bd13d5e4b9ceb8f97edb43b6e25f355a52199cfa19b0f693bf50ff141dd73fc4

Analysis

max time kernel
1793s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2023, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

16KB
MD5

9366f90855c7fbd22cdb135ebaa67d01
SHA1

17befc0ee0e1dcb9b51f0fb037b25c41d4757640
SHA256

bd13d5e4b9ceb8f97edb43b6e25f355a52199cfa19b0f693bf50ff141dd73fc4
SHA512

8571493b72270d1ce17ed9fe7061116f2f33132fcd7c78310ebd82e5a30025c41c05058ffd8f09f73a663298c2e7395e947af69d6b17fa4269f9e74828fcad44
SSDEEP

384:rNa57MDpmRgVoOsKEElKeGMSU8Hhhb7Fv7Lj28B2FBJCBXQL:rU5YfVoOsK/I1M4BhbRDLjaJQQL

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\BasicStylish.dotx	WINWORD.EXE
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\BWClassic.dotx	WINWORD.EXE
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\Centered.dotx	WINWORD.EXE
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\BasicSimple.dotx	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\~$sicSimple.dotx	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\~$Capitalized.dotx	WINWORD.EXE
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\Casual.dotx	WINWORD.EXE
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\BasicElegant.dotx	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\~$sicElegant.dotx	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\~$Numbered.dotx	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\~$rd2013BW.dotx	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\~$Casual.dotx	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\~$ntered.dotx	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\~$sicStylish.dotx	WINWORD.EXE
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\BWCapitalized.dotx	WINWORD.EXE
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\Word2013BW.dotx	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\~$Classic.dotx	WINWORD.EXE
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\1033\QuickStyles\BWNumbered.dotx	WINWORD.EXE

Program crash 1 IoCs

pid	pid_target	Process	procid_target
488	4676	WerFault.exe	114

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ed648cdc7d6a8438377f296a6970ce5000000000200000000001066000000010000200000008da6063cfd6e46338fa0fccfdc931606430c5eef21e6bd125fef06af6e52fc53000000000e80000000020000200000000f71dfa08be2dd8e78f8ff2ce9b46efcd3264ddaa046fe70488f796e4c830e712000000059f841827a04b43ac8d6d735a8d82a72d2bb3320cf02452f77269a9f7e94fda44000000041b75a27b06c233331c854c24507b1ed683a3acc28d8af0af827938a0715fceba793b1dfcb47fb7365b0bdc7179ec2f8efef14c25fe940d6745e483b1473bded	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cab2a48c91d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CAB20021-FD7F-11ED-9EF6-6A765FEA1DF2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ed648cdc7d6a8438377f296a6970ce500000000020000000000106600000001000020000000295c1660b96046dbee7782b14431a6eed4ae7f4c747b720e68b021c04474cb59000000000e800000000200002000000017b1fd8dd32653356e96a7f9d0f20710c01eb628295adc90bb2f6b286eff2bb6200000003f37ac6edaec8b460b402ade84eeae6b145807d3b073d01e63e90051d84bd02640000000d2176bc80d0183d8819ba957cae2f0f3000942015c7b6deabd92ec2e45cd5f53e4ab6c0634c19b1700bb0950e36182daeb1843c56ef2321056ae419db597fe93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101b96a48c91d901	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133297690022935964"	chrome.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 03000000020000000100000000000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\3\0\0 = 9600310000000000545692a5110033444f424a457e3100007e0009000400efbe545692a5bc563d8e2e00000067e30100000001000000000000000000440000000000960043003300440020004f0062006a00650063007400730000004000770069006e0064006f00770073002e00730074006f0072006100670065002e0064006c006c002c002d0032003100380032003500000018000000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\KnownFolderDerivedFolderType = "{B3690E58-E961-423B-B687-386EBFD83239}"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\SniffedFolderType = "Pictures"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616193"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\3\0\0	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\3\0\0\NodeSlot = "12"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\3\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\3\0\0\MRUListEx = ffffffff	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4592	POWERPNT.EXE
1848	POWERPNT.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1916	chrome.exe
1916	chrome.exe
3516	msedge.exe
3516	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5056	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1916	chrome.exe
1916	chrome.exe
428	msedge.exe
428	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1916	chrome.exe
Token: SeCreatePagefilePrivilege	1916	chrome.exe
Token: SeShutdownPrivilege	1916	chrome.exe
Token: SeCreatePagefilePrivilege	1916	chrome.exe
Token: SeShutdownPrivilege	1916	chrome.exe
Token: SeCreatePagefilePrivilege	1916	chrome.exe
Token: SeShutdownPrivilege	1916	chrome.exe
Token: SeCreatePagefilePrivilege	1916	chrome.exe
Token: SeShutdownPrivilege	1916	chrome.exe
Token: SeCreatePagefilePrivilege	1916	chrome.exe
Token: SeShutdownPrivilege	1916	chrome.exe
Token: SeCreatePagefilePrivilege	1916	chrome.exe
Token: SeShutdownPrivilege	1916	chrome.exe
Token: SeCreatePagefilePrivilege	1916	chrome.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
4080	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe
1916	chrome.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
3212	wordpad.exe
3212	wordpad.exe
3212	wordpad.exe
3212	wordpad.exe
3212	wordpad.exe
4592	POWERPNT.EXE
4592	POWERPNT.EXE
4592	POWERPNT.EXE
4592	POWERPNT.EXE
4592	POWERPNT.EXE
4080	iexplore.exe
4080	iexplore.exe
3772	IEXPLORE.EXE
3772	IEXPLORE.EXE
3772	IEXPLORE.EXE
3772	IEXPLORE.EXE
3772	IEXPLORE.EXE
5056	OpenWith.exe
1848	POWERPNT.EXE
1848	POWERPNT.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE
4760	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 4880	1916	chrome.exe	83
PID 1916 wrote to memory of 4880	1916	chrome.exe	83
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3588	1916	chrome.exe	84
PID 1916 wrote to memory of 3016	1916	chrome.exe	86
PID 1916 wrote to memory of 3016	1916	chrome.exe	86
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87
PID 1916 wrote to memory of 4208	1916	chrome.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9fbe9758,0x7ffd9fbe9768,0x7ffd9fbe9778
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1796,i,9610716672299044443,15414329390389341078,131072 /prefetch:2
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1796,i,9610716672299044443,15414329390389341078,131072 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1800 --field-trial-handle=1796,i,9610716672299044443,15414329390389341078,131072 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=1796,i,9610716672299044443,15414329390389341078,131072 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1796,i,9610716672299044443,15414329390389341078,131072 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4360 --field-trial-handle=1796,i,9610716672299044443,15414329390389341078,131072 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4456 --field-trial-handle=1796,i,9610716672299044443,15414329390389341078,131072 /prefetch:8
  2⤵
  PID:5040

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4944

C:\Windows\System32\WWAHost.exe
"C:\Windows\System32\WWAHost.exe"
1⤵
PID:4676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4676 -s 336
  2⤵
  - Program crash
  PID:488

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4676 -ip 4676
1⤵
PID:1332

C:\Windows\System32\wusa.exe
"C:\Windows\System32\wusa.exe"
1⤵
PID:1576

C:\Windows\System32\WSReset.exe
"C:\Windows\System32\WSReset.exe"
1⤵
PID:3624

C:\Windows\System32\wsl.exe
"C:\Windows\System32\wsl.exe"
1⤵
PID:2304

C:\Windows\System32\wsl.exe
"C:\Windows\System32\wsl.exe"
1⤵
PID:4756

C:\Windows\System32\wsl.exe
"C:\Windows\System32\wsl.exe"
1⤵
PID:4672

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe"
1⤵
PID:932

C:\Windows\System32\wscadminui.exe
"C:\Windows\System32\wscadminui.exe"
1⤵
PID:1372

C:\Windows\System32\wscadminui.exe
"C:\Windows\System32\wscadminui.exe"
1⤵
PID:2608

C:\Windows\System32\wscadminui.exe
"C:\Windows\System32\wscadminui.exe"
1⤵
PID:2872

C:\Windows\System32\write.exe
"C:\Windows\System32\write.exe"
1⤵
PID:3760
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4156

C:\Windows\System32\wpr.exe
"C:\Windows\System32\wpr.exe"
1⤵
PID:5044

C:\Windows\servicing\TrustedInstaller.exe
"C:\Windows\servicing\TrustedInstaller.exe"
1⤵
PID:5064

C:\Windows\servicing\TrustedInstaller.exe
"C:\Windows\servicing\TrustedInstaller.exe"
1⤵
PID:3228

C:\Windows\System32\XblGameSaveTask.exe
"C:\Windows\System32\XblGameSaveTask.exe"
1⤵
PID:5096

C:\Windows\System32\xcopy.exe
"C:\Windows\System32\xcopy.exe"
1⤵
PID:1216

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Documents\AddRegister.pptx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Documents\CompleteMeasure.mhtml
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd9e1a46f8,0x7ffd9e1a4708,0x7ffd9e1a4718
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,4446127772868033656,9496236848046470861,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,4446127772868033656,9496236848046470861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,4446127772868033656,9496236848046470861,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4446127772868033656,9496236848046470861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4446127772868033656,9496236848046470861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3248

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4080 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\WriteUnlock.ppsx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1848

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "C:\Users\Admin\Desktop\DisconnectExport.dot"
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
646B

MD5
c5247c5bafa2ff22f269f9c845ab2630

SHA1
9e8ba116377f6efe468ded00ef1daa3ea7bf9377

SHA256
b207b9c37c219cfa0955e9a6e7ee59f512351a60438129d7cae6e1795cfbb944

SHA512
2350cda6ad1ccf10c96f442c220e4ccc934aec0d73881769384d17d1ab2e9a946f37629d15966365e1fb89c5ae04bb13622af416fddfa43b04f904c89ddb13b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4c9f6be0c3d3ddc2bf53b316ced070c8

SHA1
878112107510db1fee9803c5a64ba5c462065576

SHA256
115369772a24930567fc528601eb302f56b510a796a612e61bcd5144ad9ef513

SHA512
487ea2499b3830a4192cec0fabd758e0767da98290a9c5cd2219748a7afc22c087d8f376d54db1bb6f65f5c5dcd817a650b3dad554bd67f36e01901f1aac63b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b8572be53b8533e086a3718de020c553

SHA1
48a2aadaf170d9cf1fe480632d8d8171f84350f0

SHA256
e56122a5ede0f8e9e6c03d520a4385c210708fac83f9064b56effa511771c319

SHA512
a975b2619a1f8b243f284baedb1106ca94c32b643587f0419059ce19366b5ba0290330602b80fe5f313d13a32a5a37ca7eb081b10d21ba9373fdcaa44b5b03d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
71KB

MD5
cd2b9bad504f3b41fb35308ee3e3fb5f

SHA1
1c965ace99b31e977f9f3bb4ed7aeddb91aeec36

SHA256
1e8132a7e443aba9f57e96ed89c11fff6d8b1578ae2416c9ca9df348c0ff3689

SHA512
08c82f3fcf8d3c0cee1c22226267c88a97ae153f331449d2051654da021519d221d8358d0072756db49be9067e2c24dd4c16b4a20de6f8e74d8271f7deb93a7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
71KB

MD5
cd2b9bad504f3b41fb35308ee3e3fb5f

SHA1
1c965ace99b31e977f9f3bb4ed7aeddb91aeec36

SHA256
1e8132a7e443aba9f57e96ed89c11fff6d8b1578ae2416c9ca9df348c0ff3689

SHA512
08c82f3fcf8d3c0cee1c22226267c88a97ae153f331449d2051654da021519d221d8358d0072756db49be9067e2c24dd4c16b4a20de6f8e74d8271f7deb93a7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
e0bf511086ace6266a1f419f20083e66

SHA1
aceecbebb28243c8b19e0334e7ca23dfd3bf2c83

SHA256
4da27e324902df3cf5bd4f77727991ce95bd1eba6b49329eff242a953d39031f

SHA512
3b30c0b48c6948be535e8e5e0d15a8d5c4c96628fd92d666c34ba86dc7ac2581fe6eab5bc5576402af8df7ea7b1cbee633ece52a727d3aaa0bda20a394a43a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a4d8dce61161a924ca229e64eefdd739

SHA1
1ba5838f09933a18e5356756cce88ea5f292ff5f

SHA256
3a3b59385bcf701ae05bc91301f664e3e9a6b6b858357c97eedc556dfaaefc91

SHA512
aaf7fb1b62b5a28bb8a885f279c3ddb4f6010703f9994972c229e1b4edc01dfe4029248ff053a8482819877ce199da849e38f89461a23958b1181740268e23df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
5784dfd196cfd6dc977494e4a1a24c6c

SHA1
41f24f7c82d560fe7a3da07423a282db58c4ff26

SHA256
bb8111beab21077e5a70910dd390f4d7a7b715bdcf902049521c3d2e0fb4f472

SHA512
ebe03a7e02fb24c1978329c4463a632823ef89aa154a6b11a043e63ce9a14e20994c1d02c5f3e6d4685536a8d10fa0a1d77fef98ea6b94a21370ca9ed04f145c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
a87f50b2a08c05eace91042670a6e2f5

SHA1
36c434c6f691f2dc54496452fdcd386244b4b086

SHA256
03cfae945a443f2f0a0ed084035dda8442ea9ad08371901c4565735b706e8a15

SHA512
232ecdd6749994b94b189019a8b6dbe92f29ebaa79c2c3d88f3c10d2ae731880ce4ce9490e1412d511561b02bbbac2717745fc2c94e805d6603a5dd4e78ca856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db

Filesize
24KB

MD5
36189bd14dce572996b845cb23433cc4

SHA1
66e6302c25c201710eb51b60e6d575ab9a3b8245

SHA256
38ff1c937bba20b1e34c16de63f71df42442cc3c4da3ed3717a47e7ea62bd0bd

SHA512
9f0cdb65d80a2c36d007826605f8f887fa2090fbdd75383442f6fdde07dcfc326b4542f20c0c03a954ec9311878d7fc1ce949f36898e088b6af2ab982d96fc53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\PowerP16.customUI

Filesize
3KB

MD5
21d8bd1956525cf0d2428dacdfe5917c

SHA1
843223794a422cfa076f72235876e77d97a4dd77

SHA256
00dd43de40f46c07490b1b10b43ca2974cca7e2dae36961de666ca081991c52c

SHA512
89121e011a263292a7fde7fdead58c70827db0207a5081e48c4428f13cdd2a268fe456b9aa972050be367379b3ad76fe3a0fafbf777146ccb0b7c6c6c2fcbd88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{7344C820-B56F-4205-B782-01C3BF88CEA0}.tmp

Filesize
1024B

MD5
5d4d94ee7e06bbb0af9584119797b23a

SHA1
dbb111419c704f116efa8e72471dd83e86e49677

SHA256
4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1

SHA512
95f83ae84cafcced5eaf504546725c34d5f9710e5ca2d11761486970f2fbeccb25f9cf50bbfc272bd75e1a66a18b7783f09e1c1454afda519624bc2bb2f28ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFDE4EBCBA9E5A2FAA.TMP

Filesize
16KB

MD5
c11c58bb5e6d2425842b8924a5a61e18

SHA1
91a97f0a46e88079bab8fe382b23c45f0028950f

SHA256
9c44ad210476da6c5c95b834cfbb0c0ef98cc835a7f64f4bfda6471e79c5409f

SHA512
6a1b44fd3866a64fb895d00f3abc455bdc5f2a7c2b66fd4449e6a2119aad2258a7fa98b58a1e8946d5408028c781ce67d680b6534b62871926d44d5311292c5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl

Filesize
325KB

MD5
58aafddc9c9fc6a422c6b29e8c4fcca3

SHA1
1a83a0297fe83d91950b71114f06ce42f4978316

SHA256
9095fe60c9f5a135dfc22b23082574fbf2f223bd3551e75456f57787abc5797b

SHA512
1ebb116bae9fe02ca942366c8e55d479743abb549965f4f4302e27a21b28cdf8b75c8730508f045ba4954a5aa0b7eb593ee88226de3c94bf4e821dbe4513118a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
265B

MD5
7d5eb0e5738aff4edb9b45bf6c5049b6

SHA1
1743c7fadd6f27b76a0e5fdb248e80db46027b9a

SHA256
e254e1237c3ff17f4d36a7d6f6a753f1a9039ce7cd5ef14998e7e3bb9954f761

SHA512
4c6abf32763a452b42d29841889b558610166b1b2c5803342a7ba30f4ba552ffdebd7c89d9996d32a8c5451587c7663ad13cbdecbe367184f7ba1b652eb02d96

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
8d17d6c15fde4c07c6740721fd7f8762

SHA1
2f53e5a8795238a220000b620980def9e69bdd21

SHA256
2b35183ae2bd68f60b3c475f7f78b5b3c734a529816dfc677acc59f17a101030

SHA512
2026afb14bf1f7b92662ebc194870875020d1e77eec707e35793ad99d5bbcbdf6c3880d8ec39a5a67c7dfee27ee54524f493165257dba5d8cd5a4b69264eeacd

Download Submit
memory/4592-226-0x00007FFD7D130000-0x00007FFD7D140000-memory.dmp

Filesize
64KB

Download
memory/4592-474-0x00007FFD7D130000-0x00007FFD7D140000-memory.dmp

Filesize
64KB

Download
memory/4592-475-0x00007FFD7D130000-0x00007FFD7D140000-memory.dmp

Filesize
64KB

Download
memory/4592-476-0x00007FFD7D130000-0x00007FFD7D140000-memory.dmp

Filesize
64KB

Download
memory/4592-473-0x00007FFD7D130000-0x00007FFD7D140000-memory.dmp

Filesize
64KB

Download
memory/4592-225-0x00007FFD7D130000-0x00007FFD7D140000-memory.dmp

Filesize
64KB

Download
memory/4592-227-0x00007FFD7D130000-0x00007FFD7D140000-memory.dmp

Filesize
64KB

Download
memory/4592-228-0x00007FFD7D130000-0x00007FFD7D140000-memory.dmp

Filesize
64KB

Download
memory/4592-229-0x00007FFD7D130000-0x00007FFD7D140000-memory.dmp

Filesize
64KB

Download
memory/4592-230-0x00007FFD7A960000-0x00007FFD7A970000-memory.dmp

Filesize
64KB

Download
memory/4592-231-0x00007FFD7A960000-0x00007FFD7A970000-memory.dmp

Filesize
64KB

Download