chimera | hxxps://github[.]com/enginestein/Virus-Collection

Analysis

max time kernel
119s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
31-01-2025 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/enginestein/Virus-Collection

Score

10^/10

chimera crimsonrat defense_evasion discovery evasion ransomware rat spyware stealer

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Signatures

Chimera 64 IoCs

Ransomware which infects local and network files, often distributed via Dropbox links.

ransomware chimera

description	flow	ioc	Process
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\Configuration\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\OneNote\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
	27	bot.whatismyipaddress.com	Process not Found
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Java\jre-1.8\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files\Microsoft Office\root\vreg\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
Key opened		\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe

Chimera Ransomware Loader DLL 1 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

resource	yara_rule
behavioral1/memory/712-397-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Chimera family
chimera

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000300000002a848-285.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4808	bcdedit.exe
3440	bcdedit.exe

Renames multiple (3270) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Downloads MZ/PE file 4 IoCs

flow	pid	Process
28	3848	chrome.exe
28	3848	chrome.exe
28	3848	chrome.exe
28	3848	chrome.exe

Enables test signing to bypass driver trust controls 1 TTPs 1 IoCs

Allows any signed driver to load without validation against a trusted certificate authority.

defense_evasion

Code Signing Policy Modification

T1553.006

pid	Process
3440	bcdedit.exe

Executes dropped EXE 8 IoCs

pid	Process
444	CrimsonRAT.exe
1744	dlrarhsiva.exe
2936	AgentTesla.exe
712	HawkEye.exe
1424	HawkEye.exe
2508	HawkEye (1).exe
1364	HawkEye (2).exe
1448	Spark.exe

Loads dropped DLL 1 IoCs

pid	Process
1448	Spark.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Downloads\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Public\desktop.ini	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	AgentTesla.exe
File opened for modification	C:\Program Files\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	AgentTesla.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	AgentTesla.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
28	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	bot.whatismyipaddress.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\ui-strings.js	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpSplashScreen.scale-200_contrast-black.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-60_altform-unplated.png	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-125.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-48_altform-unplated.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PaintMedTile.scale-125.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LargeTile.scale-125_contrast-black.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-48_contrast-black.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\AppxManifest.xml	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DetailsList\ShimmeredDetailsList.base.js	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\be_get.svg	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-unplated_contrast-white.png	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons2x.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\en-gb\outlook_whatsnew.xml	AgentTesla.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-96_altform-unplated.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare150x150Logo.scale-140.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-400.png	AgentTesla.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl	AgentTesla.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_wob.png	AgentTesla.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_altform-lightunplated_contrast-white.png	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\help.svg	AgentTesla.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-lightunplated_contrast-white.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\SplashScreen.scale-100_contrast-white.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_altform-lightunplated_contrast-black.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-48_altform-lightunplated.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-64_altform-lightunplated.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-80.png	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\ui-strings.js	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20.png	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_GreenTreetops_Thumbnail.jpg	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadWideTile.scale-100.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluError_136x136.svg	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\dom\portalContainsElement.js	AgentTesla.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.scale-125_contrast-white.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	AgentTesla.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-32_altform-lightunplated_contrast-black.png	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-disabled.svg	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-100.png	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\plugin.js	AgentTesla.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info.png	AgentTesla.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\YOUR_FILES_ARE_ENCRYPTED.HTML	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Fabric.js	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js	AgentTesla.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-24_altform-unplated.png	AgentTesla.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\File Cache\Spark.exe\:Zone.Identifier:$DATA	Spark.exe
File created	C:\Windows\File Cache\Initialised	Spark.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\File Cache\DLL.dll	Spark.exe
File created	C:\Windows\File Cache\IFEO.exe	Spark.exe
File created	C:\Windows\File Cache\Driver.sys	Spark.exe
File created	C:\Windows\File Cache\Spark.exe	Spark.exe
File opened for modification	C:\Windows\File Cache\Spark.exe	Spark.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 7 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\HawkEye.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye (1).exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye (2).exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Spark.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\AgentTesla.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentTesla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HawkEye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HawkEye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HawkEye (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HawkEye (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spark.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2758858633"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31159299"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133827949427759100"	chrome.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\AgentTesla.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye (1).exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye (2).exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Spark.exe:Zone.Identifier	chrome.exe
File created	C:\Windows\File Cache\Spark.exe\:Zone.Identifier:$DATA	Spark.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1900	chrome.exe
1900	chrome.exe
1448	Spark.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1900	chrome.exe
1900	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2936	AgentTesla.exe
1716	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3692	1900	chrome.exe	78
PID 1900 wrote to memory of 3692	1900	chrome.exe	78
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3360	1900	chrome.exe	79
PID 1900 wrote to memory of 3848	1900	chrome.exe	80
PID 1900 wrote to memory of 3848	1900	chrome.exe	80
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81
PID 1900 wrote to memory of 244	1900	chrome.exe	81

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/enginestein/Virus-Collection
1⤵
- Chimera
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb499cc40,0x7ffdb499cc4c,0x7ffdb499cc58
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1816,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1856,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2044,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2940,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4800,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5024,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5068,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5356,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5416,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2340
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Executes dropped EXE
  PID:444
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4504,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5244,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5140,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5100,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5112,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6064,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2724
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Chimera
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2936
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5988,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5912,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2372
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5184,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5948,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5556,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5260,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5836,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2032
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1424
- C:\Users\Admin\Downloads\HawkEye (1).exe
  "C:\Users\Admin\Downloads\HawkEye (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2508
- C:\Users\Admin\Downloads\HawkEye (2).exe
  "C:\Users\Admin\Downloads\HawkEye (2).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6032,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5976,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5792,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5052,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5276,i,6373698509896699724,8686672385986801283,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4848
- C:\Users\Admin\Downloads\Spark.exe
  "C:\Users\Admin\Downloads\Spark.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" -set nointegritychecks on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4808
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" -set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:3440

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Code Signing Policy Modification

T1553.006

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML

Filesize
4KB

MD5
6232769363aafc483caed222878542fb

SHA1
5aa4195a1b2ef0ad374cfe8ab8006dc32fdb1b0e

SHA256
e2b95363586533eeae4a265c7a9b1b4a36784ffce15165afdc087e6c6e0eea22

SHA512
f726c7636a1a28677019156e7ebc072b26aa3cd9b1fea1568fca89bc9ec18b8e8a952ac794dd533861427300546776c29e890072aeb1081c0292c41cdca2e3f3

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
57KB

MD5
a500f7e7ac02027129e2da9353a7d972

SHA1
a29b179c6e874ac42c0cc3c6e497d8c193841987

SHA256
8cd46084f7293c5ca12b65229e8c2931d0a29509dd4bc3411487013f5641c895

SHA512
776444b622a2b894f2d61cf6b288e68fcb13ac6127667439c4148bedaae429a914108ced844b7ca348d015c55f3de7bf667e516b1584ec0cac6c1575d18b274d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9eff7800-2eaa-4187-940e-ca2f9d0a6dac.tmp

Filesize
9KB

MD5
efc1b6faf9573e4ab6976580762dd583

SHA1
826fd3948706ed0c18ba0c6ea7c0d9e0168211ce

SHA256
51de845f1261337c39251daf49ed0999d5274d7980f0fbfd272be93b95697fed

SHA512
d53d245ec2673bf5278a4e61628d8c05d59bbd3a4fdfb4722ba1a5e90a2bfd8b5663dbec1a47095ea1075db43ae94563169aedea475fbcd9db0900e698aab554

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
afa34efbfbf0fe5d7b7ef0d600dee967

SHA1
eb4d06b96e932d414eaf7257f708fd1650c3a07c

SHA256
e975b365849998f42695259a88852535d73cb1d259dfd42a3924bf36d6dac20f

SHA512
7909ec6d52b595dd5b054a6e9add5629368bb2d31c2d49a00a862f1960b1270b579581c2fc8f216861ac61183ca33fbcc4c535e978ab87fca0f387c555b9b869

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b6f5af061077c6f51f241c9e022e890c

SHA1
d0330fae25a1ea69215384dade465e8db1872035

SHA256
ff8d926f0de51ba352351b8d7427b66f33aedd3f6b610cd2ffd423fb4b2e5eb5

SHA512
1b4fb90f76de56adecf3c52d170f301825d0a98ea63f2c478fcb6a8357b60b9ed43c14404e954d168367f27bf05115470d9b48fbcfe6a1f07465e40d4be581a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2d00c58c-0e4d-4fd8-a826-3070301c1f16.tmp

Filesize
2KB

MD5
5dafb26d76257c1cc3d2e9aaab1b7183

SHA1
c934313c0cea7caafc2d65ffc21e77658e6b0910

SHA256
d4b8a1d29964d922ce9405eff7e2a4b7fbda4027345b88c52f46e00f06c4e387

SHA512
1418e4d933eb9e8eb64a181865ad0a2d7730b4d1e026c8b6310b88277ff283b9faff52124831da323ccd6435067701e70fd84b0c79eb48e7e7a1cde215257f94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
947a0b218d9dfe7d6fa38d2e6fa4a074

SHA1
2aac2cb99a921db81290ea8da9a01ff1697ed685

SHA256
78510863b7c5065dd2f96b67a18dce49c9770cdf22117f76b84edb9552e2e53a

SHA512
7a294bf2b20b64a05ba72ad52b029c566214f6c4dfd289e4c52747f73c4f3cc8a4c00ecb611b7a06b4e0d9f4bae0ad28deaefbd14d2522592cdd4298d2a7f5e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
269729c9d26beed7318de1a74ec19e14

SHA1
b86cc1332d38c618720004469445943c9ca95a9a

SHA256
f9b55b99776ee9f8d3450f5eab8083020adfa3be8b7ad98f6afa6ca146fe8438

SHA512
0239a69a303ea3c3d9302d48c2198cfd705552bca16a8d1ef6f3cd52f20bd6b644ee9020054a91b36897001d032437a38876963c1fbb0eebdc2ac6847fcf189a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7fc5e571a18fdc64662ddd1fee3d2b12

SHA1
ef8410c7a6b7beb96c80ad5e45b2873efabac15f

SHA256
0fbb94447b31ae4d1205c5f9cb5bfaf645031c5508860e7bfcae4d76fe272b89

SHA512
57960ac4a9533d2ec66dc4438d99dd5d9db75886143cd035e92606227c0bc44332493219c59d583c440d05db35cea40d1a6689070229e1678152a0ccef391bda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
48abd5d77af55fff4c80b0a2050ef6ce

SHA1
c80cd6828a53a386c4b48ed2f07ac29ff8409933

SHA256
efd78ab1ed7561786843cd8c04f3db00f3821ee9b642f01427e423e9203f11cc

SHA512
0a9e2577345afde835d73930a72513305b2a33a4cb23987db785f11196f975a18c1975714e6f47267346dd6f5dc844b349db32046b9c748a3285f49289f58b3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4c5746d889d31ec033215d0e270aa004

SHA1
d51054d73a4fbcc28a747d57427ff19527e31ced

SHA256
26c9cd5325f30ed19d7b217d6b3687a20df5865899297151002935cce4f4b868

SHA512
927b39baff6a4cad0278279afa10c28a6cd2b341906cd558db46b258ac0b2355b72ba624b351a2c1ef149c5194d1899723dd89f02ede873bbb4b7fbf162024b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
13449f1f04987e0af389eeba481c7751

SHA1
41041a9452f64c9c0b8be1944df322ae6ee56ca5

SHA256
549e1ee9ad599eb21edb401cc1010ba50c653dd51f8de25b43963148c46f68be

SHA512
de67fae61b0d1a001a7b932ecfa20e1d46d01842533938abe92d0e537c20ff967b0c36f533c98db5430e04e260d9a3e09d0a7881f08ba174d82bf275e3f68342

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
54d4b72ce124dc4d94b440afa850394f

SHA1
4e19875566f0913191341690c15d669b5ddde118

SHA256
539397838d1d2bf747cfa2282f76f1201beb3431e880c5fed5fcb9d7c7fc3713

SHA512
0a431512d0a4e24710411180a6140e19b8818fd0ba0f12961f280b1a91da3b4ccfabc34a1ff45f9b3861345a12f19e622cd10e197e205cccb8bff5297df7e15d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7f2400e8beae35d39881f8d17842fdbf

SHA1
c84a5a21b03e18b8e17696a67995ddb74a5a16ab

SHA256
b3f1f5dd58e675a5dfc6814fbe3996b320d3bb831c68b14fbe4683682289d101

SHA512
273eded0769d3be2c1dfebfac3181a7dfdf0e27c11f514d697cb0a39bb3430beed385649c87bbafc1bb7394f4cff6bcab28d6062551f8ad2d193a6e661d3ad2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d27ffd7cd07bfacc3ccca88910c3f660

SHA1
2f5f4122e341dff645677c776ca25e5c160da708

SHA256
309867b3e6dfdf6d83a278e4fbcdc4c35138dcefcb2fe93c22ef18d88a7d2a57

SHA512
15013fc1fb8837c27bc2bb4b9c2cdc634730330b8df93e3cd2ed30f8d3838b7926fad253528e1cc382a6600112c44b59242eb31e1c93139504ce17954572542c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f05195ebd06bb1c65edb6c4db73921a3

SHA1
5c110cce4174966151c72bd2d3ea58dc69f9ac8a

SHA256
4a598704d582a58ae4b31da84c8dc01f397d2167c9f499a8768edc8fc412a121

SHA512
f58cc0c1b3000fa81534440d11d3270ddb80e0ead495370d13049c751a7febfc52d4e3e70005dc4971f746791ce9a4a341a12cbc94a59ce70608e689fc98883c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d3e2e91cff4c042af838592a718afe2d

SHA1
1aafc86937d1bb8f1b634e33ebce612e2a208d0d

SHA256
55c2ef849bd418a3360ca264541f490b2f3ef3ff42d490820ff56492827a2f41

SHA512
e876ecf4971566d9245dd69bfe26a751dd4269d266efe01590711a46c94c1395239fe1866ecabbb3ff2c605b866dc7faaa5674f6f0713cff00275fd2cb7df14f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
30ff7351f600ca841920c160befcb5cd

SHA1
0b683745332249cd287b741bad4c3bc84140c251

SHA256
c042c96660daa6864758b19a571b603b4615997963f410263806abcaec66af2e

SHA512
fcfcb4517f9a6e2448adcb48b8a6becf4f91fac4d63ec16455855e9e10d74470b477c1827c4f5a8a4c2af8231c1757a4702b0e2913513425e176e2cc511ccfe2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
43cc7522881403525d26762be2accd84

SHA1
557f2731fb59d52e8d9a1a06fe57921dcb222162

SHA256
f872f38e3d28fe0b53a4372529c30e07a72b7016d875531a725acf3eafbdaaab

SHA512
f133a8807a821cb4777fbd42de7d1fd4e701c658b4dcc5dca3d91444b32f8518dfa8f88a7e9ce308988a171d2c3562b5242c7a4493784e1d62a25057d685f696

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1c9ea8c38e95e45f4424f63e5394a061

SHA1
13846ebc60d5f034bf1a3f7c9067f01bdae583ee

SHA256
3cf1d9739b157880a837d6da8564f1de8b0c6f7e168ed95f0ab541d0c7ae90c2

SHA512
fb042dc556665ee8cf75be45585025d20b4db91b4b45a223b5dba9374fc65207bd9e5db427c7f80560be85e00bc91eb14ea9ba6434e0c3e83ef104b9358d77c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0c0254d89875d196411349986c0df7bb

SHA1
e86fe2712afafc38f0de5eeae55654f68be7fd2a

SHA256
b6b2f91e6fd7a49dd9aad96eee38693f724124a585c27779067be758ec86e3ea

SHA512
f8a931c6f00c4364c21bc2931abb140666a37aba95e136a60bb01aed677032adf5233b17d629f1bf3435061b68b895f0d49f543872d988a7c3a952dd0cb014bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
e347332c5ffb309aee44658739639e96

SHA1
b921d3ccc158459813a51c6ce07165f0cb29aea2

SHA256
91ff1aec74d0541a8db3ca340bc29d4b972dd07b5fc96db856a9fb1c419f2429

SHA512
c992fe961ba0ba2d3e9cf53f7bb075c98149ba36bef8d0813bd174c91fc84f40834a6fb4233c1f4ef8139f14c3f5e182aa60baa8a467e3e7708c79605d2cd77e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
4644f0d80d960c257839b632907bf050

SHA1
41b80073af6976b3a4e9725133c37dd067873fe0

SHA256
9b684b88275eda9cb6fdd84b34c78d6e154afafd18dd1d0c85d980721376ea59

SHA512
626af0cf7603009b63162406f73238b11b915bc8d0d68190242cca5f0af2f3bec712dcaabfd6a3758251801ddf15c1b65744a676a64e3a08db704d7ddeb10ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\HawkEye.exe.log

Filesize
20B

MD5
b3ac9d09e3a47d5fd00c37e075a70ecb

SHA1
ad14e6d0e07b00bd10d77a06d68841b20675680b

SHA256
7a23c6e7ccd8811ecdf038d3a89d5c7d68ed37324bae2d4954125d9128fa9432

SHA512
09b609ee1061205aa45b3c954efc6c1a03c8fd6b3011ff88cf2c060e19b1d7fd51ee0cb9d02a39310125f3a66aa0146261bdee3d804f472034df711bc942e316

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
8KB

MD5
8831ef0b55c3b6b53cf838af970c6845

SHA1
ece92233386e6640604b66532428db127ca694ca

SHA256
c56c5b4c606b455278e01460558ae6d00ace1e41fba6497791fb11d04d0cc0ac

SHA512
91ace4896b244aad490b440d56e79ca3ab27a5d15d0ec031e589fbd16b0d7953272942b8fa135bddbcbc84e940d73cbff6147a31df47f90b080baca8c82667dd

Download Submit
C:\Users\Admin\Downloads\AgentTesla.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\HawkEye.exe

Filesize
232KB

MD5
60fabd1a2509b59831876d5e2aa71a6b

SHA1
8b91f3c4f721cb04cc4974fc91056f397ae78faa

SHA256
1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

SHA512
3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

Download Submit
C:\Users\Admin\Downloads\Spark.exe

Filesize
495KB

MD5
181ee63003e5c3ec8c378030286ed7a2

SHA1
6707f3a0906ab6d201edc5b6389f9e66e345f174

SHA256
55bfcb784904477ef62ef7e4994dee42f03d69bfec3591989513cccbba3fc8fe

SHA512
e9820f60b496d6631e054204c6fc5b525527d40a578faac1d5cdb116abcb4a35aacf4f4354ff092a2b455c5d9c2e0f29a761d737d9c9ad3d59d70b51d0583d92

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 13843.crdownload

Filesize
2.8MB

MD5
cce284cab135d9c0a2a64a7caec09107

SHA1
e4b8f4b6cab18b9748f83e9fffd275ef5276199e

SHA256
18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

SHA512
c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

Download Submit
C:\Windows\File Cache\DLL.dll

Filesize
116KB

MD5
a61c26b360471c8258c7571037c4bca0

SHA1
5db105e0384f25b1ab165c10a9445e6b943cd0ff

SHA256
e77316a1fd682e1af8af3ccd03c170f886b9ec8edf7013e1be6a6207cb5a6f16

SHA512
3ef680d50ccfa4311d3d1bec1648c48cf8e8633353dea5e06f52339047ede36fd1655ce728541e769d9fcaa6ab8c2a66981aef708a9f4d05ae46ad26f9d6aef4

Download Submit
memory/444-251-0x00007FFD9F7C3000-0x00007FFD9F7C5000-memory.dmp

Filesize
8KB

Download
memory/444-252-0x0000011E65D10000-0x0000011E65D2E000-memory.dmp

Filesize
120KB

Download
memory/444-253-0x00007FFD9F7C0000-0x00007FFDA0282000-memory.dmp

Filesize
10.8MB

Download
memory/444-296-0x00007FFD9F7C0000-0x00007FFDA0282000-memory.dmp

Filesize
10.8MB

Download
memory/712-397-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1448-8377-0x0000000005DE0000-0x0000000006386000-memory.dmp

Filesize
5.6MB

Download
memory/1448-8378-0x0000000005930000-0x00000000059C2000-memory.dmp

Filesize
584KB

Download
memory/1448-8384-0x0000000005B40000-0x0000000005B94000-memory.dmp

Filesize
336KB

Download
memory/1448-8376-0x0000000000CB0000-0x0000000000D30000-memory.dmp

Filesize
512KB

Download
memory/1744-294-0x000002B045AE0000-0x000002B0463F4000-memory.dmp

Filesize
9.1MB

Download
memory/2936-405-0x0000000003450000-0x000000000346A000-memory.dmp

Filesize
104KB

Download
memory/2936-403-0x0000000003450000-0x000000000346A000-memory.dmp

Filesize
104KB

Download
memory/2936-401-0x00000000032F0000-0x0000000003306000-memory.dmp

Filesize
88KB

Download