chimera | hxxps://malc0de[.]com/database/

Resubmissions

14-02-2024 17:05

240214-vl6g3sgc5t 10

14-02-2024 17:05

14-02-2024 17:00

14-02-2024 16:55

14-02-2024 16:52

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://malc0de.com/database/

Score

10^/10

chimera ransomware spyware stealer

Malware Config

Signatures

Chimera 58 IoCs

Ransomware which infects local and network files, often distributed via Dropbox links.

ransomware chimera

description	flow	ioc	Process
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\MSIPC\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Common Files\microsoft shared\ClickToRun\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\AugLoop\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\lib\ext\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\lib\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\lib\security\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\PackageManifests\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\security\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\ext\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\dotnet\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
Key created		\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedge.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\lib\security\policy\limited\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\1033\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\VideoLAN\VLC\lua\http\requests\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
	230	bot.whatismyipaddress.com	Process not Found
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\Configuration\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\VideoLAN\VLC\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\lib\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe

Chimera Ransomware Loader DLL 1 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

resource	yara_rule
behavioral1/memory/456-1203-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Renames multiple (353) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
456	HawkEye.exe
760	HawkEye.exe
4032	HawkEye.exe
4912	HawkEye.exe
3660	HawkEye.exe
760	HawkEye.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
228	raw.githubusercontent.com
229	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
230	bot.whatismyipaddress.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page2.jpg	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\5.jpg	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\9.jpg	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_05.jpg	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\tzdb.dat	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\rt.jar	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\5.jpg	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\39.jpg	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\Welcome_Slide01.jpg	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\82.jpg	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	HawkEye.exe
File created	C:\Program Files\Java\jre-1.8\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Excluded.txt	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_th_en_CA_v2.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\README_en_US.txt	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsGenericBackgroundImage.jpg	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\accessibility_poster.jpg	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\rt.jar	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\1.jpg	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\review_poster.jpg	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MissingAlbumArt.jpg	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\javascript_poster.jpg	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\31.jpg	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\3.jpg	HawkEye.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Wood.jpg	HawkEye.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3791175113-1062217823-1177695025-1000\{362F30AD-2572-4043-9D50-8E9F4553A8BC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 263825.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
4116	msedge.exe
4116	msedge.exe
2724	identity_helper.exe
2724	identity_helper.exe
2460	msedge.exe
2460	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	2652	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2652	AUDIODG.EXE
Token: SeDebugPrivilege	456	HawkEye.exe
Token: SeDebugPrivilege	760	HawkEye.exe
Token: SeDebugPrivilege	4032	HawkEye.exe
Token: SeDebugPrivilege	4912	HawkEye.exe
Token: SeDebugPrivilege	3660	HawkEye.exe
Token: SeDebugPrivilege	760	HawkEye.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4112	4116	msedge.exe	86
PID 4116 wrote to memory of 4112	4116	msedge.exe	86
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 2116	4116	msedge.exe	87
PID 4116 wrote to memory of 3772	4116	msedge.exe	88
PID 4116 wrote to memory of 3772	4116	msedge.exe	88
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91
PID 4116 wrote to memory of 2716	4116	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://malc0de.com/database/
1⤵
- Chimera
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd468d46f8,0x7ffd468d4708,0x7ffd468d4718
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Chimera
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4032
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5346857860444741970,18087946523724220427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:1
  2⤵
  PID:3424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1528

C:\Users\Admin\Downloads\HawkEye.exe
"C:\Users\Admin\Downloads\HawkEye.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\YOUR_FILES_ARE_ENCRYPTED.HTML
1⤵
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xbc,0x128,0x7ffd468d46f8,0x7ffd468d4708,0x7ffd468d4718
  2⤵
  PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML

Filesize
4KB

MD5
690ba025605dfdc8ec6bcefe6dc7a032

SHA1
37dfba54586c50143c249e7b042418fb6444dd20

SHA256
d2a5fb7c06b1fb641537c8af0ae96f55bd4779aa720c9fd0d8452c1fdb2e9a54

SHA512
af44a14946cd1cd465c1252271c6e8d1dbe8f4e86b3121104ea495dfd38c114a9b465a52f0bbd309aac95ef23ca5a6c742c3500ed5330b36a3ed5c9a6784ac80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\HawkEye.exe.log

Filesize
20B

MD5
b3ac9d09e3a47d5fd00c37e075a70ecb

SHA1
ad14e6d0e07b00bd10d77a06d68841b20675680b

SHA256
7a23c6e7ccd8811ecdf038d3a89d5c7d68ed37324bae2d4954125d9128fa9432

SHA512
09b609ee1061205aa45b3c954efc6c1a03c8fd6b3011ff88cf2c060e19b1d7fd51ee0cb9d02a39310125f3a66aa0146261bdee3d804f472034df711bc942e316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a920c62-1c37-4939-8316-1a7f0d787d50.tmp

Filesize
5KB

MD5
60ccd77351b640e36ccb50f38fbe3002

SHA1
2db138d579476aecfcf082d790bae42c974752ad

SHA256
08468a322830c225180b994cc9a0814905531f9cc17614727e145f4721f4ada4

SHA512
58e3eec286e37eaa1e02fc220fb0cc44289c2e3252df3b2fb69f822883aafe819c65aa1160aaedd4b78e545f5611b268456999840eaba473daea02812347cfb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\57d28005-d5c0-4375-b3e8-c5752ca902b6.tmp

Filesize
24KB

MD5
b0ba6f0eee8f998b4d78bc4934f5fd17

SHA1
589653d624de363d3e8869c169441b143c1f39ad

SHA256
4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

SHA512
e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
28KB

MD5
e969e99f960c2a9c52616ed38a74af82

SHA1
0dbda7fb75e89704519d6af653cedcb760ad78a4

SHA256
c02e3222ba87462777803058a8bce8a643342db13fbd74f242cd320ef9921d5c

SHA512
8414ba71d1eeba0fcaa37225b321910ad6c7a3930b16ae4ec286a8ad9c4ad93437e6bcc50ec6cfdad6fcaffbb32f2e4c61bbc9ec9053749c91a2d90e3860feb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
1.1MB

MD5
07917e07d6e233b89f4d254dd612aa8d

SHA1
1a4d73470c380be3f01eef133bdb4df32facae85

SHA256
9d4c742ace35aaf98b2824219398d0f433ffdd8eb3337892474f08828ddc4b7f

SHA512
79dc109b9d39e4dc89058080498aa80334ec5c3340dbd556d8a39a30c779dcae2cf405106999c2a5b7883126996dd1c72d94479eb52aaad7e69a9e98c2461c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
0a516a317412934d809225de446f55e1

SHA1
ef9c4af8c0b2ee238fd346889aff98ebf1eb3bb7

SHA256
85c161e7834d5746171a03fc0f0a6fcf3ed5a91f2472a97b0f7ec44f353e1cee

SHA512
9fc33b04a915a8204c7a013aa80c71a64ee8022aa8df4f33ec7afa2e054a2f816d3972f7972fa3b3bd3703a88f7e5f5deeaaafe5d80fe3f91ed5a0cf3e21dab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fdbf6bc9bc681fc2549f9e801fee6b18

SHA1
08c38c233462eb37f0599d0290cb9d6b853d5767

SHA256
fd445f72072e297908c484cf0f9a8115801fff29d2df05f884191c6b0dbf284b

SHA512
27c482694513d658781c0a428ba121d10e93aa258c505184eff6970c38b7b933f193340dea724f1374d2aec8cbd27753d273a6463556c67b33aac42ed377e304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a9596a6bc432934db43926a01ec9e856

SHA1
ea74a46ccc0b4bc37a9e68f5b90c3f59081a4979

SHA256
2b957cba2c310855052b4cf8b7cb1e68cf0ff3db0ac440f4a06c3850026cdee9

SHA512
3a8574e17374797b9eb06eae2e81e572ab69b8e12baddb7315009aa09e3c6b0886e93543a0251e7f056732e76a9e11aa4a6ee38b5ade47dcbb88aea45175607d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
449317218599b3782c3035d4b89fd06f

SHA1
aa888acbef2c23e5d60a82d132ebdc15abc5037d

SHA256
984eea63909fda4909da5d9d2c097facbf086c0a5f9cc1e083aa6dee6851dd3d

SHA512
c935435a36915726064e932304642c62e95bd6ca8ff740e8e1e4d9e69cc6613d1e02fcef543dbd6ea7960c929aad1cafffd3745848080253c9188eae6a0afda5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
81943e3020c75e52311b080513d8a54c

SHA1
3861fec373778c0933762a86235878500cc57ecb

SHA256
ec33b397a4a1988a4c1cb03c494f73f6bea681118f5cc5b8f00c69cc95a3164a

SHA512
9aa3d4848fc3ed023279759185000ebca0d13df106608964c0dccf589e1361c9ee1be8fd72b3573665e696f0acd9def5b3c08cdc9227284902fac5a1c932326d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b32b457ef260c11fa5931728833a086e

SHA1
2dbd4f936adf63651ea414dbecf530fefbdef86a

SHA256
6222d11cf0caff68f3b04c1d59f2f93b536e24041ff96117d7029a7e3ab97881

SHA512
ef5375b7719ac76400023abeb7b3127dc02a96ffb5e8d25ecf144c105118556fb729c8019a4f43e63a0f5c8264dc9abc13c8d2baddb1f701fa568576b9ce6e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b9612779ae537eebc9b83a993e4a888

SHA1
94a812e721e1769fd44c727d6ef345769cf30c67

SHA256
e7df8c9b292424aecead6fc8653b06973ede493af11f8b80d52537733ddc7ee4

SHA512
f13265e978be7e86d1b0db6f0305b353c680677389e936a7f61263c82b2c308969456ce3a3e5a3c7294b7b0ff7a589ea0302bff8e281a46f588c52c71cf5715f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f31f47ba65749f61d583109e03b13e0b

SHA1
c575b7a00f5d59a15746125e1e900698de6890ad

SHA256
58a43b8bd948dfda9ddd4b6495010fff8825bb5891b45e5b0594421d691505b4

SHA512
1fb2130338838287f77b035f51dbd337f887082a4c1690ec0af5c52c741ebdbaa605893f6b6d976a945aac201bb64d4a037186688ca3d24f3e658225aaad042a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c9a45704bfb969bf3f51b3fbcb4aad5

SHA1
f11ca44e6f53dbbf545164172931ec2d5d35b394

SHA256
fe7a2ab9408005bfdde44622e38bb361168234f37cca74ce8c1c5489596b16fa

SHA512
70a8d223f78393fdffc8aec0b1301f169150435b88c3d1c9fce377510bd8ac9ad47258e6bd0cf09f2d422a58b100663b13855c5b66ec008939d3ae2301449977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\99c5d776-3ccc-4ee5-a738-063314f3175d\index-dir\the-real-index

Filesize
144B

MD5
3099f31a0827c2d807f4df3210374c0b

SHA1
0b313c0aa28e64a9a4e25e2cb99b491a4a36e521

SHA256
b0620137e2771b172961db7b925044f1d8e82812615d4db2941bae18a5e83d08

SHA512
b53bedc3a872920ef4d33c5157e8a08bdca1f11ed07373e06c091bd3b363038a1919cdff5fba2d78b798bd52ab5a452275d19c64375ac9a7070c77d19b8ac71e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\99c5d776-3ccc-4ee5-a738-063314f3175d\index-dir\the-real-index~RFe582c3b.TMP

Filesize
48B

MD5
a61b0a1e1b92d0e9f345084e55a03e24

SHA1
9bde5e709ad7045c4870564d84bd0daefc4da102

SHA256
6cb8824bbcfc544798ce76224631fe623ad8b9cbfcb65c84ed80737e27fad43d

SHA512
058b2d920521004cd8159a17d3d21ebc62922194f9af6353bb34db6dee5d776e0118c902dc6d5f27a1713242004241f3372e6b80ff315788a7be7d726542fc29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
5936d8c803c017c8952d3e92ab66f6a9

SHA1
783d30feee159db27b4bade164eba002566395e7

SHA256
8c2698ce7928097248c10cc9fada5927e9572bbffb19cb2d61d5c33419582bc9

SHA512
8dd2a571b0e46985ecc31ce66de8399ac292a4c7d83d9162acc5a751a0cfc828934a1fe864ed8ac40f3edfb78baefb07e5400673afc0c7c516247c53910f3e36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
df36e434d1386050ae6cc80a40506b9b

SHA1
d382219837324d64bc57e72360944fa0d5ae3ba8

SHA256
08af39dd3ebb4106f2ab10ef3de13e21dc90bb4f34c5e6352d4e5587f0464523

SHA512
4a3e3c1849aa5515e14068cc4f7aed7dd0fb261f62be383c90f544f9def2a1995ff0f568e64e219a8563698e38b60cf82505d8c1b1ac4b1855ac00fa91919359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
468f5a11337e8c3c755e743a7ee34b9e

SHA1
6c078ebf1e287933abb2d11d9209fd4082549632

SHA256
8900d678499e6a1ec97ff1c43d9aabce0c30eac0894349818bcde45b367ffef8

SHA512
8ba4244280e08e21b8265fca9fd546adcc8c58906ea55ce11a51f141ce4632d92967f3aa9a82bce6476cfd16916ba7788826255d6e2e1c42ac1d163c3d165ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
83B

MD5
89f8009f049e31d468d92d3ef09f1f32

SHA1
c91d9a2aedcbd5c46e3601b04f91cdebae106492

SHA256
63869b91ac21612d577ce60a12b37cc45a580b2a206f039ae7211c411abe608b

SHA512
871485e6279d69dfae1adbe07a40e89c0e423250c6544f81da3bd7eeca7d571325d6ca33aa2b8d3059a40dbcb42ce80f4980e814efc66c8fee57e3d21628d139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
e22bed56b68f480a229c602aa0414bab

SHA1
50bcf3e760772bf6763d1b2f6f18d204f002cc5e

SHA256
b883b2a66d3578496676a5a7c9e803090e3b3fadf42fe45149809cc81a5ef4d1

SHA512
14005a24da7fc90e5e4ac8d0d976f0a16b17c8fca77e834fd92ebced936946ab3870d10f18c71498e9f5c10fb9d86ae7a9bab1ff3f1850e3d12175eda0b940a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587a5b.TMP

Filesize
48B

MD5
e019cfc1274a0fe03891480657d56e03

SHA1
d3954c548859babf44b2077e4cfc67ac3331b3ef

SHA256
5b28592c63ac380c50e62825ba8c85b0c15c42c8bdf622d5e93725d2cb1668c2

SHA512
effbd8c062d3dfb8b53fe1f9be56d5b383020d2dece2a481bb78b06139e77e0e894f8461a80e1ac9bae3284c9dbde44e7f5ebd400723c9febe52511febeb7a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a97b6dfdcf6a10dcbc30c1518888327f

SHA1
85e427f6ae26f2066b0b8983b3d0db2607d947ae

SHA256
d82cac92e145bb1ae8ccf83688bfcdd6e13ff85e5dba96ebb69f4feb7785bb39

SHA512
f90dfaeca52d2e1181e5d7323a1a8a75b46df5e6a539b69313281376d817c667b1cc660afefd674b1cb7274a660d3119aec04f24275c4262ecdf3d05e80c8b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
114964e0884fa55a0b3e6322ef1c992f

SHA1
c54b97338a5309d3e854c7d0671e7c0868a59329

SHA256
97a3c852c66ae9b8857bf496b11016f86981e0eb86d3e3cfbdd42fe9eb758bce

SHA512
763673f8008d9b0db4a4125a45315240d4c2bbefc21a64caa06fc400cc0c4d22faa8733c4eff7f494d4b8dda63f6ba0a975e0e498d429c6df2528057c773e4c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f11c286637808245e9f44a0f366b63cb

SHA1
0aa04de34da7829c81434966689e0df4365b95cb

SHA256
7e991294b462fead105893bb500437f11f99ebe5c02a4bce8a21fd7c4d442b4b

SHA512
c732c2d99a188c6e47a5a0ff6807fe696f4be06f49f994a3b89d7d6195ccf3f37a2c88934a4add3740682a3fa017d39f200cc73bbfc7b66ace70761ab1dd4b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c3887e1189a9e3b510dda36000bc2d7f

SHA1
6d813bfd6e8671e85d92fc3e5ee063da17b31fee

SHA256
e981217b5c2ed98e43fadbbeec23804f2fec8d402acba78bb3df85b9619c07bf

SHA512
751f58845a1cc0903c9df47b356c56f62c28c8cafcacf71d84210739bfcfe18bb3d8ae3faeffc848aac9368e262a5c4e96c0f454ca3e7d93aac503e681b519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
07f4fda375233c187f15b3a87f940b87

SHA1
91e46ac07a62ae0032289672bc73a90203881e19

SHA256
76b4193a6ce602d55e89a8cecafac4a3b27af4c20c064f914add7ba0ed04d4bf

SHA512
2c7193f5997975a685126cdcc16849d2282b00e508347377c936197a64997a29ee642fc03ba70b6eb83d489de86fd64fd306b4f78531466e1ea8cc8afe7815eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
75dad40b064a90c0a0e01bc477c5ae3e

SHA1
eca8d5b03b0164a0f8df19666ab90e84fe5122a6

SHA256
dfd4766654c18f75b8b352b81d8532f1717466bac4501d1c15f8c98d200ab3f9

SHA512
00fb1168b0465f8741d9ad294be1db9f43502b040502bfb85e67784e7ab1d4a1abc1286aa7e485a3ce98788cecac868b8a710b8343e63bfe7c5adcd72d12d2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
56d7658a7d8ac268595a13eabf3db520

SHA1
444aad06bb267b2d2bcb34a5d73699bbcd1e2848

SHA256
610851a26d19ddb7eb8aadf8e9c4ac16d246c3c3e3fc6f4f71e61f4cc32252a0

SHA512
094eb018a2d7d81faf343d867c072e1a48c8e2ecfbf421ace2114b67011a55bfb570b8a1efb3dc3ca9b9e8b9fbb91a460e4de3bfd7b7fac6f43cc9f944bc5e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1ee533aff2ff2f57a63231df55349ff3

SHA1
d69971fe74f78ddce1307a5a449fbb2c98e61dc6

SHA256
3cedf973d3bafdfbe10aa3576a847db7fd25f4ef433eadce1c15dafc3e461d26

SHA512
0aa9a1a01ddd9c289daea9ef561774a72ecf693739a8ed55812f073119411795867ddd4a4805a6c219d1869d34ac3534187ccb2a52cf6ed18a88a43643e7dd99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57df44.TMP

Filesize
1KB

MD5
801791a22cf37572ecc3460ce5a555a2

SHA1
22610706f4be0e4e35f6d66826b08d5774dfe7e1

SHA256
a84f0f2ec54a35fec1fc63e163358c29fc4f17de8cdaf98b59407dc28d4c9128

SHA512
cd0d200949ee37c4f8be5c8b3725108278546d818726b963d92f720914932f9df9f8569f6e4576fc270142b6b0f42fcc2e2271ba7d9d8236493ed72947a85831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0276ee4b598f8d98459027c5f0c93825

SHA1
7716a5aea1857148ec95c5e4b700acee7315bbeb

SHA256
44ab9cdfa788cd5fb6083d281ac5292780a95359df5b2fcfda68e1666bace71c

SHA512
e4d9c6a379d9c42526204d04356f660f50e49adac51ad8f301f652a2847f77294606f7e1a03798b64616d732751f7761163cb99c00b16358a2600d00d90f35c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
484c29ea02af678d83461ba651e20891

SHA1
1c3ca82b8f2d172684af9c6a7321c7925ad2d29a

SHA256
5ef213f66ebbef200bdda32f4e08d290c91827a2a1a65a0a9787286d17525e4d

SHA512
6692c65a107e34c649477846367b9af13da8c96acfefc22519edd591568e4caf8983cb272315ca6cc40aff4923e467c6e1daa9ef2dd3d1e2a40e36c12479bc68

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 263825.crdownload

Filesize
232KB

MD5
60fabd1a2509b59831876d5e2aa71a6b

SHA1
8b91f3c4f721cb04cc4974fc91056f397ae78faa

SHA256
1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

SHA512
3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

Download Submit
memory/456-1203-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/456-1209-0x0000000004BE0000-0x0000000004BFA000-memory.dmp

Filesize
104KB

Download
memory/456-1212-0x0000000004BE0000-0x0000000004BFA000-memory.dmp

Filesize
104KB

Download
memory/456-1208-0x00000000008D0000-0x00000000009D0000-memory.dmp

Filesize
1024KB

Download
memory/456-1881-0x00000000008D0000-0x00000000009D0000-memory.dmp

Filesize
1024KB

Download
memory/456-1761-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/456-1202-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Filesize
64KB

Download
memory/456-1201-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/456-1200-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/760-1216-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/760-1221-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/760-1951-0x0000000005460000-0x000000000547A000-memory.dmp

Filesize
104KB

Download
memory/760-1942-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/760-1943-0x00000000010C0000-0x00000000011C0000-memory.dmp

Filesize
1024KB

Download
memory/760-1926-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/760-1921-0x0000000001510000-0x0000000001520000-memory.dmp

Filesize
64KB

Download
memory/760-1919-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/760-1222-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/760-1223-0x0000000000B30000-0x0000000000B4A000-memory.dmp

Filesize
104KB

Download
memory/760-1213-0x00000000008C0000-0x00000000008D0000-memory.dmp

Filesize
64KB

Download
memory/760-1211-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/3660-1856-0x00000000012A0000-0x00000000012B0000-memory.dmp

Filesize
64KB

Download
memory/3660-1860-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/3660-1884-0x0000000005300000-0x000000000531A000-memory.dmp

Filesize
104KB

Download
memory/3660-1883-0x0000000000F70000-0x0000000001070000-memory.dmp

Filesize
1024KB

Download
memory/3660-1854-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/3660-1882-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/4032-1307-0x0000000001590000-0x0000000001690000-memory.dmp

Filesize
1024KB

Download
memory/4032-1308-0x0000000001870000-0x000000000188A000-memory.dmp

Filesize
104KB

Download
memory/4032-1286-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/4032-1238-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/4032-1236-0x0000000001900000-0x0000000001910000-memory.dmp

Filesize
64KB

Download
memory/4032-1235-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/4912-1713-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

Filesize
64KB

Download
memory/4912-1732-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/4912-1764-0x0000000005060000-0x000000000507A000-memory.dmp

Filesize
104KB

Download
memory/4912-1762-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/4912-1709-0x0000000075180000-0x0000000075731000-memory.dmp

Filesize
5.7MB

Download
memory/4912-1763-0x0000000000E20000-0x0000000000F20000-memory.dmp

Filesize
1024KB

Download