Windows Analysis Report https://chimneycriminal.com/d/er/ea/index.html

Overview

General Information

Sample URL:	https://chimneycriminal.com/d/er/ea/index.html
Analysis ID:	438535
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Phishing site detected (based on logo template match)

HTML body contains low number of good links

HTML title does not match URL

Invalid T&C link found

Suspicious form URL found

Classification

Signatures

Phishing:

Yara detected HtmlPhish10

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\index[1].htm, type: DROPPED

Phishing site detected (based on logo template match)

Source: https://chimneycriminal.com/d/er/ea/index.html

Matcher: Template: aol matched

HTML body contains low number of good links

Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Number of links: 0
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Title: Dropbox does not match URL
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Title: Dropbox does not match URL

Invalid T&C link found

Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Invalid link: Need help?
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Invalid link: Need help?

Suspicious form URL found

Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s1.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s2.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s345.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s345.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s345.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s6.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s1.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s2.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s345.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s345.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s345.php
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: Form action: s6.php

Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: No <meta name="author".. found
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: No <meta name="author".. found

Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: No <meta name="copyright".. found
Source: https://chimneycriminal.com/d/er/ea/index.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 69.49.229.16:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.229.16:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.229.16:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x683aaf4c,0x01d76781</date><accdate>0x683aaf4c,0x01d76781</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x683aaf4c,0x01d76781</date><accdate>0x683aaf4c,0x01d76781</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6860d4d5,0x01d76781</date><accdate>0x6860d4d5,0x01d76781</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6860d4d5,0x01d76781</date><accdate>0x6860d4d5,0x01d76781</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6860d4d5,0x01d76781</date><accdate>0x6860d4d5,0x01d76781</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6860d4d5,0x01d76781</date><accdate>0x6860d4d5,0x01d76781</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: chimneycriminal.com

Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: imagestore.dat.2.dr	String found in binary or memory: https://chimneycriminal.com/d/er/ea/img/favicon.ico
Source: ~DF81E8D53A1AD6C473.TMP.1.dr	String found in binary or memory: https://chimneycriminal.com/d/er/ea/index.html
Source: {918DCD4A-D374-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://chimneycriminal.com/d/er/ea/index.htmlRoot

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 69.49.229.16:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.229.16:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.229.16:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.win@3/32@2/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{918DCD48-D374-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF41DA1EA9355D0F2A.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6480 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6480 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
69.49.229.16	chimneycriminal.com	United States		46606	UNIFIEDLAYER-AS-1US	false

Contacted Domains

Name	IP	Active
chimneycriminal.com	69.49.229.16	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://chimneycriminal.com/d/er/ea/index.html	true		unknown

ID:	438535
Product:	CloudBasic
Start time:	18:11:14
Start date:	22.06.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{918DCD48-D374-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	1799B772F07E26E7A0A896A7D73F8654	8589BC37D0794F83847BE1C65AA019DD5D4C86FA	29FF410939D5198B61A500831D4D532CBC4230ABDBC2398CA84B8BF4FFF6E571
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{918DCD4A-D374-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	54E80617A53CBF9280256B3D56632F69	D1F6F8340D4BE63AE926CF9099861603AB5A196B	09A9873F622D1934F3BBB4957BCC4E091B3D6A3635E18150C8839DF133A11FDD
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{918DCD4B-D374-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	510A8F4AF47B7C85EA6433CAB71B4B25	F3B15EECD3A8A085FA2F90EB68D1AEE9F36156A2	5984D6F5B47B7BD1BA2EE9CECD981948052275799790915EAF341BFFA2ADB60B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	CB7B8DAA9E3A2C11C8FC1BEC18554BCC	FA33A63F486F5BF61F5CFA551AC8714B7DF9D680	286E9E0266B3C26E0F8D09FA0EDCEA6B229EC5DE1653CA3A608885D9A2F327C1
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	466114D23CD944C11F953C285A821512	99E80F2708AA49C572AC9B45E55A8895F6D97B17	084308ADE28DAEBBC679CE795D74AC8142E786A9078C199C62CB23AFF3C82CEC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	F6BCDBA75A06C131B314CE921AD9B3C2	B5917CD26D3C0F066E90F7FE1483008BB7D3760A	61DAE02817D092236FEAE9729FD7F8E496395D93C7653D042EB7C0CB669399AE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	94957F1353B17562E8318A2074E36EF3	91921A44E1F367BE1DAE49E46E734FFED455FBF0	78E32AA4DC63E9AE769782AE80ADE6295F9A5AB0306D8BC6FAA4B801B856B1A2
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	C5D8CB6EF61EE92BC53E72450BEB0505	DF270864EB3B53B9A7BCED0E188E69158D5A6145	8874FFBB811A070F3D7CA7E7A0DC98D4CC2CB9666AEBF356BE5C4071BA9B71FF
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	907943E1CB436EF6931FEB106E82AD7D	E6E5081CADAFDE0F5A97029458993A4685986F26	B69F311DBE6DE330912CAED144B0ED484C2A2C25EAC8383A6DEBCEBB3875E25C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	CB30585B658768836FA7A5986A54A35A	9E7DFD577AE4D759C5623E0E5C9F1DAB428F1D59	7F62B1902276AF56C681D75BE1ECDCDEA63630E1292172202526E2E2F1C44EB4
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	C42A48A5CF1B619C8D65C3DE7BDC33A1	454DA3092D48ACF87FA523D1375118948613DB38	9C6CEE35CC8386FB53F383A46904DEF086242F1B8E76FFB72B37CEE65B9A3359
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	291C4B7CD1CD4441933A54BD8751B799	9421E7D1CDEDC6FF06A32BEE25959B6CDB836E53	D48F16BC3D2851E927B83B79C9B679E137B437646DA363E7861AF141E8A97B94
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	817B26CE7C3220D8EBD0BFE40BA63034	E8E0B8AFF4A19267167FB1FEB0C4422776083837	3192191338FA08DA75D5AE1CA1C8B03FD7EB5C491197D5387017B0C12D2496DF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\av022[1].png	PNG image data, 163 x 50, 8-bit/color RGBA, non-interlaced	E0251477F7131E1A46D0D8F4B19CE31D	F50354A61BD5A18E9FC273E58C586D63227A344D	590F45556412336488FF1DB500B4E34104F30E7161E494992E4D0493A3D06DC6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\av041[1].png	PNG image data, 90 x 41, 8-bit/color RGBA, non-interlaced	A93122D1F34261B94E07C3F1E7EF3F74	B2EED67DACFD8A4593C41738143EBF108583EE88	B66A50616923E92B5B89FA4F2CA2F9A0281F5A27845885CF21DD397A0C1ABB07
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\av051[1].png	PNG image data, 117 x 71, 8-bit/color RGBA, non-interlaced	70FC0022C1F83253D04B7694EA34D4D5	53F9321D829A39C4C512B53946AA84288A2DDF9A	A15B29FE61CDF379483582FE360B12868747042FA87BB40B0E9AF42CCFD548EE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\bt03[1].png	PNG image data, 301 x 43, 8-bit/color RGBA, non-interlaced	335F05C103766C7E3B78F6FA6EC13282	884DE5F276D676F35501B6B5F4D7F52EACBB794F	9C93E8DBBB882FD57E533F32709D0A28F94E3C7CCE2FCAF1729DDC97E61979C3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\bt04[1].png	PNG image data, 253 x 40, 8-bit/color RGBA, non-interlaced	C4E6C031CA581448898EC705EBD8E416	C564575BD210D4F3EC2EC3CDB074D252C47E7A90	BFC52D51178C1FB22377B03C09C8479D611E2AFECBEB5D5A34988BBBBB60D08C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\index[1].htm	HTML document, ASCII text, with CRLF line terminators	F86F436A4AA436CFDCB0E32C53838E5E	AC4E19DDA01E21D20F515CAD6562803D66F1C67B	6C6A10E491B5D8B6588EFED6039CF6BDE74F64B406DAB0668FFCEEF81DA2E991
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\av031[1].png	PNG image data, 123 x 109, 8-bit/color RGBA, non-interlaced	517EE6558D4BFC71E59837D3DD13F64E	7B339DBAAD1D1349B153647217C10E80CC017D76	137AA9734D8C02300502944ED1376D395A9F4BA97676E701ED32D07DBBF28BE6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\av061[1].png	PNG image data, 78 x 114, 8-bit/color RGBA, non-interlaced	3B97B73CEBF3BE8D46AEDF9553FA5486	B61499CF641E2540C511C01F68E7BD2C840F7712	3FE2E6BEC88C9DFDA8A8A396EF687309FB6663B5DA176F5DCE730E44763E298B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\bt01[1].png	PNG image data, 67 x 32, 8-bit/color RGBA, non-interlaced	3282AED98BA51D0B9F0E7C33936325B4	5B689D32AD29A0F9B34436BCF352EB51B493018E	BC1A464CF269178D8C6E77030104427D6A443E56551A248E1BA2DD99E46C4967
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon[1].ico	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	51E2DE798B41DB26B6A0EC187959D394	B55B0E80A4A533BE00E26D30756CB9B860AD76B1	78F31552544922D7131FB218DD480A324E6EA9E9FA5E3134F446850B3238B103
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\av021[1].png	PNG image data, 78 x 31, 8-bit/color RGBA, non-interlaced	A2F0B50990F12B9077506CCC52223D19	8A91A072B821FCC239EC88791F7A3430EC6556E4	24A8A365301768DDCF849160E1342D63B1FEAE4D5DACB1CB3D608C8CB6FA5994
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\bt02[1].png	PNG image data, 90 x 37, 8-bit/color RGBA, non-interlaced	114CCB5EF1213328E648AE75A41321D4	AFE2D1EC8F00CD8C51429D15217EFE418252536F	0CA9497A9E2C19628EF30C1405A682B5EEFAB5A38821D35C563642E1E79A62A0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\bt06[1].png	PNG image data, 67 x 32, 8-bit/color RGBA, non-interlaced	3282AED98BA51D0B9F0E7C33936325B4	5B689D32AD29A0F9B34436BCF352EB51B493018E	BC1A464CF269178D8C6E77030104427D6A443E56551A248E1BA2DD99E46C4967
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\001[1].png	PNG image data, 1588 x 630, 8-bit/color RGBA, non-interlaced	C23B576DD1E0B96E2AB82334FB914788	24922CF88A290EEB3E1D2A26534FC7D8B0D2A4FC	5CF4F5D46E721802446659D5D6A04435C8062EBE4A92EDF2DE0F62DCC093EED5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\av011[1].png	PNG image data, 264 x 113, 8-bit/color RGBA, non-interlaced	438C039278D5F8E502ABB4D18039FCBA	FCA04AFA0344E8A24312D38B3F7DD545868F0E25	A609042B1CA43D30D0006C66A1417FEA56B42766FEEAEBA8B20803A43E6DFF09
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\bt05[1].png	PNG image data, 300 x 36, 8-bit/color RGBA, non-interlaced	435E789B609BC7D66120D6F5BD2BA5FC	195F2FCDE90F797737FEA71CDC72CCB2ED23E3DB	6BDD77A0448306EF0F6AEA95131560C6FC2C81AAA25158BF975C91906616A237
C:\Users\user\AppData\Local\Temp\~DF41DA1EA9355D0F2A.TMP	data	A989F7B1ADDB80C386049B37299E3667	666876EF4E36297F973AF35AF3AFAA382B89BCAC	6B80F5C7309BD5BAF11BE979A1BFFA072964E0A0C5FCCE4089EAC172E5C5A4F2
C:\Users\user\AppData\Local\Temp\~DF81E8D53A1AD6C473.TMP	data	9581BA2B54CCC83EF17C876E29B20341	6083B7150DB676C3DACA940A66705305DA41B4EA	8D3140ABC88A4B5A09D48289C1605199D5E61FA30A95E6107E4870AB2BA197C9
C:\Users\user\AppData\Local\Temp\~DF999385913C23802B.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA

Windows Analysis Report https://chimneycriminal.com/d/er/ea/index.html

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs