d30a1c77f1bf525d89ec2b0c31087d7a0520fafdbacdc782e2d3c831cb69c69ba52891fea77c739041a3438e433f35165c4e78a02f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
cd29ddc77348fd48ea7ada58bc2b57f2

SHA1
9fb34384c77befe1a608a4e50f79797ca62c24db

SHA256
dada1cd1870187631abc2da21ebd5cc4918ee19163570d9dfed7d37ccfaa7318

SHA512
25f84c2a8c0b4f326daedf77b4a20384347ebd4aff998d6422b3d186ae72a1582d1ac86c11ba924b90a900b6c341b32e171e6d2453c6ca352e91137ca47dd2d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
7.5MB

MD5
66139d0d5e34254c3b70d211ad57fd66

SHA1
e5fde6c349b4cd54bfe43fc5a5f7abe718db0227

SHA256
eac20287894e482915446cd051b269412906c5a9beefc1667243c8adc3e03a9a

SHA512
0d64c99ec0dad2f82b011d995ce6d1c4c8faeb0b0e17de91ecdbd19893666b0e479b6badc481e591915c40bb69ea6019ba59fa80f0c09158405bf6a7aaf6cd55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
4886dc7b3764ae9d033ff05a296cc346

SHA1
e7b4b938c8db408c0be4c3469546b0b63e1a5e9d

SHA256
8a41ffe10b741de55355ada5a501348f062463bf2b50058e26b70f0486818adf

SHA512
85e40690ab4d2a340509506a8acafa5765fa1239bd1520703d0d40ea8a7e005b3e2596ff5f3e4cbe3e4dc8b40dfe565da2e5ec82d33d7b42d03ac614cd8eee27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.3MB

MD5
e5bc4c45c1eca78854cde0079064e73f

SHA1
3bd98851ad7b637d493ff7ee333dec1128f8440d

SHA256
c8e40d044a3d1c0316cb76aad54584723471f4f1bdfc0d4e936fd61a1148f78b

SHA512
5cb4c0fe83b2682a4ddf41d0bffec5ed42268e3f4572c560382524a160cdbf9052fa33d388d14531b36e98f346035f3ef27dd565b8a1dbaece69179f0cdbbb44

Download Submit
C:\Users\Admin\Downloads\attachment\Claim_3456\respondents\ibidem.cmd

Filesize
349B

MD5
8950d4b6c364d85abb15f70088858f2b

SHA1
0dbd1603fb7555d70b2d9f809f97152efd934050

SHA256
32095d63a9dd54a38bddd78140dbe2e9019175cd3ccc94839b9ee1bcac905c68

SHA512
597fe88e77c31382e551bd042abda2ae52fc1503b17aa8a46229e84d5c8b11074366dc8492abe442283d6ec432e6a11d1ea28941e5f0a08272466dce5775cc85

Download Submit
C:\Users\Admin\Downloads\attachment\Claim_3456\respondents\suspect.cmd

Filesize
359B

MD5
9a65c4a7de594744d4d90812eead702f

SHA1
0b8d0279b442c949107c771756a6364e400757eb

SHA256
76b79f0f020c13cc1fd59393411edc6ff114b3a52a5ec28139aa90bcfc9f84d0

SHA512
5bf5f0b0cdc4814a5d8451fbe8c79911217677f80c48372ae76eaca9816ff2167220ce846f81f50ccfeff7db7940e5667a2ecee7ac30d6f1fa7d1b3211e16c18

Download Submit
C:\Users\Admin\Downloads\eIDRydn6.zip.part

Filesize
166KB

MD5
ec89dc412cdd977f6e13211a2d9436f1

SHA1
af5bd84499bdd7d5114525a5270c289722cf4e0d

SHA256
81e94d9ccb2ba94b5d1c34a38c99d9c37dac349ed9f333654f27105ed3e465fe

SHA512
55c0aa58a48a5df77325d3ade72b14765a55b69e301af636901c00230f534d88e823e5a6b964fde64d4703039da4d52196984fc64b290a4a25472addef3f6eab

Download Submit
memory/1000-137-0x000002423F610000-0x000002423F630000-memory.dmp

Filesize
128KB

Download
memory/3140-23-0x0000020C5D420000-0x0000020C5D430000-memory.dmp

Filesize
64KB

Download
memory/3140-58-0x0000020C5D700000-0x0000020C5D702000-memory.dmp

Filesize
8KB

Download
memory/3140-309-0x0000020C656D0000-0x0000020C656D1000-memory.dmp

Filesize
4KB

Download
memory/3140-39-0x0000020C5DD00000-0x0000020C5DD10000-memory.dmp

Filesize
64KB

Download
memory/3140-308-0x0000020C640F0000-0x0000020C640F1000-memory.dmp

Filesize
4KB

Download
memory/4544-221-0x00000140B4CB0000-0x00000140B4CB2000-memory.dmp

Filesize
8KB

Download
memory/4544-223-0x00000140B4CD0000-0x00000140B4CD2000-memory.dmp

Filesize
8KB

Download
memory/4544-217-0x00000140B4BD0000-0x00000140B4BD2000-memory.dmp

Filesize
8KB

Download
memory/4544-219-0x00000140B4BF0000-0x00000140B4BF2000-memory.dmp

Filesize
8KB

Download
memory/4544-213-0x00000140B4B90000-0x00000140B4B92000-memory.dmp

Filesize
8KB

Download
memory/4544-215-0x00000140B4BB0000-0x00000140B4BB2000-memory.dmp

Filesize
8KB

Download