hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

20/02/2026, 06:14

260220-gzfa6acs2f3

20/02/2026, 01:28

20/02/2026, 01:24

20/02/2026, 01:22

19/02/2026, 17:47

Analysis

user interaction
yes
max time kernel
87s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/02/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo
Sample260220-brag2sd12a

Score

8^/10

defense_evasion discovery macro macro_on_action

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
67	1932	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
400	DesktopPuzzle.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x000300000002377e-407.dat	office_macro_on_action

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
67	raw.githubusercontent.com
65	raw.githubusercontent.com
66	raw.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{1B1FB79D-2D94-45D5-AA00-C318A145CDD7}\8tr.exe:Zone.Identifier	WINWORD.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopPuzzle.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1932	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134160241481886653"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{1B1FB79D-2D94-45D5-AA00-C318A145CDD7}\8tr.exe:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4076	WINWORD.EXE
4076	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe
Token: SeShutdownPrivilege	4600	chrome.exe
Token: SeCreatePagefilePrivilege	4600	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
400	DesktopPuzzle.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
4076	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE
1216	WINWORD.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 6116	4600	chrome.exe	86
PID 4600 wrote to memory of 5792	4600	chrome.exe	87
PID 4600 wrote to memory of 5792	4600	chrome.exe	87
PID 4600 wrote to memory of 1932	4600	chrome.exe	88
PID 4600 wrote to memory of 5224	4600	chrome.exe	89
PID 4600 wrote to memory of 5224	4600	chrome.exe	89
PID 4600 wrote to memory of 4480	4600	chrome.exe	91
PID 4600 wrote to memory of 4480	4600	chrome.exe	91
PID 4600 wrote to memory of 4604	4600	chrome.exe	92
PID 4600 wrote to memory of 4604	4600	chrome.exe	92
PID 4600 wrote to memory of 540	4600	chrome.exe	93
PID 4600 wrote to memory of 540	4600	chrome.exe	93
PID 4600 wrote to memory of 5860	4600	chrome.exe	102
PID 4600 wrote to memory of 6016	4600	chrome.exe	113
PID 4600 wrote to memory of 4076	4600	chrome.exe	114
PID 4076 wrote to memory of 5148	4076	WINWORD.EXE	119
PID 4600 wrote to memory of 5660	4600	chrome.exe	124
PID 4600 wrote to memory of 5008	4600	chrome.exe	125
PID 4600 wrote to memory of 6016	4600	chrome.exe	126
PID 4600 wrote to memory of 5752	4600	chrome.exe	130
PID 4600 wrote to memory of 400	4600	chrome.exe	131

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa6317c728,0x7ffa6317c734,0x7ffa6317c740
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,1237499209653438425,11805587657520067140,262144 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1104,i,9366715595919307821,18009607620055624124,524288 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,3037668689655883159,5680254216911393929,524288 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,11253504058083348358,15984419764820407177,2097152 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,4309362819483956197,13905466854631878314,2097152 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,6656062473604855146,14146460848885734998,2097152 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,1757281185656193811,18409437660662802234,524288 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,8235140070870642238,8981211204898421251,524288 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,8948819245116905737,7054738577360719765,524288 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,6886008076517422346,1557627710074082489,524288 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,4031287150261165418,8370824563976818552,524288 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,7550541396915140175,11784570390637902558,524288 --field-trial-handle=1996,i,2955804346794557700,17435211014550067561,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:5752
- C:\Users\Admin\Downloads\DesktopPuzzle.exe
  "C:\Users\Admin\Downloads\DesktopPuzzle.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3192

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 adca8daec255ade344b4097017c14b829b3d1422eb0b5d888b9f672f3fe17adc
MD5 2d172cd36e98aa38493df1237db60dc7
SHA1 d32fb9dc863a339fe431d01265de8a7a0a0623bd
SHA512 564fd986b96ebab60e0e08080d4402a4078139dbf0d6431f8ca64ab4f90d5fc6a0e466535cb5635ba1678fcf9d82915b18e6155efed9dcba938299c35fdd6ea1
TLSH
T1A3F0F4A6CA21EC2B18FC1B1D60541B0BFB5013172B41694B7A3D960D8FB667B8A8691C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 107a0d28c122a12ac4dbd11b5f57dc699689b54927cea31eaad37e6d9f981315
MD5 c6b2d2e704ab3b63285bfa71b14a1f30
SHA1 ee182d0ea0cbe79692930a043417833bdca07b69
SHA512 4a993475bb963478bb2bdfd14bfff11a4df802f2135b8f010682e48fb0e85368ee66c7d05993432dd552cedb5cb36602fe05271d5ddd399d97c93ecbb68bfeca
TLSH
T12351C43AF99513C7FBB2573A42C9AC15B2F0B8214C6B0E5AA21E26F304737F08385127
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ac6069c1-be44-4dc8-96d6-2a30098c1970.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ac6069c1-be44-4dc8-96d6-2a30098c1970.tmp
Size 4KB
SHA256 a0e977bc87b77c7755fdd16a8efa02238795108b21f88e7122e37cdb698a3a1f
MD5 5a2298574fb36358f412c01e0b15c79f
SHA1 bd593774db4e1b3b2c7788c1237b7300756cd9af
SHA512 8803b20373b06dbbd5345745dc7c15db220bbdbc422777a396c249543b7d3803bf66822da3909c941d4f4d19c65aae0a9f7be7d79385b0c35c2185dae2a908ed
SSDEEP 96:D0miYE+Xj5Jgw7WDimrmVqmEHmDmtZgBmO+mBj:D0miYE6j5Jgw6DimrmVqmEHmDmtiBmz8
TLSH
T1D991A0F783E49A7D8A0195F4AB14AE1FCE690514531C3C6AC8D4AE0B93E3972D24074F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f40c902f06b2679f39937dd848a30034b17f66a0e79457c1d75fec09fc34c5af
MD5 afcb458f6f3ab9f4f0a120dde51c7baf
SHA1 013834448f9d1ce6e6799e73d1c10718365eb881
SHA512 64999ee85053b4a8b21fb99903059fefc67cd85d7f1e0b47a1144889790aa621c365fca158c9feb48edbfdaf46de7fd75ba2aa373a0dc9e17234f4bfaf6795dd
SSDEEP 192:KRy1kkNagv7japAPRp2nTP9mHsb+WNnyB2rg2PM20e8ugVyIsnAUge:KRy1G8aUX+Iwqh2U2Dke
TLSH
T10C42E82DA924797F5CCBD219FA667B57EBF1102174902E84EAFC8A2C05D76CD6317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7674bd0f57a944a6d4d2b74331d92373001b8503c9a9168cbb13b8f89851397f
MD5 a2399f0278fdbab831ce07f0cbad5b89
SHA1 5bab064ecf4442460b0d5734a6da6208274250fe
SHA512 b5628d0d91c7175ab12dae891053b5652b7333aa5bce04742666a21cf6e3d09f6894ec6cfb6e9ae2d9c0b8532e735a052d97739d304c19e821001db2c4d22cb1
SSDEEP 192:KRyhkkNaov7japAPRp2nTP9mHsb+WNnyB2IPeSM20e8ugVyIsnAUge:KRyhG0aUX+IwqVeP2Dke
TLSH
T14C42E82DA924797F5CCBD219FA667B57EBF1102174902E84EAFC8A2C05E76CDA317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 35972a2ced15be35b467e968d6cbfe8708c52c726001128e8ded1895a1f499b0
MD5 ebbcc7a4b4b983f1ed30b126432e2880
SHA1 d954f5d7ed228e72ba1234591155e0f8e62da406
SHA512 cf423a1183d07a373ec4d7a85acc3d124d45709c49d0b8226d04c48a3572329cfb0f1519a600d7bfbadef6d0f207c6db01c10968a619c6ebc6a562ef6a0af8fd
SSDEEP 192:KRyckkNaov7japAPRp2nTP9mHsb+WNnyB2r4EGTM20e8ogVyIsnAUgE:KRycG0aUX+IwqpEF2xkE
TLSH
T1ED42E82DA924797F5CCBD219FA667B57EBF1102174802E84EAFC8A2C05EB6CD6317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 14bc366907be21f9d3808f1c2d6dd8da15c87445dc2e0650901c89b9baf2b8f2
MD5 cb9265593fa6911d4905fe044eddd0d6
SHA1 3dce08aba646679096c6eb9631998e72d3f48682
SHA512 91ebcf6210d3200031c8985772557c8a7df0341ae45f3093771ba820c8fe30d4cf7322e20c23448ccc693c2acc4e53523f6ffc565960f6895585086a96115856
TLSH
T190B0125084816941D00703F456D344983114DF208705170153F4BF75A82A9D04235191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588901.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588901.TMP
Size 96B
SHA256 8bebb26b5a25532266f2043ffc155055aeb523f5291140b6c26907089afc5120
MD5 28cef29d15477aefec154d5157d364ec
SHA1 9721869806988428a5f80ba4207da851d579c37c
SHA512 3baa429c48dc9d606ec79960cdf3b3285efb1173ebb9db4fb8f7d2a90b3e9bd2aee32c660fb42bd2631da66431d3990cbd63ddf9b3b95e3ea6d32caa847ba2c6
TLSH
T1F4B02200E0022302C00203B02AA8E0CC3220EF22C2030282C2F00EA2CC202E08230020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 8a8c73c2bf6ad86ff1907545ef68f1b290d4b2682b656e0642ea723ff4b772b1
MD5 6dd572a34d999d7aa2e39be31bb226dc
SHA1 c19b5d101470139595a2232334d586a2b69ddec8
SHA512 d505c5fc5d229c4d2064972721191d2e445a55ca87b94aae01bae6fc778d025239ece792ca9e6b6781041d07801b31c28b3a477317fdf4ba9bee391b6ba47fd5
SSDEEP 1536:0cChcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0d3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1649302BA9E2646E7957E468176AE780DCE13130D709FA8CC715C639C21D41C92B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 0882a7886b7b59a6cc6ce1f02f480b7011da508d28ff08c77b135160a14733b6
MD5 a2b8169eadd8fd6b25487a1baf82d8d7
SHA1 0818346d4ad1e95ed70647d8109f2e6560c22071
SHA512 d75b424f48b45699de9a94feae3f49f4f413aac12e9e07e8b9e85220873c3a7fc5ba5af4365c1c0b1c93f0f4c3b9656e81bfbe58bc19cfad6552203ef1535829
SSDEEP 1536:0cCIicYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0T3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1F99312BA9E2A46E795BE4691729E780ACE13130D709FB8CC725C538C21D51C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 6d105a21da39d6938f618520ca031decbda97439541d3c258a0205b3628d2200
MD5 78548210e6e89a1e0f870cb65759677d
SHA1 537462a1d169a73d7917e0258be6566762ac1985
SHA512 3d2dbc945a524633a6553f9ddf8b31cc2711e51e9b4acbe3ece49873133816b1c3837ad96800a11062af0d6f317408d1b3ec0a88dae6f1858f6c083ba1dee45c
SSDEEP 1536:0xCIicYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0O3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T11E9312BA9E1A46E795BE4691729E7809CE12130D709FB8CC725C538C21D51C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 52f78bb15c0be7bd4fbb55a342f5ac793b8aa68fe77a09d217f0a2590b419910
MD5 3bea89ab9f0a377378eea6b4604e5bb9
SHA1 44c7a36408b9866c7f7b0ee242fab74f1ce1ef7b
SHA512 b0e09fa66eb503275e32481c73ea40c02f59d2214f083c74f7376d51ef64f34807e5936dec5bc08f322beadb9b7dce123641d3a528a0659599b0a816139315ba
SSDEEP 1536:0xCzKcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0gK3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T19D9302BA9E2A49E799BA5681725E7809CD17120E709FB8CC7158538C21C51CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6A3C244D-C9A1-4A1F-8A77-68003FC3BBD3

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6A3C244D-C9A1-4A1F-8A77-68003FC3BBD3
Size 186KB
SHA256 95ba69eff1ee980b61fa7048b90b6c36b2e7ac2d369fc35fdf823556ebb0d1a3
MD5 7dafb08df033f25cf332c95c0547a454
SHA1 0bdb5d605bc525c7facd5e62b40bd40230c22769
SHA512 449887431158de1e2c4b021cf487e41b5f14266946d4936e84a134c1505b9120f92389890e256ca59ac8c29dd1345dfbd98d7748e3276b4b64f3a399131e6d1a
SSDEEP 1536:urVe3b3yFK13SllbD4sghEz1e7HW6Dkjj/mtCcAZl1p5ihs7VXXbEKD0aO71a3YY:Bue7HW6Dkjj//Xo57oH
TLSH
T1041402A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 10KB
SHA256 44e5355cf315f7d1002ccaee1d8c47f83a262d830805761140df9f2001cca4f8
MD5 ae69f91c5f091ee66164a9d07b560042
SHA1 334d0583a8c3fdf31330ef4a5cfe05df5d3f58d3
SHA512 f14cd60df99128992522ae72abd618fd0ee55a5cffdf6025f1499637016b18783836df5088c9a457771e07a2d34a45a3fe50dcd514ff810183322b939f554c42
SSDEEP 192:DjZ393BzrBZa4jjp9xDzR3ZsWBkjw69DuzqkZppjTx9P3zc:bBfDvB4uN34
TLSH
T172220FA2936EC5EB98357F176AD237914055795A32CBB009571C024A32CBA18CFFF735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal
Size 8KB
SHA256 35ba26e3209183c79048bca0c214ef5467a2c0aea1ea06e4c5ab332007c0907a
MD5 1e616d170d821539f7f32f7b30a5f990
SHA1 f0fbc11b84e3810b5852298b9b9ef9c7078b9539
SHA512 20349b7daa82521e02600470d7353a9fb03ba1327a97c7b713530f511cfd0ae1b7a6fa21d209cb6b7bea8f8c86fb393a5bb2f69ca5889dc2bcb68c72ad633fb6
SSDEEP 24:KFg5Dqt8VtbDBtDi4kZERD+lTqt8VtbDBtDi4kZERDf:ig5DO8VFDYM6lTO8VFDYML
TLSH
T14102E4C175787161E0A661F7CDB3136B173EA165043392A32EF258A29CC18CAD4255FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 4dbde982eb25cd7d66efdb86b682cd513deb89bf0baabb42dfbaa06c0823b443
MD5 90ffcd572511fcdc53e76434ed35a4df
SHA1 14c95cce05009a3647489f6be600588efc8e525d
SHA512 7fd5c97529f6d2562653995e2be28e97f3841d22b70bbc4beda168f966b24cc4cb53abaefafcc758249924436b729e5400f843018b8b0108bcae8abbe6a7a329
TLSH
T11741275CAAE91148B3776F6A9BF6A86D487B7C372F07D15D10110E8E4A36B00D8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 c6e67039d9ddeb5452f53793d1cf5a23ce09b1775756662ed4c31a609f244427
MD5 0bd4e7b583902c88f46071a5e1994527
SHA1 e2d910f86a10fea728894f95683516c702825a62
SHA512 6836b97fe4bf1beaf0e5aea87bf24412d6732f9e8137df4cb188d2817656d5084b7f6e8c33617a8bbe03345ff1ad2a1826d11d17f1db4415514d4d4799577f97
TLSH
T14051596D6AEA1108B3B37E5A9BF6B96E487F79732A07944D10150F4F0A22E00D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

5AA89E41.emf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5AA89E41.emf
Size 5KB
SHA256 3e430584cd9774ea3b21d8e19b485b48212fe356776158dd5f3c5f63a5bde7d3
MD5 0ed5bc16545d23c325d756013579a697
SHA1 dcdde3196414a743177131d7d906cb67315d88e7
SHA512 c93072d11058fa50e3b09ff4da9f3dbe2637c2b5df05e616bd8ddd04557ea1e8b0db106b1545fad334619118c467776f81cf97ca52d3f2fcbbe007f30032b8af
SSDEEP 48:ZzCbf08888888888888888888883FSjciCwt2:kY888888888888888888888sy
TLSH
T10FB1C80532B0CA29C4559634DD9BCFF95E92BC03CE21826773A5FF8F39B23946603611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDE448.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbhja.rtf

Path C:\Users\Admin\AppData\Local\Temp\vbhja.rtf
Size 816KB
SHA256 642a4fd0d4b2aa1d73bf48e293eb37d5be465318bfdca4fa356992269752dba4
MD5 2b3d53db60326bfee1a16451f06ba04a
SHA1 98d4021cf9a939a2802c87c62403f84e9178fa86
SHA512 665a714061f05f7d1af5a0d251669532aaae6ff5a64805b31c97cbaa23c5229ad3287c2a1d7a8c79ef2266a328922f049981eed9f153ce9a80c4b8e18b93fd31
SSDEEP 6144:mcUnvHbZOtIrgZGzXHtsg7uBDIjrbYgxjD/cznPsRNKN:/UnTZO+8ZGTHGWuBDiIgZwPsRNC
TLSH
T117059768914B1498F2D7A519254FBB48253AFB534EC34E8333ADD9B11F96AF3EDC2804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 416B
SHA256 f551aa3e041c41ed21d2db4b0826676319c7b7757772f24253d493e8570f43a3
MD5 73d946153d1e72c97a978a425cef50de
SHA1 be993e4f897df1cf2393ee19b349a86763ff334e
SHA512 2e325f1ae87454e64cc190ad4ba9f3a5093567b9f6da49de1af5ec1ec406748231c11243f26c5ffad3fb03b13a14f2fb7d8340422247c3941edfd5a1e613450b
TLSH
T1B4E0656BB360F3FAA3BC02443E78CDC96BF29C24CB4D191A19CC0D870D64283804720A
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 819418.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 819418.crdownload
Size 239KB
SHA256 1f5a26f24a2bfdd301008f0cc51a6c3762f41b926f974c814f1ecaa4cb28e5e6
MD5 2f8f6e90ca211d7ef5f6cf3c995a40e7
SHA1 f8940f280c81273b11a20d4bfb43715155f6e122
SHA512 2b38475550edee5519e33bd18fea510ad73345a27c20f6457710498d34e3d0cf05b0f96f32d018e7dc154a6f2232ea7e3145fd0ed5fb498f9e4702a4be1bb9c8
SSDEEP 3072:r/3qftCdbSFtY8Zf8pOk0rHitNWIekbnfFPsr24Cv/Eng9m3ihlCeKH6Fb6aX3WA:WoI/rC0k7ar68nimCYHe3qZr0SlC
TLSH
T167345D66F6D04C33D1731B7CDD5797A59C3AFE103E28988A6BE41E4C4D392817A282E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metrofax.doc.crdownload

Path C:\Users\Admin\Downloads\metrofax.doc.crdownload
Size 221KB
SHA256 b13b29772c29ccb412d6ab360ff38525836fcf0f65be637a7945a83a446dfd5e
MD5 28e855032f83adbd2d8499af6d2d0e22
SHA1 6b590325e2e465d9762fa5d1877846667268558a
SHA512 e401cbd41e044ff7d557f57960d50fb821244eaa97ce1218191d58e0935f6c069e6a0ff4788ed91ead279f36ba4eddfaa08dc3de01082c41dc9c2fc3c4b0ae34
SSDEEP 3072:zVIfFuR6AqFMa2fL3NtkWL90y7K4mlQCww7zDTW6HNRn0nPmaw:zVIf8RsOtZclptz78Pk
TLSH
T1CB24AE23F6E1CC72C81342300952CAE56BB9FDB11B524247B78D3B6EAD356B0672A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-780-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/400-751-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1216-587-0x0000014A12DA0000-0x0000014A12EF3000-memory.dmp

Download

memory/1216-718-0x0000014A14130000-0x0000014A1416B000-memory.dmp

Download

memory/3192-394-0x0000017C5BC60000-0x0000017C5BD0C000-memory.dmp

Download

memory/4076-428-0x00007FFA30400000-0x00007FFA30410000-memory.dmp

Download

memory/4076-438-0x00007FFA30400000-0x00007FFA30410000-memory.dmp

Download

memory/4076-437-0x00007FFA72B70000-0x00007FFA72D65000-memory.dmp

Download

memory/4076-578-0x00007FFA32BF0000-0x00007FFA32C00000-memory.dmp

Download

memory/4076-579-0x00007FFA32BF0000-0x00007FFA32C00000-memory.dmp

Download

memory/4076-577-0x00007FFA32BF0000-0x00007FFA32C00000-memory.dmp

Download

memory/4076-576-0x00007FFA32BF0000-0x00007FFA32C00000-memory.dmp

Download

memory/4076-580-0x00007FFA72B70000-0x00007FFA72D65000-memory.dmp

Download

memory/4076-427-0x00007FFA72B70000-0x00007FFA72D65000-memory.dmp

Download

memory/4076-426-0x00007FFA72B70000-0x00007FFA72D65000-memory.dmp

Download

memory/4076-425-0x00007FFA72B70000-0x00007FFA72D65000-memory.dmp

Download

memory/4076-424-0x00007FFA72B70000-0x00007FFA72D65000-memory.dmp

Download

memory/4076-423-0x00007FFA72B70000-0x00007FFA72D65000-memory.dmp

Download

memory/4076-417-0x00007FFA32BF0000-0x00007FFA32C00000-memory.dmp

Download

memory/4076-420-0x00007FFA32BF0000-0x00007FFA32C00000-memory.dmp

Download

memory/4076-422-0x00007FFA32BF0000-0x00007FFA32C00000-memory.dmp

Download

memory/4076-419-0x00007FFA32BF0000-0x00007FFA32C00000-memory.dmp

Download

memory/4076-421-0x00007FFA72C0D000-0x00007FFA72C0E000-memory.dmp

Download

memory/4076-418-0x00007FFA32BF0000-0x00007FFA32C00000-memory.dmp

Download