581c27ac57897a3d5e8fc99d3eefd783aead051e050fb5dbf94e41c34976ff1d

Resubmissions

23/01/2024, 16:21

240123-ttwr6scfg2 6

23/01/2024, 15:37

23/01/2024, 14:53

23/01/2024, 14:45

23/01/2024, 14:42

Analysis

max time kernel
317s
max time network
319s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Claim_3456.html
Size

458KB
MD5

9e310a76299c0c8cba40a0bba76bd934
SHA1

7b1507b134ae06ca9182d23cbbd41cffe044473f
SHA256

0d7c8f449cb7261716940fd57bbe6d583aa210cb08440c66038ee83207f9c34e
SHA512

8eaffba06ed0aec2127dd47af3b5e1cc2467b4790f395b1ebf86779a46317dbb9a331d4dc7500cb8b8a50b7ba63ec79ff7aa2c68f8c5b18ff610c82cb1bb1c04
SSDEEP

12288:9UYf1Nq4RLGZtQ9g4fRqAx1GVU8Nk1XEU:JGELSQ955q8j8LU

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\8f86f558-540c-45a7-86a1-b36329f5c3ff\Claim_3456\$RECYCLE.BIN\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\8f86f558-540c-45a7-86a1-b36329f5c3ff\Claim_3456\$RECYCLE.BIN\desktop.ini	7zG.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d347bde384c849be64bb2f1c358fef00000000020000000000106600000001000020000000982df9f908b0e18b04cbb6ddd2ead68fc17e415507a80de09d4de0acfbeada40000000000e8000000002000020000000927630f1291cc1b19cb73ea69c4977d0efb8cd71c29e51bb61e2a6eee0e72369200000008882b0ce14cc3249f2c4e596c35c57f4c2584ad1350e6148d47936030f3af2cf40000000d344edb0edd19eca7d0fd96642767d1bf8b6839033224726c337d4671bba910ca91e2c1a34557c456e147c34428485cf0ff22401d39c34fa23dff38b4c07f823	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412791895"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1559979961"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{82441A98-BA0B-11EE-B6AD-4ECC77D3B663} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1483538247"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d347bde384c849be64bb2f1c358fef00000000020000000000106600000001000020000000a944974a60855d3f97180217239312ba612e86726ab5f79bbd259d1624c6463f000000000e800000000200002000000093824fbf7bbf01f6a070bcbdff63085431dd7f63db7e284e15f68afcc778c9ee200000005638b5d6fbf0599ee3c27231446b5aa2d56304dacf24185274d603a8977833fc40000000314bb50c966207cd8f16beba810ce161a53b6e261518cef55cae6f4003053e01e6613341c9f3ad670c3798aba5d55f92f6bfcc41db2a1552c4314f9534b91839	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607afe61184eda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084056"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1483538247"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084056"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084056"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601b0560184eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
2428	msedge.exe
2428	msedge.exe
1344	identity_helper.exe
1344	identity_helper.exe
4080	msedge.exe
4080	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	1948	7zG.exe
Token: 35	1948	7zG.exe
Token: SeSecurityPrivilege	1948	7zG.exe
Token: SeSecurityPrivilege	1948	7zG.exe
Token: SeRestorePrivilege	2328	7zG.exe
Token: 35	2328	7zG.exe
Token: SeSecurityPrivilege	2328	7zG.exe
Token: SeSecurityPrivilege	2328	7zG.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
764	iexplore.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
1948	7zG.exe
2328	7zG.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
764	iexplore.exe
764	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3052	764	iexplore.exe	89
PID 764 wrote to memory of 3052	764	iexplore.exe	89
PID 764 wrote to memory of 3052	764	iexplore.exe	89
PID 2428 wrote to memory of 3172	2428	msedge.exe	101
PID 2428 wrote to memory of 3172	2428	msedge.exe	101
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 4328	2428	msedge.exe	103
PID 2428 wrote to memory of 3064	2428	msedge.exe	102
PID 2428 wrote to memory of 3064	2428	msedge.exe	102
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104
PID 2428 wrote to memory of 4072	2428	msedge.exe	104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Claim_3456.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:764 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x100,0x128,0x7ff9b5f946f8,0x7ff9b5f94708,0x7ff9b5f94718
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3450918384769230816,14237554245929885199,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5576 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4616

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\8f86f558-540c-45a7-86a1-b36329f5c3ff\" -spe -an -ai#7zMap22246:134:7zEvent6233
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1948

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\8f86f558-540c-45a7-86a1-b36329f5c3ff\Claim_3456\" -spe -an -ai#7zMap8143:156:7zEvent14145
1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /q /c respondents\ibidem.cmd
1⤵
PID:1176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /K respondents\suspect.cmd system star exe
  2⤵
  PID:4028
- - C:\Windows\SysWOW64\replace.exe
    replace C:\Windows\\system32\\starr32.exe C:\Users\Admin\AppData\Local\Temp /A
    3⤵
    PID:4692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /q /c respondents\ibidem.cmd
1⤵
PID:2536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /K respondents\suspect.cmd system star exe
  2⤵
  PID:1632
- - C:\Windows\SysWOW64\replace.exe
    replace C:\Windows\\system32\\starr32.exe C:\Users\Admin\AppData\Local\Temp /A
    3⤵
    PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
b0e04da50e22c31e5a1bcd823b31bc0a

SHA1
834ed42ea8cc071f41030231dfd38dbdd3a92c33

SHA256
b97307b15450163273d276f2918012e7afbcb2dfe9359886402fc7acbc198031

SHA512
37f70063bf02ed58b18dba6b1986fae9d57a6b54cded5d929098dab98fe450e81a8461c59e3f19a7e45c2b59295494264322747427cd1a30cdb3cbdd12238df5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
f3990afbcdf64f1f806d1b926cf35b3d

SHA1
da1297f9ac1e9e9e7e78b567006e9248bfc212f7

SHA256
48c214dd545cc2718f7e844d699efae28f80d683340959e000bb41ad75dd6386

SHA512
9b5bc750b2e1038c82a93d51efe0d7dcf951ca594a62a90bac0ca1019d232afd07f9630e1ba1b609e128a9ba9c23c1ea8f1badd9e6b25f3eb591a936c89ee939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_1362B7791428C28A832A1F1A09A6ACBB

Filesize
472B

MD5
40bd5c9d420c5ef86c805b027b3db1ee

SHA1
f6b7bc9c0bafbda8accabe90624dbaedbd136222

SHA256
367b655565ca3a0bc7ab21dad4d011b596516f1b699a9b3005fe6564325935ce

SHA512
cf593a845d1d06bf6ba998c781d747c30a8236956eeabcebe6da93fbe67c3575559ea49de3fd0e8a9b02df91a853cd59c6ef1a2f237cabb406bb9cb01a1877c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_625B6A317EF9FBF256D00704E8512DA8

Filesize
472B

MD5
b2e9e0f12115ac46c386681bcfae0cfa

SHA1
baf4250748034e5b94084152b14921380a35abb4

SHA256
e596790ba61903df01f7e6849c06c9b80352ae113384c1776e6f8f13f9c022ec

SHA512
0a39aeda67c3f86dafcee9c54ddf49dde181bca94630ff9d6b3618d7841c6f59c3e017d1e6653d0e243a6ee70fc69afae10e24307bfc5d38e29fc6ecc6aa4dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
91222e8b8699bbf4627a78e26b920038

SHA1
af8208b9bc6a68308c3e3fda428d30fa87736e38

SHA256
e31e9b0f794426e0c545f0f719c454769496310c864b748cc4afde527199a007

SHA512
58a3d0c45c6549398e9cdc740e87f81a5c48e4680572ae29f72f421ffc92d49487abf4324ca83e65ffe4188e7e5b202d49ab74e1f03d6aeec6be286006e91cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
bd86a8324d37d2e830c209fb94724e22

SHA1
fda73ec4b200452f35f89288f871e163a5ccf1bc

SHA256
06d9d27355137e9290ed9735ae0a8e0976c1632c08875e9d6c6dc1d7871e0526

SHA512
036b128f15a6a26011eff9d1b61fa8ea081f7c880ca456c9fa67c080cf0cfedc29327832462cedd3ae737097bbf9e281c7105fddb6c467b251e29c11851f4ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_1362B7791428C28A832A1F1A09A6ACBB

Filesize
402B

MD5
18c618c5b4de766de66b9216bb3e7336

SHA1
de39056d78ed2391b7f035993293df765885940a

SHA256
42dff93b24665e76e0905b82d83e18f01ff64f7c229b2d8436c7d9e592e1aebd

SHA512
d963b4d8b817830246b76f4c72b89e87844df3ac67ade0b41badaf84d7cdfa9a9f538e6fd70080a13075e1b31437bff7807ce3101e7ac682c85c55a3b78b12ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_625B6A317EF9FBF256D00704E8512DA8

Filesize
402B

MD5
a3b6b351a6fe6d2d3c3235d31443cc9f

SHA1
dc386965223fb2decfaf41846ec2267c75e42451

SHA256
f35d4f5de965d99244462f82bd13847f115f5ddd2bcf0f19532354798f5b6e81

SHA512
84bb6964263d5f2b2e8592127109969866b1aba4e219fbddb65eb3d2ff3be8d18e52504d7ba708a815727671b61c50f730794ee12f45f7318a83475c2f05c062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
dda286c512c6f11aa953491337d28350

SHA1
3caecb42bb1a44f39fc886308efc87a9e8ca1605

SHA256
3f5f1ef02b8fd9495afbce05e31b596a557498b07c6f36d35ad0c776b72c4343

SHA512
31985459145588bad2bd72647c37dfd4c3f7c46331b024a857c6d303d9ab530738237248cff87fd890dc15937a3b70a0edb950e0a7355ea5b1c170f82f026e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
505B

MD5
b3ed8cff774f05a0c0192cd4e2abb34e

SHA1
4e304eb1237d5a3fe77b888e9aa0da5f1263557e

SHA256
391d9e7fb15c709efedfef606929355ae43600eca367fb2f17feb02b977194a7

SHA512
9b579f9ed9663bb1ad5b4caaf7fe8179abac52b6a120ae09be754f4c2fbf302291e1d538c0aa81352a06cd6a8f168119d14b123a820de79e70921f5fee6cafec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b261c815db01ff3288efdd94e205240b

SHA1
e700b18096486cb55b36d3d3aa492f0d3b208296

SHA256
4f209ca2b9e6932bbbc08c5eee4543c14ec188dc7dd64f33dc7598e02b32d653

SHA512
decc4aec12c992aa3c9dd5c8bc7c4080bb4b975921d6383704b2be85e2182387af320597a23e81f08abdb74a20cea0b152aaa795962f25e7056d3c47a71122d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
412cce323614532296980c0549080d19

SHA1
02e9f9d79b26305a8c5dca0f237be20de974f72f

SHA256
2e0b1bff662047335387c5bf16fdc383c9e3bde00b6db65723bfba26ae25697b

SHA512
22fdf39a4d30c7e73ad5a4c0bb01f212864af2e5d5127e67b454383316463b4bb475ff77fa4768acbe1a3f58b5c2f64d7e460b16a85ddaa649d4ae0623cf3a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
15ca0faafaf502ec2a85f33cf313ffc2

SHA1
9a2047e44024e4485197386a394e92706b074b57

SHA256
88836a5ce80301914cba488d911896a39a936fd83dd57bdd2a1def4b39993354

SHA512
8ee532378b357600be3a6c14118baea3cc684155020faf969f07ffcb6f3f2407e757f31fbc277a7194720fde2dc50b668f8bb40513a71956bd40e15eb3fc0858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
100e22e27e4f791dcbb7f81f79de53a3

SHA1
d5dd1c437873f9af10c06b9a263f7b38474bb0c7

SHA256
37f00704e0d02396d2a430fa4e107a823df437418f59d7db6363cfedd51a0c4f

SHA512
5b360974244eeb8e06594f9fea676f21c22913a48aff0599aa985cfb0a061606c7c2dd911238445f94e1e0b72de60e49d6a30c3be7e08b9a6a894da993f89e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4f6ca95249d5cff0adb224badc20a745

SHA1
cf172579ea8527ca70d38b6dbceae31562788bf0

SHA256
99f0477ada5202266b153d7ebacb4f5d01975685763afbc6873d02008059bb1f

SHA512
59a440c709d805394861486142dd03a49eb144621d376d4c41754b1780e210094f043b7d163f39c3466cec30af4795edd1bcad14c83c25e933eae6a5784fa6dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2bf7cc0bf84857ec9bf67d9eec9006f0

SHA1
cf01260e1bf313f908f49e966a1f3cf362ccf0fc

SHA256
001c5a07d1d860560aa9a8cbc4ed997b1c63739000c33a5ecba07e0cad1de7f5

SHA512
5a8335b91192da9125960f1ef1950df6189df79ed687f505679fa911727a538155fc4e807c2ea162c20daf0b01f9d0698b6b6d649ec3d51996936ae4ea6d9c57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
40e44a47e631dadb0c0afa5b7e0e3442

SHA1
bb3cb835113135e90ba158b11513c21dc0b42cd1

SHA256
3661a16ec6f854c22b8b821df9f32d5a79a0a4b6ab26dc73b8242876becff1a2

SHA512
2e700b4650b63f23d9fb5bf0de71356037ad6f2b9fcc9b0c370c4df0349d46fb68c27a22f215af7428859b2f154cabcb7e9e393fb64024c4e79c750d38bbb377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
253982cc92debf578b54815e2d8d15d6

SHA1
d6ad2036b64fe056c20c3bc76a6065c0719ab6e0

SHA256
dd4a303bc2e6482589b75be1c8468198d211b2ad6c7ffadbb2a4ff5ba704fd11

SHA512
6a2081713d4e94973293dbd973ec6bde9539eed1456ee4d776ee909384354d0edef8b3b0a12ba6ef6decc2d78c9a0f8f4efd0d0e29a98b15fc6c2f223a412073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WHUIQOC9\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\Downloads\8f86f558-540c-45a7-86a1-b36329f5c3ff.zip

Filesize
166KB

MD5
ec89dc412cdd977f6e13211a2d9436f1

SHA1
af5bd84499bdd7d5114525a5270c289722cf4e0d

SHA256
81e94d9ccb2ba94b5d1c34a38c99d9c37dac349ed9f333654f27105ed3e465fe

SHA512
55c0aa58a48a5df77325d3ade72b14765a55b69e301af636901c00230f534d88e823e5a6b964fde64d4703039da4d52196984fc64b290a4a25472addef3f6eab

Download Submit
C:\Users\Admin\Downloads\8f86f558-540c-45a7-86a1-b36329f5c3ff\Claim_3456.vhd

Filesize
6.0MB

MD5
d8d7726066785b3944c3f3172c15694a

SHA1
c10f80584900a02f59ae56164aaec8850128e8f9

SHA256
c26c8b85402c63b4edca9dfbe20a9494143b8978dcf3f681f59c200208866b4b

SHA512
d8a2f851ab5538ca1695335667cd58b9649495d2ec1c8e07c332b5e80e8760477f2e48d81887df54171da3050bcf3f31dc65d41584f49190c13cc22a8561df92

Download Submit
C:\Users\Admin\Downloads\8f86f558-540c-45a7-86a1-b36329f5c3ff\Claim_3456\respondents\ibidem.cmd

Filesize
349B

MD5
8950d4b6c364d85abb15f70088858f2b

SHA1
0dbd1603fb7555d70b2d9f809f97152efd934050

SHA256
32095d63a9dd54a38bddd78140dbe2e9019175cd3ccc94839b9ee1bcac905c68

SHA512
597fe88e77c31382e551bd042abda2ae52fc1503b17aa8a46229e84d5c8b11074366dc8492abe442283d6ec432e6a11d1ea28941e5f0a08272466dce5775cc85

Download Submit
C:\Users\Admin\Downloads\8f86f558-540c-45a7-86a1-b36329f5c3ff\Claim_3456\respondents\suspect.cmd

Filesize
359B

MD5
9a65c4a7de594744d4d90812eead702f

SHA1
0b8d0279b442c949107c771756a6364e400757eb

SHA256
76b79f0f020c13cc1fd59393411edc6ff114b3a52a5ec28139aa90bcfc9f84d0

SHA512
5bf5f0b0cdc4814a5d8451fbe8c79911217677f80c48372ae76eaca9816ff2167220ce846f81f50ccfeff7db7940e5667a2ecee7ac30d6f1fa7d1b3211e16c18

Download Submit