chimera | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke[.]98[.]exe

Analysis

user interaction
yes
max time kernel
62s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe
Sample261018-ss785set8l

Score

10^/10

defense_evasion discovery execution chimera impact persistence ransomware spyware stealer

Malware Config

Signatures

Family: Chimera 52 IoCs

Ransomware which infects local and network files, often distributed via Dropbox links.

ransomware chimera

description	flow	ioc	pid	Process
File created		C:\Program Files\Java\jdk-1.8\jre\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\MSIPC\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
			3716	msedge.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\Configuration\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\VideoLAN\VLC\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\1033\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\dotnet\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Java\jre-1.8\lib\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\security\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\ext\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\VideoLAN\VLC\lua\http\requests\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\AugLoop\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
	1	bot.whatismyipaddress.com		Process not Found
File created		C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files\Common Files\microsoft shared\ClickToRun\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe
File created		C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\YOUR_FILES_ARE_ENCRYPTED.HTML		HawkEye.exe

Chimera Ransomware Loader DLL 1 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

resource	yara_rule
behavioral1/memory/4956-452-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (342) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Downloads MZ/PE file 1 IoCs

flow	pid	Process
75	3716	msedge.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1288	NetSh.exe
404	NetSh.exe

Executes dropped EXE 4 IoCs

pid	Process
3896	WinNuke.98.exe
4956	HawkEye.exe
5076	HawkEye.exe
2708	Annabelle.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
73	raw.githubusercontent.com
74	raw.githubusercontent.com
75	raw.githubusercontent.com
103	raw.githubusercontent.com
104	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	bot.whatismyipaddress.com

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x000c00000001c622-1601.dat	ConfuserEx
behavioral1/memory/2708-1605-0x000001EBD99A0000-0x000001EBDA994000-memory.dmp	ConfuserEx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\added.txt	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	HawkEye.exe
File created	C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	HawkEye.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	HawkEye.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\WordNet_license.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\changelog.txt	HawkEye.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf	HawkEye.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Added.txt	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar	HawkEye.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\OutlookApptNaiveBayesCommandRanker.txt	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	HawkEye.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\README_en_US.txt	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\rt.jar	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\OutlookTaskNaiveBayesCommandRanker.txt	HawkEye.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	HawkEye.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMailReadNaiveBayesCommandRanker.txt	HawkEye.exe
File created	C:\Program Files\VideoLAN\VLC\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml	HawkEye.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\YOUR_FILES_ARE_ENCRYPTED.HTML	HawkEye.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	HawkEye.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf	HawkEye.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\action_poster.jpg	HawkEye.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	HawkEye.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	HawkEye.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HawkEye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HawkEye.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3716	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Interacts with shadow copies 3 TTPs 6 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2096	vssadmin.exe
308	vssadmin.exe
4156	vssadmin.exe
1684	vssadmin.exe
3448	vssadmin.exe
4124	vssadmin.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{14656751-7BB4-4244-A288-6EF37C1446C4}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	HawkEye.exe
Token: SeDebugPrivilege	5076	HawkEye.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 3564	5656	msedge.exe	89
PID 5656 wrote to memory of 3716	5656	msedge.exe	90
PID 5656 wrote to memory of 3040	5656	msedge.exe	91
PID 5656 wrote to memory of 1148	5656	msedge.exe	92
PID 5656 wrote to memory of 3040	5656	msedge.exe	91
PID 5656 wrote to memory of 3040	5656	msedge.exe	91
PID 5656 wrote to memory of 1148	5656	msedge.exe	92
PID 5656 wrote to memory of 2268	5656	msedge.exe	94
PID 5656 wrote to memory of 2268	5656	msedge.exe	94
PID 5656 wrote to memory of 2268	5656	msedge.exe	94
PID 5656 wrote to memory of 4152	5656	msedge.exe	95
PID 5656 wrote to memory of 4152	5656	msedge.exe	95
PID 5656 wrote to memory of 4152	5656	msedge.exe	95
PID 5656 wrote to memory of 4352	5656	msedge.exe	96
PID 5656 wrote to memory of 4352	5656	msedge.exe	96
PID 5656 wrote to memory of 4352	5656	msedge.exe	96
PID 5656 wrote to memory of 4860	5656	msedge.exe	97
PID 5656 wrote to memory of 4860	5656	msedge.exe	97
PID 5656 wrote to memory of 4860	5656	msedge.exe	97
PID 5656 wrote to memory of 3732	5656	msedge.exe	100
PID 5656 wrote to memory of 2700	5656	msedge.exe	99
PID 5656 wrote to memory of 3732	5656	msedge.exe	100
PID 5656 wrote to memory of 2700	5656	msedge.exe	99
PID 5656 wrote to memory of 6092	5656	msedge.exe	102
PID 5656 wrote to memory of 5632	5656	msedge.exe	105
PID 5656 wrote to memory of 5632	5656	msedge.exe	105
PID 5656 wrote to memory of 2368	5656	msedge.exe	106
PID 5656 wrote to memory of 2368	5656	msedge.exe	106
PID 5656 wrote to memory of 2368	5656	msedge.exe	106
PID 5656 wrote to memory of 2076	5656	msedge.exe	107
PID 5656 wrote to memory of 5548	5656	msedge.exe	108
PID 5656 wrote to memory of 5548	5656	msedge.exe	108
PID 5656 wrote to memory of 3896	5656	msedge.exe	109
PID 5656 wrote to memory of 4456	5656	msedge.exe	131
PID 5656 wrote to memory of 5836	5656	msedge.exe	112
PID 5656 wrote to memory of 4840	5656	msedge.exe	113
PID 5656 wrote to memory of 2536	5656	msedge.exe	114
PID 5656 wrote to memory of 2536	5656	msedge.exe	114
PID 5656 wrote to memory of 2536	5656	msedge.exe	114
PID 5656 wrote to memory of 2948	5656	msedge.exe	115
PID 5656 wrote to memory of 3448	5656	msedge.exe	129
PID 5656 wrote to memory of 3448	5656	msedge.exe	129
PID 5656 wrote to memory of 4956	5656	msedge.exe	117
PID 5656 wrote to memory of 5076	5656	msedge.exe	119
PID 5656 wrote to memory of 2712	5656	msedge.exe	120
PID 5656 wrote to memory of 2712	5656	msedge.exe	120
PID 5656 wrote to memory of 2712	5656	msedge.exe	120
PID 5656 wrote to memory of 4640	5656	msedge.exe	121
PID 5656 wrote to memory of 5828	5656	msedge.exe	122
PID 5656 wrote to memory of 5828	5656	msedge.exe	122
PID 5656 wrote to memory of 2708	5656	msedge.exe	123
PID 5656 wrote to memory of 1880	5656	msedge.exe	124
PID 5656 wrote to memory of 1880	5656	msedge.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd7d15c188,0x7ffd7d15c194,0x7ffd7d15c1a0
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,13800362945081862490,5070747872575838917,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:11
  2⤵
  - Family: Chimera
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,10236451242624378456,6980852306995745910,262144 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,14702870564869542297,13536305838628070796,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,7663139339790663644,11534208837018097154,2097152 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,5696798378882565980,4422477913176118096,2097152 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,5274959129202395877,10220135699222508271,2097152 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4368,i,10720698577315999376,9378896626627260277,2097152 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7270500772754978649,16738562740952182665,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,5194335123454451666,10076635441827734995,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,2916224382154455796,703889297606083076,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,2916224382154455796,703889297606083076,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,8810844910097983598,11915625780819492603,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6540,i,1511744653165333266,9253418986342820451,2097152 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,15561435781691012511,1976474461668397194,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,5645512367447290733,12771832582790393285,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:14
  2⤵
  PID:5548
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,15292383725881074236,11158189694194743970,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,14244175548670054779,13263780975415252029,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,11054815095915365703,919641437060532006,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5160,i,6672755685567053422,14605228880279488609,2097152 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,9636380186390490308,6928009959584996230,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:14
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,16653395560747925699,13721684042198613306,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:14
  2⤵
  PID:3448
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Family: Chimera
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6916,i,14037974025033238667,6180794268988346894,2097152 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,12772658055153065225,4018197710176728638,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,16464774064604549854,16489911538583080781,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  PID:5828
- C:\Users\Admin\Downloads\Annabelle.exe
  "C:\Users\Admin\Downloads\Annabelle.exe"
  2⤵
  - Executes dropped EXE
  PID:2708
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2096
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4456
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4124
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3448
- - C:\Windows\SYSTEM32\NetSh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:1288
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" -r -t 00 -f
    3⤵
    PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,16709782406425157771,11778422005868111237,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:1880
- C:\Users\Admin\Downloads\Annabelle.exe
  "C:\Users\Admin\Downloads\Annabelle.exe"
  2⤵
  PID:4016
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1684
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4156
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:308
- - C:\Windows\SYSTEM32\NetSh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:404
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" -r -t 00 -f
    3⤵
    PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7288,i,14449640203380348981,16358611353742841619,2097152 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,6450799040785194462,4866364518058667761,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:14
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,15539684240762419016,14357162881117490164,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:14
  2⤵
  PID:4832
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  PID:2492
- - C:\Users\Admin\AppData\Roaming\{99f7db78-3d5b-415d-a1bd-0da10fbb2ceb}\hh.exe
    "C:\Users\Admin\AppData\Roaming\{99f7db78-3d5b-415d-a1bd-0da10fbb2ceb}\hh.exe"
    3⤵
    PID:2984
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  PID:5044
- - C:\Users\Admin\AppData\Roaming\{7c6294d5-19a2-4092-9386-5ac6acfe31f7}\xcopy.exe
    "C:\Users\Admin\AppData\Roaming\{7c6294d5-19a2-4092-9386-5ac6acfe31f7}\xcopy.exe"
    3⤵
    PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=2520,i,9820542517603836151,15790958920079246833,2097152 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,5266089738971731537,6793592453392275228,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:14
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7480,i,9682294856687781090,6431537913493344433,524288 --field-trial-handle=2808,i,4452140440418612557,6160310103870032253,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2112

C:\Users\Admin\Downloads\Annabelle.exe
C:\Users\Admin\Downloads\Annabelle.exe
1⤵
PID:3412

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ca855 /state1:0x41c64e6d
1⤵
PID:4804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

YOUR_FILES_ARE_ENCRYPTED.HTML

Path C:\Program Files\Java\jdk-1.8\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML
Size 4KB
SHA256 b544980a62529f3f841f9608c7a304f93a607c1af49d4fa4979e89fcf7971590
MD5 74a33cf82dfa617184c447f8bc202dc3
SHA1 bc99f7a0d6e12b37eb54099a5a9707cd06509ad7
SHA512 a892c35a0df93d3e250c4185c6d8fa7bf9c7ebe2c71840cfc92723af53cfe7d22b7136ddb1f50d0bcadc5e044c5e94fd215e8a72b84c745baeb806f86c46f27d
SSDEEP 96:7lM3TQgwVzlCAQODfNbBeCzS4A84zz0dxIcX4X+z/S/iedbKLNJ8wXbe:JM8gSzx3FcRXKNJ8Kbe
TLSH
T19F910A779E8A64265893C5277180BF8DFD4680EB413C1B2C6E9DC06BF2C8135459EB8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07f8aede-66e3-4aec-ab21-8e530b4440b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\07f8aede-66e3-4aec-ab21-8e530b4440b7.tmp
Size 392B
SHA256 57a5e69d663ffa2babdfd55197c7b101f03cb36df3608ee078a037006fd8a444
MD5 41c69d5b61172fe5a054525851fef1f3
SHA1 264c7d36174135f28c7dc7ef1656eb323f87691b
SHA512 1708e9f7e5c906bf6cea4c0db289a912e99c3b27615c833cf94852fe30bf4d80461b931d3a0539753e3607708080d8350c4f42b13f870fa5887d8ed87e746a9b
MD5 SHA1 SHA512

Submit Download

26b31b10-3a87-451e-8560-5abbdaf1494a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\26b31b10-3a87-451e-8560-5abbdaf1494a.tmp
Size 34KB
SHA256 288e8b5b6570a245764fce8798d33d675309789f1f6c1dc789fcdd68c0c3749d
MD5 f72b924fbc7ad9170aa1ab96babd14b3
SHA1 163aacc004c1df8c9b429d335c92b288f6080a83
SHA512 1fd07c5b5bbc4e837f716ae23d0120e5613f1fa474bcad10e09f712d504ffba8128a77df0117e4024fbb3a03528e115bfce69a1c8b330a94804fd1924c610b4e
SSDEEP 768:or3kjVHiO9EP/9OA9at01j0iq00+Iai/GxTWLA:or34VxCHq00Na5os
TLSH
T1D5F2B071FCB19E639CE6A795B20637879FE45613CACD0A80C5DE6A0D018B6DE2707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58a4aff7-02c2-4887-8135-77ec15e953c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\58a4aff7-02c2-4887-8135-77ec15e953c8.tmp
Size 392B
SHA256 15113a86caf5e943607dd31e25ba2a26e20371ecc9ba649036a5be0fc68e549f
MD5 f9a7852f41045e0f0f76c0a3f9d7a533
SHA1 0dbdd6ac9522851664497fae4aeb2fefa6820077
SHA512 bacb1fbe702bf986bfac88ed8698cff4ee7d9a356d20d2f6beb9b4c586c9858768d8ad14070182c47496963ddf1308ba64c7753f10061ed88cea6945fbea5a6d
TLSH
T158E00115E30002BEC42C073005A31B20A7A2C02006E203475A6102642C223402F30EC4
MD5 SHA1 SHA512 TLSH

Submit Download

76bdcc28-d635-45b2-9847-3ee51e0424f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\76bdcc28-d635-45b2-9847-3ee51e0424f1.tmp
Size 34KB
SHA256 b5380ea87bc9857fb9c36e7634e058605a942cac7bdcbca103bde901bcad43ca
MD5 0afda2d3e16e7a46689504774b3ffb35
SHA1 e1ba59e5dd4b4e72d0862540b89fa99a6160c41b
SHA512 95e54dfcbd3fac63eec6f9e37c8d507a30c494d14c76254bf0b794546f903681104081bb0299d8a5bc08ee7eb5613d8ef5943a59ecdb18568a05e64c9f2a6fb5
SSDEEP 768:ol3kjxHiO9EP/9OA9at01j0iq00+Iai/GxTWLA:ol34xxCHq00Na5os
TLSH
T141F2B071FCB19E639CE6A795B20637879FE45613CACD0A80C5DE6A0D018B6DE2707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fe11b10-c542-451e-9cfa-7b9d38c71105.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7fe11b10-c542-451e-9cfa-7b9d38c71105.tmp
Size 37KB
SHA256 0953cd92a5f22013fdbf558ef7d764fb7d73f99e01aa9189c6cb9a2f00c91f3d
MD5 b732de9efc6ff736434151dde35d2a12
SHA1 62529f3ee82f32025718cf3d04c822ffe822c53b
SHA512 9ec2a9d83a6d4e1071449ab61fd4a6748cc1fb92372bbe976bab6aa14b5dbe8f33299fea725798d2a962ddec34ee1602d88523dfe555f86fd6cf01fbc0949cb0
SSDEEP 768:X/UxvxjgC+H3AYTvO9L/9OA9at01j0iq00+Ia2LSHxRz:KZj3+H3AYlCHq00NaQSTz
TLSH
T15703BF31FCA15D739CF6B384770A63879FF44563C6C96A9049ED2E0D05876AD1307867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8795956b-dfd2-42dc-8c0a-32115637da11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8795956b-dfd2-42dc-8c0a-32115637da11.tmp
Size 34KB
SHA256 4d3bfeb1cd08be70bf65e4d4c694c6b75cf5f8a3951e9f3ba607fc26e794cdd5
MD5 02daab0d95dc59298293995b9bb44336
SHA1 b3a5c1fd5797037063e7ba2828c69d7c5071ef9d
SHA512 c9fc1bdca90d4616ff39612fd24d8a797fcb56ee1df833cbaff3c332296daaab471a48b2b8f0a00e9604f308c64ca361b369cff5e99a85494dd0aa60059a76da
SSDEEP 768:743tjyHiO9EP/9OA9at01j0iq00+Iai/GxTWLA:743xyxCHq00Na5os
TLSH
T11BF2BF71FCB19E739CE6A795B20637879FA45613CACD0A80C5DE2A0D018B6DE2707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9032cff2-4f30-4a31-899f-0b5b523f84fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9032cff2-4f30-4a31-899f-0b5b523f84fe.tmp
Size 34KB
SHA256 47660649c61ccc57a95933686cb81f2f52e46176992d4989f8c57bcabcc8166a
MD5 51d597d48bb8165b31157860d2fe416a
SHA1 871609d9fe10d54ccf69df2aa234bd7b0b3142e0
SHA512 b1ba1311d2d6b1870754c74edcfcac1b93800f2608715ef0075894c9e68e2996dca693cef0917b560c5d78b2432cdfdf25752a546ef7a6148798bbf0410b8491
SSDEEP 768:7H3tjRHiO9EP/9OA9at01j0iq00+Iai/GxTWLA:7H3xRxCHq00Na5os
TLSH
T134F2B071FCB19E739DE6A795B20637879FA45613CACD0A80C5DE2A0D018B6DE2707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97fed022-0893-48c6-b321-d3137ce36545.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\97fed022-0893-48c6-b321-d3137ce36545.tmp
Size 34KB
SHA256 0f9ca12eff2a29e4dfc94a382a50034a75ba5c82ac5e1a53c0feac8def558c0b
MD5 48e617b83a9d0770942e874c646f8e13
SHA1 02bc46aaf66aba0b2d6e203f3883550d2679399c
SHA512 5225772221341042866e24fe9180c07b5e248735d6559ccea3e9fbe4586118bfd88eed3cb009b71d6776d35f4a1ba7b5b949236c90eae7e758be46312d741019
SSDEEP 768:7X3tjQHiO9EP/9OA9at01j0iq00+Iai/GxTWLA:7X3xQxCHq00Na5os
TLSH
T1EDF2B071FCB19E739DE6A795B20637879FA45613CACD0A80C5DE2A0D018B6DE2707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ddd0d66-fe8f-4a00-8a46-f99b6dd23f31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\3ddd0d66-fe8f-4a00-8a46-f99b6dd23f31.tmp
Size 105KB
SHA256 9ea13bef147b77cf059af0bbd32c4029231ee71a5eeb87da41465837f995c823
MD5 57517d7e9ca7c7dbf0369b56fc0b7190
SHA1 a15c2c9123a0f7f8e518a208d6f83aaea1923b00
SHA512 b584ef39e653fe4d5ada82f1439bada3ed13f5368752b2c2bfc5418788b2c6d6c615bca5636bbeb2f36bed6c3cf3f63c9dff735604a91156a020790610f0581d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

25506aa4-5ce8-4667-a791-752baf2802a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25506aa4-5ce8-4667-a791-752baf2802a2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4624a4ee-ce89-4212-8568-e625dba06a9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4624a4ee-ce89-4212-8568-e625dba06a9f.tmp
Size 11KB
SHA256 3419b856687ac73fabbc8a6b25347fb3b0d56d6ef5e92be896f14be025a4f4de
MD5 a30ce9d85741fe0e2f27ab481332cfdb
SHA1 42ef69124a93a67ff9122fa8db2b216663e7484a
SHA512 14c72ac2f659d59cb27f507f43c9a7ac2ae8f1c6a2a673895ba6b3da54390875d972476d6da2f0258bc208eee5554f957f005a3d893ad78d272932254dbc5228
SSDEEP 192:sxRjRAbd/fLs4rzoA8py0u/g6+WNSTD/YoEkOGBwIgTJ:sxRjgd/fLs4Kq/52/BMF
TLSH
T1753295556D28AD3B8CCBD21ABB95BF13D2FD1032A0D15E48EAFC991C01EA6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a2c4f87-9d81-4fba-8055-f0beff147f31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a2c4f87-9d81-4fba-8055-f0beff147f31.tmp
Size 11KB
SHA256 674221d11fc7780b8ddd821b6b57c9665489ce9d9d16f3e52ddab60a87d37fc8
MD5 3891044f71823f160cbf28547931d79c
SHA1 bb819a31d2275943d1817e68125ea00abc19046a
SHA512 17cc0fd4decfa9695204232e2bd7e993f8269021c32ac1ce6b8b5dbcd3bbfbdb2d2ea49b4483c759810c0d314c5f925cac36fad170815c9d454b5c6bf86d2427
SSDEEP 192:sxRYRAOd/fLsgrzoA8py0u/g6+WNSTD/YoEkOGBwIgDcJ:sxRY5d/fLsgKq/52/BMM
TLSH
T1494295556D34AD7B8CCBD21ABB95BF53D2FD1022A0D11E48EAFC991C01EA6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a443c3d-8a72-4319-b851-5b73fc40a633.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a443c3d-8a72-4319-b851-5b73fc40a633.tmp
Size 12KB
SHA256 bd5d2a7af969d89af0b2e5f2510792b2c0cd92673d45cd6e0b1534d3a4524709
MD5 298f75ce510f5d6321fc30b6ae929832
SHA1 5055525326684bd54bc392e97adfb4ccb9da1e29
SHA512 c4d3b663422ebfe9fd7572d45a9946e4808ef02c163ef31a08183ae06fdd9b09a4a96c07a7e23a9b0065c06e82cab0ad9cf5d2ca7f4b2522a1eb1ac6a0f96eb2
SSDEEP 192:sxRYRAOd/fLsTrzoA8py0u/g6+WNS+tXYoM0OGBwIgDiJ:sxRY5d/fLsTKq/5xXjMq
TLSH
T1844295556D34697B9CCBD20ABA957F13E2FD1032A0D11F48AAFC991C01EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 0f7b5cb8ac3a699fedf531b475957b8026a38aa05a01ab3d4d30d03b79e1b289
MD5 5534f8fafde79275619b1d7f4e040efe
SHA1 d6487a9ddda52c17c108306ea9ed97423b9936f7
SHA512 54cb1494c6e9b564cbc7b3bfaf6f5d3c7427448f572cc3feec4292c423fba6ff2c485d6b484888df25020dc18c91b47ac56b982eacd8805f3da29e0bf9e36865
SSDEEP 96:3wKjAuk1nHYjQfRmOyPggusjiPiHzMmTPCcLufR13KKIQLe008cpts0O2CcO9a9n:3whV+iDuiUpW071FmFYB9
TLSH
T162D12C01F20686E8FB5A70F459D18F96BD330A93745BEE6E9A20F3F8185E7E52C72144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c5363a056c68a1256c223b398c444bc83cbb0d4c9db462d1bf9e97f35f88ee64
MD5 aba1cfb30d0a773af47cb4c17f74e698
SHA1 a50c85fc65802413551bf025ae2d673911e7ceca
SHA512 24352b8e273dbe1c68ae997d0fdc5f93c828acdfe17773ac6653de09be73658a30a5fb4f732c529917c6477bb98bafabc2b82bc559bf8ad450682c773cf429de
TLSH
T17861A602D357C798FB9E40F09AD08DA7B6304AA1689F3E73DE68D0F86C0E3782172244
MD5 SHA1 SHA512 TLSH

Submit Download

7b7417db-2310-4b94-86de-838db4622fdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7b7417db-2310-4b94-86de-838db4622fdf.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5425259f-5f62-4098-b81a-ddbd852e8b2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5425259f-5f62-4098-b81a-ddbd852e8b2d.tmp
Size 2KB
SHA256 05718c1f433eee23d1300fff06a7d0a58945075493fc80afe8c18b9b6553dc81
MD5 cda0c204c223d85f2b078f893feefeb1
SHA1 357afa18a9c0ccacd42c609f324eb8d8a631f1b7
SHA512 b1b1b4d1b978509cfb59f2007b770f5d7a83c6dbe957383fe8b5e2a0b3149fd506b72e42c44ae66497bd007c1abfb90de97f643bde9239feca6ccda20f27f402
TLSH
T10E5159F747F1956D9A1259F0AA08EE1FCE2C0521831C786A85E0AE17D3E3872E141B6F
MD5 SHA1 SHA512 TLSH

Submit Download

9ae42f8b-ab60-422f-aa31-6400610dc742.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ae42f8b-ab60-422f-aa31-6400610dc742.tmp
Size 1KB
SHA256 fb1e40469c0ad6001803279ebabf652a0e27ab7e4ff2d3bdf73f3899304a2070
MD5 ecac5d34e0a766e86c4b5d5212089b2a
SHA1 fdd084543427806fc27531e4fa33605425ab597f
SHA512 f448ebcf6e142068f120bd9dc73253f2d66d97525e017d8b829e3c84109462f0e68394e5f51499e789a40ad3db67179ba25c8f744ce473344b1085a5a4db9c11
TLSH
T1C421CEF3C2F4567D9A0182F867146E1BCE2D0910931C3D5BC8D49B5F93E14B1D280D5E
MD5 SHA1 SHA512 TLSH

Submit Download

d95bb729-ed73-46e2-a1ae-d0482c768348.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d95bb729-ed73-46e2-a1ae-d0482c768348.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dddd89dd-92ac-41ea-a033-0662939859b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dddd89dd-92ac-41ea-a033-0662939859b9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f1fac1da-803d-4fe1-8ff9-ef84411b7423.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1fac1da-803d-4fe1-8ff9-ef84411b7423.tmp
Size 1KB
SHA256 5b810f1344e3b512afca2162184ed8e7553668e6a67af09a3b859406d34cd860
MD5 cb9461646f1dfcc6ea36c1a8d2667d37
SHA1 8b7ebb2f4e91ee65fee439fe4e50d3e4b4f333d2
SHA512 6698ed3178ad83b06c82248b9c1e961b8d312273875db4f52dab8b25316be4df205af1852797865fb62839585c66cc65b75ee1802de19bd2bb3296dcb37e3c8b
TLSH
T14321CEF3C2F4567D9A0182F866146E1BCE2D0910931C3D5BC8D49B5F93E14F1D280D5E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 087873da36fd82ccc33bd376b7a81aec6a2cee33d182ffeea9d1e5792d8af2ea
MD5 5b6b0734e7dd7f5501a3aab8bcfe4983
SHA1 86283ca192a40f0f892465291658296a81add635
SHA512 44f1f5acff57bd2ebef0054a32d8cebe59d9ffd541bfeb73c02b623aae68502788d7b4acd81f61a6964a10fc926860cc7ee4574d8883b777a2fbce6e8669faa5
SSDEEP 24:KZRDu7u0LZXDn6rbo+IHPnKMwh0Rn1md3SAJe8OzsyXQbwPIjIvK3hW1qSmxViUq:K0KI/KL6ErypAIvKxW8pwIrKVyM7yo
TLSH
T1A6918E60763B468139FE364954A9D65B534132B3322CF56F37E911624AAFF002CFE4E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\55e83e02-9ee0-40a3-a8d9-558366b90052\0
Size 10.9MB
SHA256 838fa0b08fba45c99233254dd2e1b02840c6f2c842a3848ee1fd343d0f3dc6b7
MD5 c2c4450dd9dd82f2214c555cead43118
SHA1 af8f5b2955f2f1976128d08045b35d6c939495f5
SHA512 6e30efbaab63f33776e263a72a42a52fa15cf145edee80b129b50ac80be97411285dc1263cb4609896be6150ba49ba59fae3f906e9cdf55f8539da0d79837de9
SSDEEP 196608:mOm0qMUp9EulOtFZmWp8kz7yolvpML7jQ/aRN2GdCh/lx256FCZWZpNkr61y:mbMUgoSZmWSmh4aaRN22ChHCMNku1y
TLSH
T1B8C623697200F68EC563E972CA64EDF4A6603D66D317D20794E37DEBBD3C496CE100A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cee92a05-a187-4f9a-8ca8-dfbf207aaf14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cee92a05-a187-4f9a-8ca8-dfbf207aaf14.tmp
Size 23KB
SHA256 44f0a9b9c50c11e016cf5c25ce914b5269e03edd845d31c1d8cfff0565e74b16
MD5 e8c5897569161b7533eb8e7278a80a84
SHA1 a732a5736012db14579c4b75a3a7584007d91959
SHA512 cdd4630a014cd0d3535509ac9c2a51e36bee65da83dbda9a7deca64254c0c5d2009a9597189e493bafeda1aff9ffeee2fbe35991a8f2da7186a9a408c46eb81f
SSDEEP 384:pFZwWWPfCtg/NFf1pKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVt5931RUXrondk:p/wWWnWg/Xf1p8F1+UoAYDCx9Tuqh0VL
TLSH
T1AAB2DA2B704DCB7F4FC04A9D9C196FDB6D9802C796588D4047FAD94C02C77EA922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a0265ddd-4c4a-4f34-99ea-8eec528b0eed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a0265ddd-4c4a-4f34-99ea-8eec528b0eed.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1f9aeacf7a17633cd1551271bbe438b33a3bb9f7e275191d08e1fd9ac2e3bc8f
MD5 bf79e8853f900d337f327203fa03d757
SHA1 e1aee2a11f4cac939538d32724a3dba9796473c6
SHA512 f0100a8a0f52dada23d18b273a1d35967ab7be671a0163fe35abc8cb65b43886f7b630ddcf5987b3a6948bd40f6a12fa1677c95d5761ff3794ca861898090e09
MD5 SHA1 SHA512

Submit Download

ccda20a9-d7c6-41de-bc14-3ecd8ea1b6c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccda20a9-d7c6-41de-bc14-3ecd8ea1b6c1.tmp
Size 38KB
SHA256 9357b3e84244c2ece89239f9024d9379e2b66e424727ab5ea812574313a5d835
MD5 c4caca89ce97a5433ebe726f14c4c130
SHA1 67055a302ecee6cc3ce510f4aaf702f53ac9d9fc
SHA512 029c90545e579f1da475fd90bee066ec88af941e224149455ea3e82d3a951054cf344e906ddd4cea85300e4bfa3dc90e594414e2cde85e51271e89cb471580b5
SSDEEP 768:1/UxvxjgC+H3GwTUO9Et/9OA9at01j0iq00+IaX/GSHxRz:YZj3+H3Gw7CHq00NaOSTz
TLSH
T12E03BF31FCA19D739CF6B384760AA3879FF41663C6C969D049ED2D0D058B6AD130B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebe3c411-474c-4795-a1f3-cf8b663f366f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ebe3c411-474c-4795-a1f3-cf8b663f366f.tmp
Size 36KB
SHA256 8e40c2d186e077434d8a25983389d9159ad27323f4aa4cbdbf54bc96efa747b6
MD5 84bc3aacce3869af9845b62757155f25
SHA1 cd209f682b2bf37eafba95648fed58075bb70dec
SHA512 8c4e8cd56b12385fc62a85830341b5f507cd07a50c2c4de48c3edc64a05653e29e7a0f82ca28b6c3d09ff5abae92cd2a35aff983d0382464430587a879315739
SSDEEP 768:GFd03lwg2jrHiO9Eb/9OA9at01j0iq00+Iai/GxTWLA:W032r3CHq00Na5os
TLSH
T124F2A072ACA0CF779DE66B95B60A33479FF00153C9C95A90C6DE6D0D018B6DD2707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d445d14-242b-4212-9dbe-7379d5236103.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0d445d14-242b-4212-9dbe-7379d5236103.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fa882636-f9cd-4bbf-86df-81a6cdf7bce3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa882636-f9cd-4bbf-86df-81a6cdf7bce3.tmp
Size 392B
SHA256 403e88ed2af7c1d60a408d35f002eb34def61cb7fc40cbaff812e054fc46d3d6
MD5 ebac13268dfe291d0727421c9a5d3994
SHA1 e15f607c3f92fcafdb7554ae5acb583de5454c3e
SHA512 d6c9080e61218b73c402405225267e53c4df6acea1cd6415da42bbdd2b79f0f1bb5c2c35c9d006f8e12253a952395e555966b82380f91e4cbe7fca85113f25e6
TLSH
T196E00216E30001FEC43C073005D31F3067A2C02006D303075E6103641C313002F30EC0
MD5 SHA1 SHA512 TLSH

Submit Download

xcopy.exe

Path C:\Users\Admin\AppData\Roaming\{7c6294d5-19a2-4092-9386-5ac6acfe31f7}\xcopy.exe
Size 255KB
SHA256 fe544b5cbe320d7950af648fb00df1ecdc761d52ccdc4c02d64cfc5ae7742651
MD5 fb8933c9118cea042c0bf15450714ddf
SHA1 ce3adca36568eb2210969e50c2ee8f0af89975c0
SHA512 dc68b1e039dff9b538e472d608ffc44e0bcdc537bcefc3b826c04e606383a45ea8189683b63719f2ee70743d1084ee990761585346b2de26ea447410fabc9234
SSDEEP 3072:eTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3MR4YgTl:e6nrD0ZMcPBAL7c0fTHs+2seXg
TLSH
T1F8448B0D7990E92EC4B222719A38D7D2FD3B79314F24A19FB7D0695DACE08C19938B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hh.exe

Path C:\Users\Admin\AppData\Roaming\{99f7db78-3d5b-415d-a1bd-0da10fbb2ceb}\hh.exe
Size 255KB
SHA256 65d808e3a28bcab371515a3f01275815e8cc85ea9f29a88014b692b4a88636f6
MD5 63aec06694464a679232937beb298f0a
SHA1 f3d41f4310e682855acc9cb47aa6e54f998d9c12
SHA512 efc1fd8721b8e454871ddf53c562aae05da7709dd649b44997e9d20ef167134b3791342003e85999fad470907baad498420a2bce3fe88a7b5202ce85aea6b0e0
SSDEEP 3072:uTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3gi4YgTl:u6nrD0ZMcPBAL7c0fTHs+2sdXg
TLSH
T11C448B0D7990E92EC4B222719A38D7D2FD3B79314F24A19FB7C4695DACE08C19938B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableTrace.jpg.crypt

Path C:\Users\Admin\Desktop\EnableTrace.jpg.crypt
Size 303KB
SHA256 0c1f24747b155cb546377d18ba8fe5e4d07b0c47bfb4bae1578e34b58cd1a583
MD5 4142b17182ac0dd68837bdf326b746fc
SHA1 2dc14c0bf4d362838ae7c132df1032f88d113195
SHA512 53533bce6c0bdea135aecb635022df866eaf0c1a6fe7a51f6806e9bb172d838a8923b74b682d249c75af8466270d74e8679167119a7270b1751c783f782b2482
SSDEEP 6144:mPkrAT60Rlv/R7iuZ3M+X5WHCs5twXc0ZDr:MkrAO0nv/R7tM9is5t41r
TLSH
T1AF64231DC574C1DEFE2AA775A276D9245B32D80DE9A1DA660ACCCC33F2022F998D710D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeSet.xlsx.crypt

Path C:\Users\Admin\Desktop\InitializeSet.xlsx.crypt
Size 11KB
SHA256 a83a3a602952145aea4867738ebc4e72779c02fe835971226c6abbeac6992f05
MD5 fe34ac82f34e78fe32d252301ecca10f
SHA1 8a561b00151894aafbbd5d84e90f82f8c726c674
SHA512 3de6e75016d3f7579315a270ae83b4a3df8c74f0cc6a553546a0b77a084a9c513a13565255d8ec98703baf66e3dbba1ed7d95080fecffe5cf5586541499c130e
SSDEEP 192:dCOQmh7VdEm9xJfbv/3t+3wnwZx45QUvt30WeaMMFkFh5U7HDZRQD5HnNKOZKuRm:YOJ1EQJfDPteZx45elMF241qhnNKQNM
TLSH
T1BD32C049F5EE4209B7403FD5F362793B1411124ACD2636059BB568D1ED23EEF31D42D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureSync.xlsb.crypt

Path C:\Users\Admin\Desktop\MeasureSync.xlsb.crypt
Size 160KB
SHA256 784e9829960a4a5469f824196b6cbd50c0681af494eeeac8e3f531761855514b
MD5 263d12161dd4c09a1f4437e7c6def2d9
SHA1 981a03577fedb8ff8f7c14e4da4425261d29ece1
SHA512 a9d3466bcfae3b84659f6baa980ab74776531a90fb133159b1942da29cec3e1fd9c132b6365f8a29d739a8be3cb48f6c9c62083e6b85bf1133e5bc12b1f2fd87
SSDEEP 3072:vvyB+omnqx4gXuKdNHcfvHEj5fv2pgPHCPJfhSZX1igKlelQNq86m4ylZ7:HyEomnqx4g+68Xmfv/PiPJcZFi9FQm40
TLSH
T14EF312CAB4FEE35862078DD20C7996085F209FED7DF1E45DC14A80326E1166F3B267A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingMeasure.pptm.crypt

Path C:\Users\Admin\Desktop\PingMeasure.pptm.crypt
Size 294KB
SHA256 2fd714f17a8d3386390871451318fb172e700443587dfcc2d41fb8a38e3b6ab6
MD5 ccd9f90d17adac4a4b87f9739f09ba3f
SHA1 62fdac06dd9c21aaa64469ad4a384e5800bf2e73
SHA512 88d95537d0b33803c28e5a1edd5d018f41c917243418ebb8af9ebd780f26999a01ff8436d7f8ff2bd8abb7bf0a213e4fa6c6e6672c55dff86662a5e8ffaf5d55
SSDEEP 6144:Zb0wx0dgAiEMjkQpE4JSNHlz8GdGGWqOT9JQ7ij3GS0c:BXaSA8kT4JSNHx7dGG9k9JQsJ
TLSH
T14E542383DBB6FECBD0008E92FFB4735C1A865D113429AC9239C00D64EDC793D4B96A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushGrant.xlsx.crypt

Path C:\Users\Admin\Desktop\PushGrant.xlsx.crypt
Size 11KB
SHA256 274c21920a7a466be424c68b519b7afb4ab411f7ac7d06d3d6dd57f8bffca6a2
MD5 c0239e6fa6036fdfa0d0f842f01451d0
SHA1 d7cc119ed76cd505467c677812a24e57791ae8d0
SHA512 b300938ddb82c273603963e1a14b9e4cdfa385081a01c70bf764451f16832e042fd3e88254350732a5da41ddec7fec24ca2d8cd89e059f3b8e160236f9d492e3
SSDEEP 192:3wOzrotGeRdiJuY9Q897T8yfuvaq2L1DX1S6lNdr/6MpUT/uc0FlLhRAyh4f:3r8tIJxH7TJTLp1vrzo10FltRAymf
TLSH
T1D332B067B7E986D3F740E041DC6896CF4553EEBAA708C2F381976FC99820A7391F6406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowConvert.docx.crypt

Path C:\Users\Admin\Desktop\ShowConvert.docx.crypt
Size 19KB
SHA256 4b1bf7103d2a86fbabc5d5a879ace50dde77e2163530f55b0108e3a874b4fdf7
MD5 7a132299f017ce8b35d6f0b7cfb37912
SHA1 6a61fca9af9922d25c3f91346cba7acc3ac0564f
SHA512 cb67ecf5bf300620f4660547e8fd7e48b4abf0b77b35ed91e5295a6124ea4ff5dcf9acc13ed0ae8a9086d414ae24e8450867c15a245e8408a80d894d7746b3aa
SSDEEP 384:IOIEQDosKQZVj5w4Fs1NWOUiJnUk3JDXDPtzfGMe1d4MhA:YEZsfZVBFsKpiZH3RbtbGMe1vi
TLSH
T1A192D024E5D2D2D89D410B73E6C291EDD7BE287801298694EFFF3684B42F3DD24E0644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YOUR_FILES_ARE_ENCRYPTED.HTML.ANNABELLE

Path C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML.ANNABELLE
Size 4KB
SHA256 d97bac82ccfb806c774f0068fd3813be05d954246edc2c1c836102c0d60b018e
MD5 c0d3fdae4fc7e211d532bc2940163014
SHA1 7f49472ac23ad90b22ff62a7ca05bc504a750387
SHA512 52542b53fc25a5dc1df761b51db58a1481f53aaa6a7bd40d5737f97f4811473657b5dbf8b4c66f1ad8995963ba59cf4f89a7a5d42beea52f84bb1f1c7522a4e7
SSDEEP 96:otCZe26LptwWA1yzIfIMgGw+gV+pkHXU5M9zPP802tsjCDas:KAe261twtxfm+mXU0a
TLSH
T12F916C57F39AE24793CE76274044D85B67347B0EADBA8D82A0865D0CF71E9B60F63248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertDeny.ppsm.ANNABELLE

Path C:\Users\Admin\Documents\ConvertDeny.ppsm.ANNABELLE
Size 1.6MB
SHA256 2d57dad6d3a4af25f9b457c9684f4ed2d7c5cb95e23c54ad857b653ecb5e967b
MD5 ebbb2048f96387f899e57c660ade63e0
SHA1 0835264d50f958efc19e2f62a4929d752ec9e709
SHA512 acbcb894b2b6b563f3be59ad82331b3995cd74a1320096898271a95169c931630b543f8c5b26cd7dc87c499cb81c43acdd714849f6ac0382bddca06012d69900
SSDEEP 49152:2V1ZpRg7yWdWfevxeTD5osc83fheHft8Ze7T:21g+WXxeT355BZO
TLSH
T1717533B4DE001EFA82D5D9B59FB7A8042477A3EC53E1B203B45EBFD12217C952118DAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertDisconnect.docx.crypt

Path C:\Users\Admin\Documents\ConvertDisconnect.docx.crypt
Size 20KB
SHA256 95b932aa0746f64634f3d3bd47f62efee41f6c34aac3dee86ec1ae2d02f6eea6
MD5 d116eeeacb1df09e93b3510744446444
SHA1 dd05825b460c411ab7705c3554fb48954bf88aa6
SHA512 57808134fa0b0f90be4d7b35a88b61790815ce84775ee95b572400cab1a252cf117c2a94fa0f577dce7e782804070fd4e18d8a907e0964481814eb554d6fbedf
SSDEEP 384:PhxNZqyDBEUu0wOGTlEYUrIsXb/av4n6J8R3njM79rvw5dFeHBjf7j0lP:PXhGUu0wOGTlF5sXpP3njM79rY5j6Bby
TLSH
T18F92D07FED37781C487C897D26A4C571A41EEC101A988CD1F74901641BDBDA26E3AE18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertDisconnect.docx.crypt.ANNABELLE

Path C:\Users\Admin\Documents\ConvertDisconnect.docx.crypt.ANNABELLE
Size 20KB
SHA256 f8994157040905c89c365cc767db85e663e434687abbf6cfb789cde8981614b2
MD5 761b833b3a8aa91042a7b0fd1aed64d6
SHA1 80a5b301574788875e23063b2b3cee38d02c8e38
SHA512 08afa6d1d52e35e0d320e319f65551d56d21a166c39821df9015b5edaa7f28f37abe46f12336ed136fb1efbf37f64a1a92344272a89552e8820201abc1d6a403
SSDEEP 384:kmaLkqn835haZXAA072l5b6nyXMB9blt/fbYOlxMh26Cum9:baZnAsstTbTfkO7oWum9
TLSH
T14892D08BBA94AE574718369EA534444B5C7FF373D88FEB04165847E13CE1EDB7A44900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrantCompress.docx.crypt

Path C:\Users\Admin\Documents\GrantCompress.docx.crypt
Size 16KB
SHA256 5dd04e6d2af483d6ce5827ae46e90e00474d08e45bf72273556ece60e6337057
MD5 3b1dba3dddea05362f70a0329abe0575
SHA1 d4f5fe7f79d3491d387982f5125ec89cc09543ae
SHA512 49af6ca7bd550b0691ba53ac7e19972c18fcb07296c5afd3174f4a4b815ea41c18a59eb6701f2bf2764a68166f9448fb8040595d2f19f06889fd3bb90478c9cd
SSDEEP 384:C6sQfrKxdjH42hYxhrZz/VF2Zd8e6Kw3Qxs+ULSUqYRT:C/cKxdjHDKrhb66K3xsDSPQT
TLSH
T15572D11633594F0F9E814DFDA8ACB0B258F4C5CBA4A0574B9875F469639C39F9C43836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrantCompress.docx.crypt.ANNABELLE

Path C:\Users\Admin\Documents\GrantCompress.docx.crypt.ANNABELLE
Size 16KB
SHA256 300c0ef0db3164201fcb91fcf105cbab3e5c8e004cf715e48db78c4f4077d7bc
MD5 d714d1c3a05b4629198bf378e55f13d6
SHA1 5d3600aa4ed9e8f627b7ad172fa3948bcd1a9810
SHA512 b265e00f1decaa2132c4cfd766f0fac6c0bd8572eeb285b69303689d38593088b445e8913cd4ed32d252d312ba41f904325708abb79e657127947729d11a8247
SSDEEP 384:LB/QvfjTkGqi3A/vqih6iPNlJePQGDkbrfCnnjum:LavPkGGKgvJnGgbrKnjum
TLSH
T1C672D14687664A9BFE2713563B4BA1EBE42105CDC320D1E85C7E0BE120E8F5184E84BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeConvertFrom.csv.ANNABELLE

Path C:\Users\Admin\Documents\InvokeConvertFrom.csv.ANNABELLE
Size 3.5MB
SHA256 ad0347731a238926fc19edeb0c826547470fde6a24f99a5ea7871c4ff7297862
MD5 0f502c03fbfd0d2f5fca09f87a5b98e2
SHA1 ff68ef764260c24d39f58a9b6e4b4e4671ace870
SHA512 20032a9e8da34fdc99acf4f82281cbd1c2eb4e3ca2525c9eef4011be8e27b4439795e8f55ba67d1255fc05ee1b435b22aa5141232859b7a47ad1febe7db4998b
SSDEEP 98304:KhVB1FhUQoytqkNnQotzBaOnP9dVRzSTHeDLaY+DTEHtptAXas:K3EQoOq6nQoFBaqVdQHeDLaY+DgHtfiL
TLSH
T1F70633A9346C41A763F32F098AEC76602B0E6BD79DC820B048EF6D4F26D751781C9797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeInstall.dotm.ANNABELLE

Path C:\Users\Admin\Documents\InvokeInstall.dotm.ANNABELLE
Size 2.2MB
SHA256 c2289494621fedd2349096d958c1f16c7084d5e9bcb54518a1c607a21a7a73ab
MD5 45fb9037d8bdac1c7d0c308c79cbf400
SHA1 4ee3fd9f9c4918e10169decfd2bd90e3e55ab69b
SHA512 222e5429fce39efb568371982ae1e97d2bee25e6ff8ffa6a55b396cfaa0965a44f464d7ed29b46c08c636d9e8e750fadbedd1706e14ea17e760679b9dd5d0655
SSDEEP 24576:bfVyGttLlcsSdbEKbTyIp+g3YfeBgIXmAcj3RVIjMGHtvZqc83zozJodkDqPQZ20:bdt1lc7aDjFjkjMieESqmMNfWNjQd52O
TLSH
T15BA533BD098F41CDE875821C02BFDF38D2B3C1495AD6E2545BCA22DA536CC914E9BE4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureSubmit.docx.crypt

Path C:\Users\Admin\Documents\MeasureSubmit.docx.crypt
Size 16KB
SHA256 449ee9fa46b83ba5ea2ff3df1b9b457114381f1bb80c08c7d80809fe3926a403
MD5 db3274f68847af55b34b8cc9d1ada588
SHA1 68df70eee796cf0dd85459e0f762ad0008848d83
SHA512 ec0b3ded6e23d9a155544fbbcf80d1cffe1f71b2e3c249281b877f07188bf4ad9ce5edfe5faa9fe59888d00b8f541c9d2dc4d113e3079815fa58cd856e5b4718
SSDEEP 384:aqlwK7BMYRW70egcaM9PfxCM76QfYXmvUGFn9wsxmC:YYBbRWYHc79cM76sYXXmhL
TLSH
T11772E0A0D4CC552AB46C54BAB9523872F18DF47E3D0B14ED3D8FCCCD5B348A07AA4A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureSubmit.docx.crypt.ANNABELLE

Path C:\Users\Admin\Documents\MeasureSubmit.docx.crypt.ANNABELLE
Size 16KB
SHA256 2312eb1cfcb375c1c7e01318b7c9183126e4ec7f13e06b5ca56dde25e48f3f00
MD5 1ebd7d360a7ce14eb1e1187b5e1a1b48
SHA1 cc2ba99e76d56af8ad84499ed69c92a47c049ce3
SHA512 adba70edd17cc7af4195c190d42bc19721dd137877489888769ae221419ed0a422a576d0a0d376679ef75a98fb797665a7c1f3f66a845dac7727bae133faada4
SSDEEP 384:lHtiKb92FBCM66DVJUN9CM2MBZLMaw6G0yvipVB2qwQlJlZeb:WKhOBT9RJg9dMawgyapVoqwQbnS
TLSH
T1E172D03107EF748F0ABF592DEB546A2F4CCB36AFA583807C2E2C96349A706904513973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureWait.potx.ANNABELLE

Path C:\Users\Admin\Documents\MeasureWait.potx.ANNABELLE
Size 3.2MB
SHA256 5ad91c5c96e5b247a4587dd53c487a458cf4d299016d91295294b9d6487a8f6a
MD5 7a2954a8cb48ad034454d973a88d3a7b
SHA1 315d09e09dfc6256313a02e52acbcb05455e7243
SHA512 d3646a48498275496da4526f16bdf35636d2c6846a0d5a2ffb9236b22de52de3a35dde0e744229ed01e3b3211b24295fca702c1e6de4812bc0142c3a19e78be8
SSDEEP 98304:7wWFqs75Z2hLQcvkHnAs4ga/NDKWS2rsjQfUyzT6KK:77FqsP8kwAJ4t/9hHrJUyHzK
TLSH
T186F53320E6D8D32E7E08D9D031CC7D5D2F62257877EAA0F15E06203E9997E76E0E895C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadInitialize.txt.crypt

Path C:\Users\Admin\Documents\ReadInitialize.txt.crypt
Size 1.9MB
SHA256 f212afa2b9c08bbc80baeed862351063d69449dc2e618fe0320f8506bef1d53e
MD5 9213ca3faa2cd70a8becda9d4e80edfc
SHA1 0f8a1c96cb9b8809abc228c1c9c02a303c1b7825
SHA512 5beccbb6b92831e613e1096e7d5b99771bc68955b73b0c10e43ccefa235e05b6991d400cefbabf7549d6f89a28565b70fcf6eddc9f6f715d0e20820fb70f9aac
SSDEEP 49152:er1krgX6YJdkjsWTLWfvjbuqrEPII5YEC8UzyO3Os4lhiFWqB:O1kEq8kQWvWzbuB90yO3tOhiFW2
TLSH
T1DB95336E3E6D911BE7F1F30F3CA11AC5745459B39ACA20EAC04A8D92ECD35BF25AD041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadInitialize.txt.crypt.ANNABELLE

Path C:\Users\Admin\Documents\ReadInitialize.txt.crypt.ANNABELLE
Size 1.9MB
SHA256 0bc72ce5cb110efab04023829069a82c266812cf6c3799100098fbaee6942b4f
MD5 2639a041795a57e3e72ca04732a2c1a4
SHA1 e333d26d9988cdf59a69df718154fa525070c38f
SHA512 fb691432f60614cd0f0d625603018c816efdb6346389df6277caad12177b9c8551a67d4989ef82654309bed48e178aa66df08d199fa8fda972c37cfdfe0aded4
SSDEEP 24576:qshvoab7b/gvFvkum3OTtckXe1wvZu++wKG57spY4BkpveGeI0B3zKx3T7oK5OHt:bQqkxm+pY1wvZuFQIKevVBjKxD7ox/F
TLSH
T1D395332F9CF9C25740D22CC6E4A5D7BEDBAD1F809A29CF9BCE643918618109702E54FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadRevoke.vsw.ANNABELLE

Path C:\Users\Admin\Documents\ReadRevoke.vsw.ANNABELLE
Size 5.1MB
SHA256 c42e549c36c60f2476c5e6a797ce15cc05bb63ce5c99d5566b9916ddf66e6065
MD5 1e4606c47124f9541493a9ccbe4b54f6
SHA1 9fbed114a205595148fa6ea0b2a12ef4fee68649
SHA512 5aa9bb67c75a04661838381ffaa53b463fef3065be8cdf869a3c98d8693de1c62395190e8729c5b2bffe6ae190711beca530d32dd34626b95b9c19521e982f9d
SSDEEP 98304:2C798z1m+Us9kNJCeBRfp7VOeBZIzT+1G3EaA5AXVScIQ6I/Pg6+9N:t79om+VknCiv78QIzTX0r5EVX6I/PgjN
TLSH
T16046335F0D859FC8E7EE1BEDF31637A9E4280728D04E4F74072659EA3CA9670E8241B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveCopy.vstm.ANNABELLE

Path C:\Users\Admin\Documents\ReceiveCopy.vstm.ANNABELLE
Size 3.0MB
SHA256 bbc8e4d9fc0d066fd213b48111bd5bad93c6baadb7dedcef0f249c90cb7d4f5f
MD5 58bc8f72a916d940c5788967892cff02
SHA1 a5386f9fc7e42d31f04640f2df1fe2e1155a7159
SHA512 479931305acad4c53efc8d6a48c949d2abbd1f5bb7c000ce4fdfce690fe9343ce01766d26ad3cede29232f4b68b805eba6c572645cbf1dfa309fba5fb93f9194
SSDEEP 49152:Se9cCTvJskHRT7/DLKtXfINdTxSltM761lsbjLWlz2oX0CwjpWMXqOdWa86wUCrb:xcCTvJ5RX/DdvAlxzsbjya00Cw1z6OdA
TLSH
T197E53302DD137487DEC0926B3AA4B0C72563327611CB599F1245D26BC9B89CFBBF4A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameStep.dotm.ANNABELLE

Path C:\Users\Admin\Documents\RenameStep.dotm.ANNABELLE
Size 2.7MB
SHA256 209b0c061dfc4eb5fa15aefd7ce551a94366875d10da4f9bf24f71144beacbf0
MD5 a4d51355a5e0fe6899642afc7829d36a
SHA1 798353502fb6cbb72521452bb0e05c70357378f0
SHA512 371b8db36da0cf5467ec0760ec4aa9f94755d55ff2202ba30b69e74c1ca73573299d499882ec958ee209b6fb3a7802129a781b2fa391bc53b690526499ebd84c
SSDEEP 49152:I5HInqYnIzs4I3ziEaiKkw2Ph+RcK3+1ftXGIU5blU0JTSmnWyqs7:INInqYnH3pKk9Z+m1ftaZU0xxnWyqi
TLSH
T147D5335F2A6FA83269B6684EB77E9BD1C93E868325D4010D9CFA401B484D4857C52FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeMerge.mpp.ANNABELLE

Path C:\Users\Admin\Documents\ResizeMerge.mpp.ANNABELLE
Size 1.4MB
SHA256 98fd49cd4a3e36a4bb81ff71cfdb7c5a51d188587d38d1deda31119233488c6c
MD5 46108e71dd3114fdfa93688de80f6896
SHA1 68764bf1c03344fdb66f05ed596a2883ba907490
SHA512 331d7d20187bb08d5ea2c9d569141de613a514b7dc4960f7225195c453b06d1593110dccdbfd68569ba6204e0aa2766ac7ca255b9716444c7d38a444c81f647f
SSDEEP 24576:Kceu4akGkHluZGhy7jYTc+SDNaKHB08m43Zi3aESSe0JqIuD6Ll0Ze7+fzoVV3:KZu4Pl3hyvYTxGLHB08534ESHLyZewcT
TLSH
T1676533094B3C8C706838A9F9B1ABB63B538BDD16DAAC51638D2CB31550E4277BDBC51C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestBlock.doc.crypt

Path C:\Users\Admin\Documents\TestBlock.doc.crypt
Size 2.4MB
SHA256 115cba19f6f29288c857dbf425803cb6e980793e3a27321915545b95c836d9c8
MD5 31fbe11a622a2e982a4e10af7cea0dd5
SHA1 ba696c6dd7e34ca27d14454ad2198d338a424243
SHA512 e24021f6eac4a617c1201f44d7e4622b15729c2980a45bb51924a2b5ca98b516956470f7320f29cda6ad0721daaf3ea6b7117bfb03739c5cd923a3639bce68ff
SSDEEP 49152:bVtVivEFDDSpQl98d5ZmwmxLjOzXat4IKzTRBu1znNMUK48HV:3Vi5pQl98d5Zmwo3AqtcBuRNMUK5
TLSH
T160C5336ADC6FFA98E5FA127FE3268A7DC9B4257A3738265770BC784091D5A70403D02C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b92db7b-2d34-4a29-887b-329c846c595d.tmp

Path C:\Users\Admin\Downloads\7b92db7b-2d34-4a29-887b-329c846c595d.tmp
Size 32KB
SHA256 2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a
MD5 eb9324121994e5e41f1738b5af8944b1
SHA1 aa63c521b64602fa9c3a73dadd412fdaf181b690
SHA512 7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2
SSDEEP 384:4cr14oKDP9KDviKDeTngwz9zmDAQE4KDJKDv5KDPP4vWe:92FgwBzMAbb3
TLSH
T12EE25232DF1A9884E9F4C5B685DB89B52131FC23C0403F6722D0AE3F6D73E96E914299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Annabelle.exe

Path C:\Users\Admin\Downloads\Annabelle.exe
Size 15.9MB
SHA256 716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac
MD5 0f743287c9911b4b1c726c7c7edcaf7d
SHA1 9760579e73095455fcbaddfe1e7e98a2bb28bfe0
SHA512 2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677
SSDEEP 393216:UMwm0qBknxdEX+LbMUgoSZmWSmh4aaRN22ChHCMNku1y:UMcKX+Lbjgd7W1RNVC9ku1
TLSH
T1E9F633597210F68FC9679A71DA64EEF4E6603C66D30B920791E37DAB7D3C496CE000E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopConvertFrom.rtf

Path C:\Users\Admin\Downloads\PopConvertFrom.rtf
Size 230KB
SHA256 7922adcd1080b74aedf87eda4b420edd3bbb3ea8e2f9849a88f97f5a8321727c
MD5 f88708bc0bba9796788d4ab2781984be
SHA1 9cebd003b302ff354b34c4324d7c0a644ef7380d
SHA512 da50c2d07dc4f197df3e83caa11efbbc323320babc86ef2e60b02b77d00401d5227049f617edcc0bc6464c5b0c021f0e21f2cbb3a6dabc5ea52bc354f66e72d6
SSDEEP 6144:6AntdiB+9oTfuBgxs/g3UWlp7z2OSqwkAe5ENw/I:6AnjiIaTfuBBi7f2Ogle5EN6I
TLSH
T1C83423109C3E21859F634D4796246ABB229628D54827C36DB50237FACB72BFE8751DC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc0bbaf5-efc3-4dd4-b201-534ae2de64fe.tmp

Path C:\Users\Admin\Downloads\bc0bbaf5-efc3-4dd4-b201-534ae2de64fe.tmp
Size 232KB
SHA256 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838
MD5 60fabd1a2509b59831876d5e2aa71a6b
SHA1 8b91f3c4f721cb04cc4974fc91056f397ae78faa
SHA512 3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a
SSDEEP 3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi
TLSH
T1FE34B2343DEB5019F1B3AF7A8BD879D6896EF6733706645E2090034A4A23D82DDD293D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToFormat.jpeg.crypt

Path C:\Users\Admin\Music\ConvertToFormat.jpeg.crypt
Size 204KB
SHA256 5d7080e622b62fa762b475325487f061d091fb83185b4cf7318645d5fd0c2139
MD5 65b956330482e7f3c22d46fac94feaef
SHA1 181fad6feaa5c23141df0bce1119090d1e441b9a
SHA512 5370f205deb4c345fff57781fbc9af728151ecb33c4830cd8101158ae9c1a6d03b793ccaaca0113a0a13a38af7355de08e595095710e85413166c6c51a0b2ffd
SSDEEP 3072:KV0EidjhKZiffXkEp1EMnDsHQ41dx+aasoko9BAbnlOqluUHUXl56V+0NDDMQ31x:KWd9rn0EEMDsHQy+angMOWZUXrfKR31x
TLSH
T14C14239897CC62F13E033E4880020E514AF950A4EC72F463EA7C59AD65FF46E16D7ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountClose.txt.crypt

Path C:\Users\Admin\Music\MountClose.txt.crypt
Size 140KB
SHA256 b27c4175011ca2ed4240c082a5627b2432a1e26e2c024cbaa63a0f5142174c5c
MD5 ac66d2cc55da6621686f7452fef3d36e
SHA1 88b515c899c54b2baa0d402335a6779956f6b206
SHA512 2d13892474b61d714e1ad8b5d0bb82fbad188000c3713f6ba67398d2273f13e1cca2aba647481b171105cb2be53a91f7c9696619bd7cc7cadeeef3febec5c0bf
SSDEEP 1536:VFzlYSaXhWjDbY2s/nfyK0uGD5dnkyvt3zosbz5m2U5hJrjVJYpNm3UjPr6E0nL/:j9lEVMuK+yvtjZzQh/R/kPiE2cnMJr9x
TLSH
T154E3137D01D0328A268E26C06D506FDA846FA4584CFBDBEE916A474536CF9CB7924EE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectRead.jpeg.crypt

Path C:\Users\Admin\Music\ProtectRead.jpeg.crypt
Size 144KB
SHA256 294a0ca42f5df2c0b004f8857e6d96019974eed710c91d78ed0d417660d3d526
MD5 703116ba16924a89739119d6b9353b4f
SHA1 8139c844daaefb37731f7544745234775795d046
SHA512 2ee1191e2f14e755ecee0d5467a3af548ea8e23d27fc64c81ac454b06811066bbfb80a5fbff2ec35d12cb8fea0f866ff1a64f59acbbb94138100ea402941138b
SSDEEP 3072:bl56ZMFBaRmx9aqX80LpeNXYG7flp7G3jdzBik7gXQK0Su:blgZmnaqXBDqflp7cWk7gghh
TLSH
T1C4E31368157393A6C5330AA012D73817BAD180DAF9B35EFA16FDA1514DBC05487FCEAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitEnable.xlsx.crypt

Path C:\Users\Admin\Music\WaitEnable.xlsx.crypt
Size 136KB
SHA256 ded0ca016d9bcb97107aa47b98a8195c974b1bbf318fb272ee8f33ead58c82c7
MD5 46f80c8c1f4ef4cdb8560e5da6ae504d
SHA1 8c9f8831121aa73ac1506d29af1c6f8e079bdf6f
SHA512 80a4cd6d4ffaf510251176adc9e01bcc5aba65b160ee9915eaa4d677857c22684db9c00da4376e005599c6be0f8ba50ef2a97ea55a55cf399d0578412adb272d
SSDEEP 3072:neZePvKYB/t41dtaPU3U+N8EBhvwAXvQhCEZqkZY9C4xlm834en+dY:nRVt4BJbd/osvQsE8kZYc4xlm7dY
TLSH
T123D313D0EEAD8031C846A9E76BA433CD735CAE014BD94BE116E2170DE289135A74D9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2708-1758-0x000001EBF51A0000-0x000001EBF672E000-memory.dmp

Download

memory/2708-1605-0x000001EBD99A0000-0x000001EBDA994000-memory.dmp

Download

memory/4956-457-0x0000000003200000-0x000000000321A000-memory.dmp

Download

memory/4956-452-0x0000000010000000-0x0000000010010000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads