chimera | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

10-09-2024 00:42

240910-a2qfkszfpb 10

10-09-2024 00:35

10-09-2024 00:23

10-09-2024 00:18

10-09-2024 00:06

Analysis

max time kernel
355s
max time network
366s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-09-2024 00:42

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

chimera defense_evasion discovery evasion macro macro_on_action ransomware spyware stealer trojan upx

Malware Config

Signatures

Chimera 52 IoCs

Ransomware which infects local and network files, often distributed via Dropbox links.

ransomware chimera

description	flow	ioc	Process
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
Key created		\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedge.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\ext\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jre-1.8\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\VideoLAN\VLC\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jdk-1.8\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\1033\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jdk-1.8\jre\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\security\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\AugLoop\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\dotnet\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jre-1.8\lib\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
	20	bot.whatismyipaddress.com	Process not Found
File created		C:\Program Files\Microsoft Office\root\Office16\Configuration\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jre-1.8\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jdk-1.8\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\MSIPC\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Common Files\microsoft shared\ClickToRun\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\VideoLAN\VLC\lua\http\requests\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe

Chimera Ransomware Loader DLL 1 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

resource	yara_rule
behavioral1/memory/5096-1015-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Renames multiple (299) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x000400000002ab75-257.dat	office_macro_on_action

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DB.EXE

Executes dropped EXE 7 IoCs

pid	Process
3676	AgentTesla.exe
5096	HawkEye.exe
5844	Ana.exe
5720	AV.EXE
1732	AV2.EXE
2188	DB.EXE
5164	EN.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000200000002ab92-1973.dat	upx
behavioral1/files/0x000100000002ab9d-2076.dat	upx
behavioral1/memory/2188-2084-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/files/0x000100000002ab9e-2086.dat	upx
behavioral1/memory/2188-2093-0x0000000000770000-0x0000000000803000-memory.dmp	upx
behavioral1/memory/2188-2089-0x0000000000770000-0x0000000000803000-memory.dmp	upx
behavioral1/memory/2188-2094-0x0000000000770000-0x0000000000803000-memory.dmp	upx
behavioral1/memory/5164-2099-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/5164-2119-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DB.EXE

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
31	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	bot.whatismyipaddress.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-2.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page2.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat	AgentTesla.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar	AgentTesla.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	AgentTesla.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\music_welcome_page.jpg	AgentTesla.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar	AgentTesla.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar	AgentTesla.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_Watercolor_Thumbnail_Dark.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	AgentTesla.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	AgentTesla.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml	AgentTesla.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\bg2.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Spring_Thumbnail.jpg	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_AutumnLeaves_Thumbnail.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml	AgentTesla.exe
File created	C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Winter_Thumbnail.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page1.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt	AgentTesla.exe
File created	C:\Program Files\Microsoft Office\root\Office16\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_SpringDandelion_Thumbnail.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\1.jpg	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll	AgentTesla.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_Watercolor_Thumbnail.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_Watercolor_Background_Dark.jpg	AgentTesla.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{642CA0DD-F336-4FCA-A100-6D6D7613B27D}\8tr.exe:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{8D1F7270-4528-4CD6-BEB8-EB1DA1300144}\8tr.exe:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\Downloads\HawkEye.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AgentTesla.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ana.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ArcticBomb.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentTesla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HawkEye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ana.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EN.EXE

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 918160.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 128769.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AgentTesla.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ArcticBomb.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\metrofax.doc:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{642CA0DD-F336-4FCA-A100-6D6D7613B27D}\8tr.exe:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{8D1F7270-4528-4CD6-BEB8-EB1DA1300144}\8tr.exe:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 287767.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 899412.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ana.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 6 IoCs

pid	Process
1156	WINWORD.EXE
1156	WINWORD.EXE
3692	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
776	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
5436	msedge.exe
5436	msedge.exe
4460	identity_helper.exe
4460	identity_helper.exe
4140	msedge.exe
4140	msedge.exe
4128	msedge.exe
4128	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
2464	msedge.exe
2464	msedge.exe
4824	msedge.exe
4824	msedge.exe
3608	msedge.exe
3608	msedge.exe
3404	msedge.exe
3404	msedge.exe
2188	DB.EXE
2188	DB.EXE
2188	DB.EXE
2188	DB.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	HawkEye.exe
Token: SeDebugPrivilege	2188	DB.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
776	WINWORD.EXE
776	WINWORD.EXE
776	WINWORD.EXE
776	WINWORD.EXE
2484	WINWORD.EXE
3676	AgentTesla.exe
4896	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5436 wrote to memory of 3968	5436	msedge.exe	80
PID 5436 wrote to memory of 3968	5436	msedge.exe	80
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 2100	5436	msedge.exe	81
PID 5436 wrote to memory of 3568	5436	msedge.exe	82
PID 5436 wrote to memory of 3568	5436	msedge.exe	82
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83
PID 5436 wrote to memory of 2756	5436	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Chimera
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f4603cb8,0x7ff9f4603cc8,0x7ff9f4603cd8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2004 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1272 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1156
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6368 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Chimera
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:4624
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1276 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1572 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,6870317667091630131,12320660486423775067,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:3372
- C:\Users\Admin\Downloads\Ana.exe
  "C:\Users\Admin\Downloads\Ana.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5844
- - C:\Users\Admin\AppData\Local\Temp\AV.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5720
- - C:\Users\Admin\AppData\Local\Temp\AV2.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV2.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\DB.EXE
    "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- - C:\Users\Admin\AppData\Local\Temp\EN.EXE
    "C:\Users\Admin\AppData\Local\Temp\EN.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EN.EXE > nul
      4⤵
      PID:4436
- - C:\Users\Admin\AppData\Local\Temp\SB.EXE
    "C:\Users\Admin\AppData\Local\Temp\SB.EXE"
    3⤵
    PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1660

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3692

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:776

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML

Filesize
4KB

MD5
9f5e591f43f61393378b03ffe840fd41

SHA1
6f7b02317cbb5559fcf83885733079e6cd8bd181

SHA256
23e06653812303a6efd8b25c8e79136c341ba27d15d19b8a7b88ce7cd5970071

SHA512
cbdc1ab7e552c39ab7c8a6c84e3fba5d5ce981bdbc041bc46e7cbdb1eb974917b47c0da9fd04abbfd33ff888bfea4ebdf62bd21705c86f5e342801945bb3367e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
d2cffdeb49b00ee7027fcd3876946d41

SHA1
93266dcf625d90fb10690455289f3bce096019ea

SHA256
9cbab35140a489de0454fc0c7a9a6a6c5037cfb0234170748ef28c818676031c

SHA512
4505f4018f409d61ff921023d4b323e7a84b5390ae20d8b8ecfecb55d62c6a9f87b1f8d603dcd1b45fad2531fea769874d9dc11ed3c055c4b7e28a200084f6a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
0a2d34eeb15e9cf40590d6653de59c4f

SHA1
fd9f803bce88f08dc46afe5d76542e53946cc9bb

SHA256
c99118dcfc666e5005f591029a35beafc6c9a1957e75f8b4c1cccfb7564c641b

SHA512
a85ac585eba313c8c3e42fe36aff791dfcb41c0271a7fbac7d690ccf5d07530be65df581afd2f8c376f2c0dd2940c47ec5e03e9a2e7c0193442ddbb48546b218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31d85165-a22c-411f-a4de-9f5ae9ffa884.tmp

Filesize
11KB

MD5
6fd7f4e47735a53661cfce3e95573426

SHA1
82de83293d4b47f79368d3331646b5011f3f8363

SHA256
52b48c64a81923ae765b97959598b5f4e8f536d76f381cf660d441c6e2b5384a

SHA512
c6c602c775230fe7e8882e8137fecb8df201fc66966f5c4c5bd81c162ea47d6e846ff15af2c21be1377fb41cebae84f48b1197802ea7de08bfc8f24d2defd722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b488a91ce62c987cdc50675610f43a5a

SHA1
0d9cb4ba228c28c40bd685cdd3bc93b61a503cd8

SHA256
d3815317b39e6c66b3238785f196d560137312519fa8a7cff24d55d127ae1e1b

SHA512
94cc40e6fc54ad85642a7abd256ef05e242cd838d6a3b024b1972e22b38e618198b5d9cd1c90fd58dc366d407da62a441f022f5055147e224e088944d93784b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3ccb7a204d31f06d9eb079b458237177

SHA1
761b24b9d4f97982f2deb1f1b66e805f150f2a51

SHA256
0841d4b063d2829a802483a1b7e8c76cad3693ef125ae38e389d3b813a1ac34d

SHA512
9f086cc0a0e578e84bd832d36f96dabce0502ea97c8ca28ec6581a536d18db437193ce32f89539fa4160252e040df9d5f1c3aa084cd3df1d2d7fe726370ce5dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
cc726eb5a14d3791a8bab5cca8e576e0

SHA1
8ea089f1b0dc23d67571e1bea065bb6052e72304

SHA256
df4b32b37f6009cd9e369e824681f0cdbd0f25cee154ce4cca22e01bdba5ee49

SHA512
84871c3d0279e836456ac36239cc16ecf48b9d7d7d345df0d279c31f870aec8393d3734880a3c779b054632bdcfc730d9121be0a38fa9466c4f411a2cca1c1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
46fa4f5f7344089589d117bd7599b3a9

SHA1
b6cc1fe19e527d4a372c97e4d195ed94eee40030

SHA256
223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

SHA512
6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2de78cff65379bec5f204357775fd439

SHA1
e69b60c079238dab231bbefe063fb20fed103b95

SHA256
8eead8f5db174919a987a31f0f96e7c73609875791e2e0b365ecabfd7a38f20f

SHA512
21e30cca94bdd0061e91b2966862b69e6a9bcc6805a8eb754e312ebb381fe634ed008398165667c0332b86944feba71b6b4fddd80f80a1a18db85dceefdcc9de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0151e831990abc3dcb6b4e2a42a2247b

SHA1
667ac0e1639c3a9d825b01180ac04c3ef916c347

SHA256
1477ba26f958bf98a3c17b3db09410d14c128cdf843231b2e16d5409d4c89daf

SHA512
323e8c6de6a6e6fcb657dcb01d98b6cdc9f06ff6bfd28e57585f40c7e732dccde027ed5f1196c7a623c3976959b5adae24699f1e81e345c8aa9b11f1ef8229cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3f9e26c967de6ec96c7b759734b94e3

SHA1
ea576bbf0cc27753bbeb687305e7d33328d3dc6f

SHA256
c1bea07e70d6aa0ab822789a217774215fd867cf36033d84ecfaf288e27ac472

SHA512
3c8a8deae1c5c6a97332a0655557e907d0998020f66c697071c1ea8805d1846635fc182a2b2816f9145cc1e4ca9bf19b52e0fe0e763b6d2ab4ef4af768ac8498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fbeced1eeb21d97d842ec8dbdf0a403

SHA1
5b413df10829c5f7d6dfacfffb23cac66ca792c3

SHA256
6d3cea594d649122fba2f98d70a1ae158d5ac347e0fdcd81a4affa15b8814930

SHA512
1f1f83a958afee70efbd2be8d4f1ecfdf48c800b40926ca591d6961a266fca6bbe751c9d063dc6696f079a9292bd69a83702c527bedbd6abcfee22de2938521e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a74f6034b601adad93528db00358cfe

SHA1
3e4bbf7eeeac70d99c29cab809f5e5ad11ac5521

SHA256
29de432819cf509efd093b961cc43dd1f9567a68b1f878fe752348f8989f124c

SHA512
f506c9cb2da49ce2d2cd9a42cb376cf1487aead71ed940c10d01c7dffd289978eb1e9491abdb1b1e7011ecd8317e0ce4993d5ad68197cbf98319d2b7ce90afda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5c062081e411f1c521c20b226eb4c8de

SHA1
869f135c36fbd002dd8e61cf353b24f08a18294d

SHA256
139c3c5ed92ce5cefff78968603a17d8dcb7158e886dbacf865d1ce00f6c4bf3

SHA512
8e013de5b9973f5eb9ad78ee935642e564e120f95e0f3e557937ad3f6486edb4e60e26e8743515100fdea6c6b5e5b542eb4abc16e8d616942e15f98a9435b5ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f5d0ac1a0d0e13e034c8796bc659d318

SHA1
93d1d8ecf3478352e1ddb3ea9f8f73f10955f395

SHA256
332665ef219f7ef5376a292d51cf74625450dd88e691a91fd60247702b2240fc

SHA512
9309aacc3227a0175e840f085e0e5139408e0d024bf6edac02194f6d3dc3e0a844576d2007acd3a549c0c80c28af8940fe31b69d8bb3399b22595885c14b66bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
86bd140e84034c7d46c761ed40ed5ef6

SHA1
b9c26030d4328b324c76a506e14fce1a58544e5f

SHA256
2b787dd1b30988dbdcc30beeb95c318b5abd1725b90f5315aa56ceec84872601

SHA512
c0f80385fce49e1edf5c222f01751714cad24253e05486ea5f12aabc4111270efd1b7f40b1455571fe87936e899c044938bc8d2bfcc32ea504cfffdbc72009e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0543af30c579c73962862f06f49ed0f8

SHA1
e8278805ef41a58f0573d4d835250882741c251d

SHA256
51f9a7106799f1f330727e2c3958f0fb0b03cbce967126393e8a006399649ada

SHA512
7ffa80c209e0dda0a4a83e57a9114168cfb9c817ee071b580ce272df4ddf95dfb211d2b9e4df78a4335a45d6f09d9ad50e5c9c2155dc49bdd04b6f5e0b1dc876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d3e8372de110ddcf4f53bbd728d23a8

SHA1
aebe384b114667763bbb75912a5ebf391efd48e2

SHA256
f5503198bbc1c251acdaa91ea91150cec3b1213c7fef13f41b3d4d67e5cd07c2

SHA512
43f74cc2690ebf55014f240006af2480ca92ebd7bdbaabe141bb790db8cc6f5271808a23f0f96a2d09abe10f72442b474febce6b7da3adef1633d43d49c3cb4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
60b87ee2747b797a655e6b759821fcf6

SHA1
109f660559ef21ba67247d84ebc644e95bfc0ba0

SHA256
a83a0c10cd74c45d126393afda1ad2635def78729713e943cd515a9369900361

SHA512
9a7444ab552893bfe46dc5cbbf16bbc9fac9271b14ea5d3b103319abf090cb3b2ce34b1b7f76beae75323a0d1dde51f5b62737235199175ad2c9df79affdde2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a8a54a2c21cc7842bfadf82701c82ede

SHA1
6d43db785a591325520a9635fd1a6d6762e5728f

SHA256
f1de47f744dd9abef82407890c28e46399f33e94a2845d37d3fc67a5084e841a

SHA512
ec0aad046678f3e1e56117493f516cc841e3521ef5dfb8a7a9094cf408a924dfe44c4476e6fd2fc2910aa8b807d8a3eaadd99def9d37ca0caed4b20ca18bce4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84f9c35012d06356f353ec2484e55be7

SHA1
248674d8f5e04ba9c19cbe34564903562f8bc42d

SHA256
6f5ce3b382125d692e71601561544a2ed5adad019df0bdc26c1d21a237eabd99

SHA512
00d1a026a0477979f425240757b237463eca5443754d9a6a0cc034d1d4a09344cf362d6d04a0d215f86dde9c99991a88e060decddf7f65291e6c904e8ea8881c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a3d3fdaf3de24ee72acfd0304c98e052

SHA1
fc3f0187313df41a83918f15621c8f0351620fd7

SHA256
fa74ddb3b93edc0f66b00f3c73fd5869912a8125e1eb5039bf0be114c91a0bb0

SHA512
12383aff2d33a42146f98677e62ff94d5a2f4a36ac7a80b8d483e2a1b224f0a23e31d85bab9a362e12e8ea36c31f5dd4d91c4b1d6169ba7a91ba5ecad11e5e85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f145.TMP

Filesize
707B

MD5
848a92990e72e563b98c3bfa62c191ee

SHA1
4b48c44208b5e3563c18b65255d030066d3d3e1c

SHA256
eb37319c3834f3ced572f6c53999052ca6ae36a21bbe3e8d0516191a41b7c429

SHA512
fb1890dbd91a286c36e5b1550bc3d93229dd6293916c6df166e75217a1eeb29a38c445067f301f15f9db483477387457c9221b3757f9735207b1a5834cc63bec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4c1481d-a298-4fbe-96c7-284f41f7cbaa.tmp

Filesize
579B

MD5
8567e1f2692c0b6b22ff80d629299c19

SHA1
58cddc76e9ff5e87f484897575c3a00f748d903e

SHA256
401da02959aad39d1b085fb55389b5f8ca4ee9724f7ced382eda6517490bcfaf

SHA512
4c94507f7f61227a4f10c6380e132df75d8698fb737b635e78c1c2a280b3313f61069eab4117641ae862b228e791e207960ea267fbf201618f6c2a7671a505e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
71322205a9fa9b7a8b8520e6723622ce

SHA1
332ec055d96b48f8d18a66d645eb92f8b5b565ee

SHA256
f7acff64b1579cbb97a409bf53e3b075d3a3b124703782cc6aff4a2115b58d1b

SHA512
a6022fe6263f7d2b9ffe99e77fe70391efab62bfc13cfad2a0ce02ce5ce1290f818367c176a430a3ac345b29e160cbfbfa893fe7c36ee25cd8a0432df2b4fe30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
03142d20a05f8a46f1a65aceed4ce479

SHA1
b49a5aabe45f0e6e4a73b8ab5e317210071b1ea0

SHA256
ce4142b8ba752d20eccb068b385804238e6b5ad6c0ade14d3b95b3c46c1daea2

SHA512
6ba2c4ff2b414ade2cd6ac506fc0dbe000d282692bc79ea7e259b65d04b1cffb52704955327d8a9f93dac27febb6556e3d632b457bbdcf21b22c3333aefa9baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c91eb01c47d11b14323247f2313aa20b

SHA1
e91b46064e689ce7827e430ed674b81a0466fe6e

SHA256
93db1e10c39516f79253bcf7818e9e961e6562c9d2f391ee68090c3667d1e047

SHA512
2724725b515cdf5a13fd88b8635682672989b9b11fa62f6155a2d96f54ecd1f3256f6b3603d0e04a0c8af01665b6d08618abade246d8e92fb477a914bdfc0699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a25179a742258022fc4a16cdf279a15c

SHA1
0611c5707ad821682cce329673b3d01332b8c55b

SHA256
f8281e28ec8890d9a32f0b8fcfc947ce94ee8a66c4bb840965dc446553b663dc

SHA512
f201748099a0f7bd236aca7bfe8184d7bed20e57b2bc162b8fac2b4272f4c6a20a5add8b1e39d3844711713f6d061bfd00cc783886160283f4051def58d52e24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ab4852f00e28c1e6c768d7008acf5b8

SHA1
76e8258c74a717f311b575684cc256529a0cf90a

SHA256
2ef6af64714d5e56e1359a5592b8a4dba0dd902833d73d292462c749cf6dff81

SHA512
7dcf38a6941f5ddb5ed67424b52a4fc0f82d92a72a89164b1817833258a82d2c40f35b8d976b52b74d02308afd822fa850a1f963172edd403a0f3ccd22771b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
502B

MD5
3cee43d131bd68b7f7af47f862bec34a

SHA1
7911f98ffd8894aa4c18c3fd9b3ea4213e1c4362

SHA256
070b98f1cf33aa9c3935c4c7c2b2172ff8355d80b61ca718a05c462e914f4f60

SHA512
5df3c9d61fc66d94d3569b82d3bf5bfffa8d02741d6b1ea55d7cc8df4a49a85c25c67ded708d07059208d9a5473870c907dd056b501ae4a7cf31219e77b91502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6FA43830-B8F4-425C-9732-733E30D4E319

Filesize
170KB

MD5
9a3f37f9536a4b39853169d7d233c326

SHA1
97f7e165375c85de7255a534db6494e40878d1b5

SHA256
0496f65c3f07279a1fc388d2e89522334c60b848a36779a7000a7732cb2641b5

SHA512
5a8b852dba01ff1fce2e89264a11783b9ba008d0057466441172444f4767585d61420c642f230d92919f36a6ee2c4bd74a8e4604bc4c6e32a89603429550f51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
10KB

MD5
466214580121c370dacd119936d9bfb0

SHA1
38d231134e7d3d40ea54c5b895f4134e7f95ef5e

SHA256
9ea7145ed2a4dd03443f6b12b24b87c917028f7aa8bf8fd137c9933f03301eed

SHA512
3774097378d88fbb7be342b3068744d37296965224106979a10381c1b28f1dde5bb407b356f0b760f321b5f491060a20d5ca06dd0216cc45495522f341388c57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
15KB

MD5
dba10702a3930dcd547662083b3fc582

SHA1
4157421510cce795e08b66c2e81d6a1934a7a3e4

SHA256
078208ef3207439b157f63a5f73f6b22f73400aa90e6af66ce658be266ef7da9

SHA512
7a2af7459dfa770b3f2f41480367dbce3a280802b6d64d9f93636c57d86bd42d8c24e6a8050d6084ca578a22e772c8484da15f1f17ba3a50c6be94c7487daa1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
17KB

MD5
35d99a4aadd05a0eebb0286bc4a02c1f

SHA1
45ec030694ed901419385329dc90845f5969cb9d

SHA256
1e46cfa0da036ccad183f887209d7efb4ad0a1ade9df945948303d1470c5db31

SHA512
83074fc871f595b5c7d33891e21bd7b358b0d4157b8cd3a0290a6e5dbceeba21f99a8a68cfb97983ac3b5534c2d1fe13eb3ff226cce7920affbcf7b0c82e8408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
3b803b35f38c5a3cf7b4fa288fdcd397

SHA1
997f0ccdfb9dc06a6ea7b0fec593c777fb5b5ca6

SHA256
faa8d382a9916a7aa6471f37787d1e243a4c26e47e47f9b378f981afa6ab25cb

SHA512
e596641435745b08c901c41ab0e62d6ac2597a09b95da1a8cae484b160f12fe63bd1c5ce38ab23ec8fb19963b80d82229b3c396a88f56e407b04a4c7a543f557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal

Filesize
8KB

MD5
17ed1845e02504ec59a0ad3c66b7c005

SHA1
479fac24c07d01a65b51c1c52e0d896a8550fafc

SHA256
996dca155651e45054c81dece848e3da50fe1924d0d5cfbf2e455e02243b119c

SHA512
4bd3f6c3448f9853730c54e217f57ccdc1027031defb319f696ac7bdf29660ee069779d6408b0ba5754c466ce87d46d16b0c9f0db205cd89887a9d6e2984c2d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal

Filesize
305KB

MD5
279d8f88ab5dfac8a61d649751494969

SHA1
368f63ae72cfa62e032040f4657364ab0b0d34a3

SHA256
56464a9920ae9320c2772c7b4f4d1febd005fa67ee7b0ba744b899f61384ca4c

SHA512
fd64180b3a7e5569d214db1820b333987a4a697b81995f2f4ecc13ad8d7bc0443f9b303202e37ac957dc2580cf46541c7ebde6f4aff86fbd09d56082557cdbca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal

Filesize
8KB

MD5
0e5e22e19be3b75c079e68ccb2e4d7c3

SHA1
b144b2ec9bc628f485a9ec0c618757b48279bf38

SHA256
312ac57f244c7864201acb3857500c89985d37e12253e2f4ad58709a059c611c

SHA512
327297cb0d2c951137bbc9a57c1e70b6f281ea079c49e1275c13fc701f73c7ba0db0a6efdeec0679bbeeceb63cb52966ed772effa5488453f92c7f355f34399f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A772F2AB.emf

Filesize
5KB

MD5
0ed5bc16545d23c325d756013579a697

SHA1
dcdde3196414a743177131d7d906cb67315d88e7

SHA256
3e430584cd9774ea3b21d8e19b485b48212fe356776158dd5f3c5f63a5bde7d3

SHA512
c93072d11058fa50e3b09ff4da9f3dbe2637c2b5df05e616bd8ddd04557ea1e8b0db106b1545fad334619118c467776f81cf97ca52d3f2fcbbe007f30032b8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRC0000.tmp

Filesize
18KB

MD5
4aa86e032f8c9bd94aba70d518deda95

SHA1
6522e5deccf5432a71909ddcac6408054855d67d

SHA256
f2ca3ea678f99b46d1d6b8b024ac91d8939cf63c64f44b49811de80b8097b2e7

SHA512
ebd68258e6418ade6b02fd20a4d9871eca625d124614bb086daccf143ca83d1c9e7b2d985a7749c1350b7abe63cbe447b5cf383237d951afff49e3bf87a767a3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
3e1f5eeae74491d8850ef2c8b03a9a3b

SHA1
0c02c9c2550107de6dd0eb740ac5668f292883c0

SHA256
66756c0edf3925de7bcb685385e2a4f0b854cffd796a9e90eb1ed064b1fb0e30

SHA512
7637f0807d88dbceeb68823a044583e2248ac1ba73c000da6560f94075635a27d15970df7e52f8315bdc2f1c45cff6f1ab7690e916b58307a533f8df24329c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV.EXE

Filesize
1.1MB

MD5
f284568010505119f479617a2e7dc189

SHA1
e23707625cce0035e3c1d2255af1ed326583a1ea

SHA256
26c8f13ea8dc17443a9fa005610537cb6700aebaf748e747e9278d504e416eb1

SHA512
ebe96e667dfde547c5a450b97cd7534b977f4073c7f4cbc123a0e00baaefeb3be725c1cafbfb5bb040b3359267954cd1b4e2094ef71fc273732016ee822064bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV2.EXE

Filesize
368KB

MD5
014578edb7da99e5ba8dd84f5d26dfd5

SHA1
df56d701165a480e925a153856cbc3ab799c5a04

SHA256
4ce5e8b510895abb204f97e883d8cbaacc29ccef0844d9ae81f8666f234b0529

SHA512
bd5159af96d83fc7528956c5b1bd6f93847db18faa0680c6041f87bbebef5e3ba2de1f185d77ff28b8d7d78ec4f7bd54f48b37a16da39f43314ef022b4a36068

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB.EXE

Filesize
243KB

MD5
c6746a62feafcb4fca301f606f7101fa

SHA1
e09cd1382f9ceec027083b40e35f5f3d184e485f

SHA256
b5a255d0454853c8afc0b321e1d86dca22c3dbefb88e5d385d2d72f9bc0109e6

SHA512
ee5dfa08c86bf1524666f0851c729970dbf0b397db9595a2bae01516299344edb68123e976592a83e492f2982fafe8d350ba2d41368eb4ecf4e6fe12af8f5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\EN.EXE

Filesize
6KB

MD5
621f2279f69686e8547e476b642b6c46

SHA1
66f486cd566f86ab16015fe74f50d4515decce88

SHA256
c17a18cf2c243303b8a6688aad83b3e6e9b727fcd89f69065785ef7f1a2a3e38

SHA512
068402b02f1056b722f21b0a354b038f094d02e4a066b332553cd6b36e3640e8f35aa0499a2b057c566718c3593d3cea6bbabd961e04f0a001fd45d8be8e1c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB.EXE

Filesize
149KB

MD5
fe731b4c6684d643eb5b55613ef9ed31

SHA1
cfafe2a14f5413278304920154eb467f7c103c80

SHA256
e7953daad7a68f8634ded31a21a31f0c2aa394ca9232e2f980321f7b69176496

SHA512
f7756d69138df6d3b0ffa47bdf274e5fd8aab4fff9d68abe403728c8497ac58e0f3d28d41710de715f57b7a2b5daa2dd7e04450f19c6d013a08f543bd6fc9c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SB.EXE

Filesize
224KB

MD5
9252e1be9776af202d6ad5c093637022

SHA1
6cc686d837cd633d9c2e8bc1eaba5fc364bf71d8

SHA256
ce822ff86e584f15b6abd14c61453bd3b481d4ec3fdeb961787fceb52acd8bd6

SHA512
98b1b3ce4d16d36f738478c6cf41e8f4a57d3a5ecfa8999d45592f79a469d8af8554bf4d5db34cb79cec71ce103f4fde1b41bd3cce30714f803e432e53da71ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\fygbf.rtf

Filesize
816KB

MD5
75a31b6bc7f870eabb2cb10044d28a51

SHA1
a354d23e4b09832f074a4a8d1fb75fdb1a2d9e0b

SHA256
243566b089f00eb33b9d4512b72c1248395289bd732df0dff225a18a21a466d1

SHA512
ee2890bdfd2f93143c3b167abebef501d15a7421ce2b1830679fcb954a37717cd91548b97b59ac58e4a468e1d2f358805fe4c7cc186f4cada0432a3ae8879fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbhja.rtf

Filesize
816KB

MD5
1fc10f0cbf0e7071cde988d7bbcfa78d

SHA1
1a8fc464953df595109ff2582e50dbc402579294

SHA256
7f05f8353fbaa442fb336f2fa6b40a83d74beee257e4f957ddf9f060b1f1b0f5

SHA512
cfc9abeab890fab5655ffbe5a6bde3a42d32fc2def64feebcb8ccac43c1f4f63bf49bce0888cae03c55bd2cf229e90eda75cd94a63da48196334bc4829ba0db0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbhja.rtf

Filesize
816KB

MD5
14d404717a016881d89cb9815784fb4f

SHA1
f26fecc8a41589990ab777f66ced8d3f01cacb29

SHA256
752df694492206c832f0deaf844e5384d47b9bb5ce0c1d0b819b8d033e000372

SHA512
a47c9572731aa8e5b428bd5797b76b088e3b9073ebf05d636c99f7fefcc7eb80d68a347510aa0bbf9987824a57e141ab82a1bb89ca7814d54bbbe031a6a0beb1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
367B

MD5
8261b38f19e94c266c29a54be15447af

SHA1
1b3b83aec1c4dfdfd4114e9951366bc6c29066da

SHA256
f38ea0d24c0091cd71105e4407cf107a9e9e400b130eaaea95d441b5bbe488f5

SHA512
aadda61136859ee81a333645b03f1d50e6b250dfd51f59de24437e527c9ab0776ba1682abe1489dfef7bdb1c37a083bd3d8be8dc6d61e2c669f97e1c6ba1591b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\metrofax.doc.LNK

Filesize
1KB

MD5
b14b4e8fca9f589017932ad2e4fc1e26

SHA1
18caff5154f6abae1da9f96179b27b762e58e333

SHA256
2ec7e4bae5aebba33457cd1cd6f54c36549f8dabe82fcf720158548dc0984934

SHA512
8d9d848df3caf020613ae17a82ca2a659fac8e8bc9ad6432f91d0506ee611b098540f61d75c48a62920afb760e47d6f80d7fc1344c362f40790c6f258715a2a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
67ad29643f9080f20c5e48e20b009f4e

SHA1
8d96771dccf07d593e84444d80462478ee6b1ee1

SHA256
e7beb9b30f93c21b317f5aa60b1f4f83610abcf0401155366c0319d58f45bfc2

SHA512
363bdaa54716200d42f7bcec8a1e59857975b42923a908f9d1ca47692ac81a6e666eb537c86cb175b611e220e382567c23447e1dafea57f8c000955f60500c0a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
1b9240fa22a66e175f2cfeae3c9d4d53

SHA1
1497b05d5b533397725f2d6aaa64acfb77d4a547

SHA256
0f2e2fad145adae43e363b807b9103afd505046b9af39de4795aade202bfbc2b

SHA512
26aa843270e4781b0b79f9e84cce95ac75b08073ec2d6f51efa5fe6fd159359204ceb0e93437f2e41eecffd0d33f794f2a451016e3f6cba779683efe2a129730

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
b7be9032c1fb1981333d22ef6ae7ebef

SHA1
0d967c8eaa7fb6b298c0142ac7f6de76881b37aa

SHA256
51fa085f2fa01d4b4b967af291d1e78ed16b649577939cc6f275cf6ef6a158da

SHA512
4157469c07dfc22324a10f457e720e4aa72766cc111f9e585ea075220682b4bdb63efe5b556e0fdca347d9323480678ca14f18462172a48df6b89cfb364a643f

Download Submit
C:\Users\Admin\Downloads\AgentTesla.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 128769.crdownload

Filesize
2.8MB

MD5
cce284cab135d9c0a2a64a7caec09107

SHA1
e4b8f4b6cab18b9748f83e9fffd275ef5276199e

SHA256
18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

SHA512
c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 287767.crdownload

Filesize
125KB

MD5
ea534626d73f9eb0e134de9885054892

SHA1
ab03e674b407aecf29c907b39717dec004843b13

SHA256
322eb96fc33119d8ed21b45f1cd57670f74fb42fd8888275ca4879dce1c1511c

SHA512
c8cda90323fd94387a566641ec48cb086540a400726032f3261151afe8a981730688a4dcd0983d9585355e22833a035ef627dbd1f643c4399f9ddce118a3a851

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 899412.crdownload

Filesize
2.1MB

MD5
f571faca510bffe809c76c1828d44523

SHA1
7a3ca1660f0a513316b8cd5496ac7dbe82f0e0c2

SHA256
117d7af0deb40b3fe532bb6cbe374884fa55ed7cfe053fe698720cdccb5a59cb

SHA512
a08bca2fb1387cc70b737520d566c7117aa3fdb9a52f5dbb0bb7be44630da7977882d8c808cbee843c8a180777b4ac5819e8bafda6b2c883e380dc7fb5358a51

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 918160.crdownload

Filesize
232KB

MD5
60fabd1a2509b59831876d5e2aa71a6b

SHA1
8b91f3c4f721cb04cc4974fc91056f397ae78faa

SHA256
1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

SHA512
3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

Download Submit
C:\Users\Admin\Downloads\metrofax.doc

Filesize
221KB

MD5
28e855032f83adbd2d8499af6d2d0e22

SHA1
6b590325e2e465d9762fa5d1877846667268558a

SHA256
b13b29772c29ccb412d6ab360ff38525836fcf0f65be637a7945a83a446dfd5e

SHA512
e401cbd41e044ff7d557f57960d50fb821244eaa97ce1218191d58e0935f6c069e6a0ff4788ed91ead279f36ba4eddfaa08dc3de01082c41dc9c2fc3c4b0ae34

Download Submit
C:\Users\Admin\Downloads\metrofax.doc:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\tsa.crt

Filesize
1010B

MD5
6e630504be525e953debd0ce831b9aa0

SHA1
edfa47b3edf98af94954b5b0850286a324608503

SHA256
2563fe2f793f119a1bae5cca6eab9d8c20409aa1f1e0db341c623e1251244ef5

SHA512
bbcf285309a4d5605e19513c77ef077a4c451cbef04e3cbdfec6d15cc157a9800a7ff6f70964b0452ddb939ff50766e887904eda06a9999fdedf5b2e8776ebd2

Download Submit
memory/776-790-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/776-789-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/776-788-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/776-787-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/1156-286-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/1156-273-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/1156-275-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/1156-274-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/1156-288-0x00007FF9C1250000-0x00007FF9C1260000-memory.dmp

Filesize
64KB

Download
memory/1156-287-0x00007FF9C1250000-0x00007FF9C1260000-memory.dmp

Filesize
64KB

Download
memory/1156-282-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/2188-2084-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2188-2094-0x0000000000770000-0x0000000000803000-memory.dmp

Filesize
588KB

Download
memory/2188-2089-0x0000000000770000-0x0000000000803000-memory.dmp

Filesize
588KB

Download
memory/2188-2093-0x0000000000770000-0x0000000000803000-memory.dmp

Filesize
588KB

Download
memory/2484-619-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/2484-616-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/2484-620-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/2484-618-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/2484-617-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/3676-1020-0x0000000003450000-0x000000000346A000-memory.dmp

Filesize
104KB

Download
memory/3676-1018-0x00000000032F0000-0x0000000003306000-memory.dmp

Filesize
88KB

Download
memory/3676-1022-0x0000000003450000-0x000000000346A000-memory.dmp

Filesize
104KB

Download
memory/3692-460-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/3692-459-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/3692-461-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/3692-458-0x00007FF9C35B0000-0x00007FF9C35C0000-memory.dmp

Filesize
64KB

Download
memory/5096-1015-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5164-2099-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5164-2119-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads