25508da7e4efca1c3e0a67b88a7bf2428fefac8d65342c8a836a8aa7e1d7d18b

Analysis

user interaction
yes
max time kernel
270s
max time network
272s
platform
windows10-2004_x64
resource
win10v2004-20260130-ja
resource tags

arch:x64arch:x86image:win10v2004-20260130-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
24/04/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25508da7e4efca1c3e0a67b88a7bf2428fefac8d65342c8a836a8aa7e1d7d18b.doc
Size 12KB
Sample260424-k225gset7m
SHA256 25508da7e4efca1c3e0a67b88a7bf2428fefac8d65342c8a836a8aa7e1d7d18b
MD5 5e1187d61958733e0173d86119cda57e
SHA1 f45126186a6c5b84ff72c54583c20dc672fcae26
SHA512 74f9cb7c4b77076ea94dd80cb4932edade88178d05bee9185e3e3c15c18f6447695d5a9fe7b831b1873f7415e98556b82ab73de1b8c69253b8dfbcce84a14c53
SSDEEP 96:I8GOhI6aHSB+8Q7h88IuERqjxLYQ2BygKDafkb91L8Y7VL8AJa:I9OhfaHSBMW8eqNLYQ2iufkJ1AY9O
TLSH
T1C2424346B3C7CD15E46A9B7849A783A1353EFC586E05E623B148FB2E5C32DF1E600E84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
167	852	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
173	732	Assessment.Letter.1D27FFF720A99BBF8BD.EXE

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	Assessment.Letter.1D27FFF720A99BBF8BD.EXE

Executes dropped EXE 3 IoCs

pid	Process
852	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
732	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
1000	Assessment.Letter.1D27FFF720A99BBF8BD.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assessment.Letter.1D27FFF720A99BBF8BD.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2868	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214952621655963"	chrome.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5116	WINWORD.EXE
5116	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
3176	chrome.exe
3176	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe
Token: SeShutdownPrivilege	560	chrome.exe
Token: SeCreatePagefilePrivilege	560	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
2888	7zFM.exe
4728	7zG.exe
4120	7zG.exe
3484	7zG.exe
4220	7zG.exe
2980	7zG.exe
2852	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe
560	chrome.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
5116	WINWORD.EXE
2248	OpenWith.exe
4484	OpenWith.exe
4460	OpenWith.exe
852	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
852	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
732	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
732	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
2020	OpenWith.exe
1000	Assessment.Letter.1D27FFF720A99BBF8BD.EXE
1000	Assessment.Letter.1D27FFF720A99BBF8BD.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 4036	560	chrome.exe	90
PID 560 wrote to memory of 2868	560	chrome.exe	91
PID 560 wrote to memory of 3036	560	chrome.exe	92
PID 560 wrote to memory of 3036	560	chrome.exe	92
PID 560 wrote to memory of 3184	560	chrome.exe	93
PID 560 wrote to memory of 3184	560	chrome.exe	93
PID 560 wrote to memory of 4860	560	chrome.exe	94
PID 560 wrote to memory of 5044	560	chrome.exe	95
PID 560 wrote to memory of 4860	560	chrome.exe	94
PID 560 wrote to memory of 5044	560	chrome.exe	95
PID 560 wrote to memory of 4912	560	chrome.exe	97
PID 560 wrote to memory of 4912	560	chrome.exe	97
PID 560 wrote to memory of 3564	560	chrome.exe	98
PID 560 wrote to memory of 3564	560	chrome.exe	98
PID 560 wrote to memory of 4120	560	chrome.exe	99
PID 560 wrote to memory of 3208	560	chrome.exe	101
PID 560 wrote to memory of 3208	560	chrome.exe	101
PID 560 wrote to memory of 3724	560	chrome.exe	102
PID 560 wrote to memory of 3724	560	chrome.exe	102
PID 560 wrote to memory of 4444	560	chrome.exe	103
PID 560 wrote to memory of 4444	560	chrome.exe	103
PID 560 wrote to memory of 3136	560	chrome.exe	112
PID 560 wrote to memory of 3136	560	chrome.exe	112
PID 560 wrote to memory of 772	560	chrome.exe	113
PID 560 wrote to memory of 2292	560	chrome.exe	114
PID 560 wrote to memory of 4520	560	chrome.exe	115
PID 560 wrote to memory of 536	560	chrome.exe	116
PID 560 wrote to memory of 3176	560	chrome.exe	124
PID 560 wrote to memory of 1104	560	chrome.exe	129
PID 560 wrote to memory of 1104	560	chrome.exe	129

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\25508da7e4efca1c3e0a67b88a7bf2428fefac8d65342c8a836a8aa7e1d7d18b.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffe7a7c728,0x7fffe7a7c734,0x7fffe7a7c740
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,15526779124811770602,8289456599306539187,524288 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,3975527942093819846,16765755164565836764,262144 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,9518362577207535512,214614461563501038,524288 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2176 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,929848813966353695,7287523152516207868,2097152 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2628,i,10852280478916907243,16445656755772557795,2097152 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,4089478025537402208,4277028164927894124,2097152 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4792,i,13352819424893882756,10608253567643587323,2097152 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,3426704524221227432,5254151556351284842,524288 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5772,i,11749325383148696205,10414717074042434218,2097152 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3332,i,10679550350763642837,12259420720904015,2097152 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3528,i,1286525671457717706,14349766489652406110,2097152 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3456,i,8171894409517706131,14294636352774257063,2097152 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,3011093314467103832,11118178705022062980,524288 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,18313615941941196645,15036401814896042119,524288 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,8106511079175015250,14196172223102875173,524288 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,9172737194611012561,9979716508416462730,524288 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3924,i,16956464062047198727,17726474132610223868,262144 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=ja --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,14779480355697979916,415506972531267188,524288 --field-trial-handle=1964,i,9723728092991521020,13362996846882412484,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3324 /prefetch:8
  2⤵
  PID:1104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3920

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\給与および職位改定ならびに給与明細ダウンロードのご案内.gz" -t7z
1⤵
- Suspicious use of FindShellTrayWindow
PID:2888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4484

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4460

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\給与および職位改定ならびに給与明細ダウンロードのご案内\" -ad -an -ai#7zMap23778:114:7zEvent963
1⤵
- Suspicious use of FindShellTrayWindow
PID:4728

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap13184:114:7zEvent6330
1⤵
- Suspicious use of FindShellTrayWindow
PID:4120

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap20674:90:7zEvent31660
1⤵
- Suspicious use of FindShellTrayWindow
PID:3484

C:\Users\Admin\Downloads\Assessment.Letter.1D27FFF720A99BBF8BD.EXE
"C:\Users\Admin\Downloads\Assessment.Letter.1D27FFF720A99BBF8BD.EXE"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:852

C:\Users\Admin\Downloads\Assessment.Letter.1D27FFF720A99BBF8BD.EXE
"C:\Users\Admin\Downloads\Assessment.Letter.1D27FFF720A99BBF8BD.EXE"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:732

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap14971:136:7zEvent26306
1⤵
- Suspicious use of FindShellTrayWindow
PID:4220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2020

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap654:64:7zEvent954
1⤵
- Suspicious use of FindShellTrayWindow
PID:2980

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap4826:136:7zEvent17647
1⤵
- Suspicious use of FindShellTrayWindow
PID:2852

C:\Users\Admin\Downloads\Assessment.Letter.1D27FFF720A99BBF8BD.EXE
"C:\Users\Admin\Downloads\Assessment.Letter.1D27FFF720A99BBF8BD.EXE"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1B7671A5957918453A16C5C15634EFED_5A5015EDFB513B5686006384177FAF53

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B7671A5957918453A16C5C15634EFED_5A5015EDFB513B5686006384177FAF53
Size 1KB
SHA256 78831f8f9b9590861e6130fa4d3f00f2c8c8d02da399b1519d2c6f39fbd2c384
MD5 110ebcc3808a6dbd12b91df785a7e680
SHA1 9b76f518f3b75c15a4e7720785b03eeeda945f0f
SHA512 554f75002f6937f96d6e2428afd9313482f46e6a7edb6108216cda52a2a92a48267268d96097de4ce64e8041549389f0e38059f2b3592117962ca31c982f9aad
TLSH
T1C93183245E616C653BA308801FEAE77EEA35B4C508601121347DDBD5DED37BB3A3581E
MD5 SHA1 SHA512 TLSH

Submit Download

43B48DA1D00CD3789726198FDC0793EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\43B48DA1D00CD3789726198FDC0793EF
Size 654B
SHA256 e328f1ae570f14958dd00c39030adf31191cc4be9ff662a8fe62a816799ba39d
MD5 e61f1dcb64d7ad04a303acfae13b823d
SHA1 91d2a6c70bc83fbf8d1c2071707a91ef468f1ed8
SHA512 2bc7d07c2693c2ff24d71bafb03b7fce950cf06137aeed3fe30f67b528e4527fdf4887c66fba7d4f35e1edc98b5dd33e83ec5335d88e701d049465f495a1de4d
TLSH
T1E3F023D1F11D0900B98CCE9772CECC2F6FB0D28189616A279430168905A13A7E77BA29
MD5 SHA1 SHA512 TLSH

Submit Download

5842D07EE79257F8DB719A0F6EC17AAC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5842D07EE79257F8DB719A0F6EC17AAC
Size 781B
SHA256 8d0f76bd651eceec31c550e83d3ebd04a8fb6498b2ed4acff60ec1cae15e1170
MD5 be359ea652e030c4f3ed41be1214c092
SHA1 837b113ac9bd4aff063c66b3934e0a8f12bc013f
SHA512 ed0da2a22feff9bc077c761be9703184c8ba5a3cb24855959e9b1792fe4eecea28d66adba6dee1f5a8c4620ebecd85f1a2f0092ac929b81d0a7a91977edecf9e
TLSH
T17C017A6EC7B5D7804E197ED001850B3BCCF4C99157444359E7E1498D0E53F6976D943D
MD5 SHA1 SHA512 TLSH

Submit Download

1B7671A5957918453A16C5C15634EFED_5A5015EDFB513B5686006384177FAF53

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B7671A5957918453A16C5C15634EFED_5A5015EDFB513B5686006384177FAF53
Size 408B
SHA256 bb0745b9d89831749499ce2fb8f9f098ecd4b3695c046e9527fcf2790ac665f7
MD5 f268cdf24ef92c44446f1534067b7f8b
SHA1 80e527ead29714b0d553a9b00cc9f145dbbb7cc1
SHA512 29f42a4ee2d0d66fcf3d0922c0f065b7f6bcbf2bb98eaa7cd67140cfd152efa30fd9009812e21460f24fc39137ef015d6e3cedfd382cf79cb18250ac25bc07e5
TLSH
T152E0C01932FD005DF634CABD04CDB3914927F533042A26F548901A413E209801C62472
MD5 SHA1 SHA512 TLSH

Submit Download

43B48DA1D00CD3789726198FDC0793EF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\43B48DA1D00CD3789726198FDC0793EF
Size 216B
SHA256 36ce76f6ea8079ec7ec2e000a86bb332637838e0aae4bd9e05fa30aaca16d3d9
MD5 8f804673b50b20e195f9671a89642701
SHA1 e870808ae69c875b6a513666fc6f8991b0bb72cb
SHA512 30b36e030d733afe8da3cf3e2f4d77b53475140cdab2498481307bfdae91d1adba2b0c5ba4b4036a447ad6f854b4e775a6e21db79ab6d8035cd577979bbdb94e
TLSH
T132D08C1C23C812A3D112CA3D3EF60602CF6262344E30EB1E13F2007C5C647431830C1A
MD5 SHA1 SHA512 TLSH

Submit Download

5842D07EE79257F8DB719A0F6EC17AAC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5842D07EE79257F8DB719A0F6EC17AAC
Size 214B
SHA256 7dae6a4ca27043538ed7f7859ef370db7415f0ff1593ba6a45b4afc40c81b055
MD5 6b7149d6a02ec527d11262ac80524b14
SHA1 6c37a63c13c091fc9094a94131c6066bab30996c
SHA512 18d99a6f8393eddaad547760f096d65c89296c1779d97c101e35e2603d0ae9b4b4bc56c508f2ef6e36ea617f80f462df0aa0dbe192b46fdd9fd94af618f0e232
TLSH
T129D08C0003FA3662F1341D3E3F9006408F272179BC25C3669B35402EBA3CE00C979A06
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b5934a4b117dc3416b4773254a5d5010034e3858366b19bed972dc15becacaae
MD5 d7060a55acb7500b3ac1ac8847f00277
SHA1 a23254e0c409e97de6e606de563666c195a8057c
SHA512 069504e6f572079466a01a9d0d825a9157db73bebc9cbbe06c563dc7b9f9849ec6929921123afd93e2b5b724470d30dcb3d272ca48ea4b722169457a2852b98f
TLSH
T1F8E022BACC26DC371DFA0B2861044B42E76027572782881F7B3CD60D8FB173A46838AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 bc12d4132dc5bff7dae6d85e63a886f1c3542d2321d5752583202068a4e0db93
MD5 f19d9b50bb8c97a216029431b3d4b087
SHA1 33a0a2d42e7daf56d92d20c89938959fba49e193
SHA512 ad335b0b42a146f114b2df74b3536f413de930af69a23b9d61bb995b870b05aa0d5134435a414becf254306354fc70e3ec5b8daa044cc3084309281694188816
TLSH
T127B0121043F0E401D7C142311192098031150D185205420343F050A890A5B921201100
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e121ecf810e89843c65af55e516cfd38523094af52157aee571e5b3a0eb2be7c
MD5 910b451acc405502a7db12573cf3f5d5
SHA1 e362adfe145f686c13fd3a6a74bc301df4b62c84
SHA512 cc4f6ce5d6bd6676c40f49ccea93e9d46f68f38a8d342cf156ec8085e7765f2414d6e18cd64a315719006a37abee3111e8e89bfd1174f2a9bbf8f08f6b14c6a4
SSDEEP 48:YALlhjq7vqkUGUqNXU9J6h9aXYfo7zsigmzsX4sHfsgosE1KsEYcs/ls25sNZeA+:DFkvJ1fpOJ6TaIa/gHVcWYr1R6jhAo6
TLSH
T16DA19DF7C3E8C62DC91152F4AB146E2FCE6D0A18435C3C6689D5AF0B53E29B2D20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4c627e04f3bc65d811b369ec98f08332c5b695ba69146dd1c6087e07fbe55596
MD5 6df7e8dd4083640043e975d4c8df6154
SHA1 3e83e05ef0277be5545a50518a4568737e4e7786
SHA512 b62bf82af6e0de4e7ad4512d81a424311bdbf258b42a7eb369c146ed1dcc3672091443373c8d3d5833b6e4e621babcb81795cb5139633ca4570405a92c6e893d
SSDEEP 48:YALlhjq7vqkUGUqNXU9J6h9aXYfo7zsigmzsX4sHfsgosE1KsEYcsIAs/ls4+s2q:DFkvJ1fpOJ6TaIa/gHVcWYEH/sX6
TLSH
T1C7A17CF7C3E8866DC91152F49B146E2FCE6E0A14435C3C6689D5AF4B53E29B2D20135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8f6e3d6c2869f46ae4b5e17ea992e3781e7fe07b0f9077070a4cb169757f1bff
MD5 a6ea2e895b935c09ce8060c4cb41efe7
SHA1 68165f08c378882a0a239d8e2eed7ee0d2cfa173
SHA512 9c8791a40b68c601e639f2f1244bb17e767056250cc6ef58f670a64a5314e595b4df266d6017b2149a6f5554b81bba6f9b828d785de7b7522b44744b982b28c3
SSDEEP 192:KRYxLucsSQLv7rpAPRp2DV98Hsb+WNnb/AAo2wVJkwq8sKVyIsnAUg57aJ:KRYxezHUX26wLI2UJKA5O
TLSH
T11E42D62EB914797B5CCAD219F9257757DBF60021618A2E88EBFCCA3C00D7ACC212745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8be5de28afc47bf92cd114a27299922f8f94ec2d796a9c9a1d429e207e0c5cc2
MD5 3a994d3ebf940f2b993539c1ef72e2d0
SHA1 a81e7bbd2f22944aa7d00e63ea2bb1419d45ef1c
SHA512 50565ceb77b2d7e49fb2828c87b17feff4b857fe6b3e3230ace3cc1e02523f87522651217f0ed8d2268bd46a32a95c6fba48a8daa399cf9aa5e3dd21e062b49d
SSDEEP 192:KRYxLucsSQzv7rpAPRp2D098Hsb+WNnb/AAo2wVJkwq8sKVyIsnAUg57aJ:KRYxeLHUXn6wLI2UJKA5O
TLSH
T16542D52EB914797B5CCAD219F9157757D7F60021618A2E88EBFCCA3C00D7ACD222745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 53a617813cc5cdbcf4e91f1d8f4ef89d53fb4ff14262562da2e7991744a405b9
MD5 bad09116849b8fc3b846220125ab8080
SHA1 54eb95ae6d9d0bd4cb5a748762ec3200904dbcd5
SHA512 00967746bf47b6e787f708e0e6fe2a2c996f90281e778fa4f0b25407831703b2ed25e62e60dfec70d91ec849f70f877de60154f8e0e5449d41d8df5e26f5476b
SSDEEP 192:KRY1LucsSQLv7rpAPRp2D098Hsb+WNnb/A0EeYVJkwq8sgVyIsnAUgv7aJ:KRY1ezHUXn6wLEesJKOvO
TLSH
T1E752D62EB910397B9CDAD219F9157757DBF2102161852E88EBFCCA3C00E7ACD222745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cf139e73ad53a4b3a1751cb0a834499e1528f78002e21a656e668803eedefca1
MD5 cd284cc924d863f450cec2a67788cb2a
SHA1 491b054f8907a6b744018e5b869946e0eeb7ecb7
SHA512 dfc922d061a761957935082877ba42742f85af9f253153a7e5e1975cce75d941ed7a8bbb8dc2e3caa1f9a8b022f7649b8b6babd34d0e6d59ec7aedb27b9b5e36
SSDEEP 192:KRY1LwucsSQLv7rpWPRpwD098Hsb+WNnb/A0EegVJkwq8s+VyIsnAUgv7aJ:KRY17zHmX56wLEekJKAvO
TLSH
T14F52E72EB910397B9CDBD219F9157B57D7F2102121952E88EBFCCA2C04E7ACD221705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 afb620de3b74827cbe295f411d3ecdb7b3c517621c758b75d54c4546c47c1f72
MD5 724082666a3c21d5e5b0a8fff7a58862
SHA1 1f6a243da4aab5c0e02884397886f8118618c86a
SHA512 31100bf34c4a47d731b0de54174b0113a5df409c15dd34e737c2a2f9d65c8c428697de78b51099d4d685f455d566651cc68cfa11327d39e1e3421671ce9b9830
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLdLcPfqrXODID+ErU36tsHui6+AAlSu:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pi
TLSH
T129720B6B6C4C9E7B0F94C688D8167F4FADB6025B65D9886483FB882A03D4BCF11491F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 efa3287222cc43a1af85165ab74558e437ad49461c5d5229d2e0aae2ceafad9d
MD5 a4f6ffaf1d5186da7ba01d5d64dfa1f6
SHA1 377a64eadba218b756218b42e4da930a330df6d2
SHA512 15d23a699d69c6c1e647206431dd261114ef65836df707f23271c74f9a11265ea7b44208b2e8d48dcfb0d36d514ef41d585f186058bc23c59e8fcd774a6827a4
TLSH
T197B012608401ED11C04743F4118614883614DF10C717130163F4BDB198271D04114150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590bbe.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590bbe.TMP
Size 96B
SHA256 17f44e9509b839814adba6b406a7f4e52a733a45f8222c79845ea18b14407759
MD5 a6154d1651629e93052bc2ea90b5fea9
SHA1 f3b5b4bec12b0c09ccad7a986e47b2325cf2e4aa
SHA512 9aedcf292d09321e38941f1a341b6c038bb0824be4d090388f2b0628a872d9b8d7858ffc9f1cc49726b27b00aec443972366d6800b47af81c71c34ce686c663a
TLSH
T143B00255E306B212E04203F82995B5D8F160DF35C783222A93F55A67DCA66614526AE4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 5a097a3f34c3adb366c40da4ecde22c3d639d5dce4fd4227b5ddbe5cb06f5390
MD5 da89a286f8aaf848f4f69d699ad82fe4
SHA1 3c03de2712983fa16caea66c386496c4e21f1e58
SHA512 0c7bdb30d0eba3ca3ef2d10050b1d31b403e2ffbdd08ef87e4b914b41611aac92acaf896fc2b2f778909970366e3241d183c605288add42f952fdef994de7e19
SSDEEP 6144:EQoXaASOdsOzixBO8TOtrOk0HOGm/SFyEE9:Et0OdlzixjytrOjuGdF29
TLSH
T15E1412A98E234ED764BA9BCE355E740DCE719356106EE3DC238477CE52C11C927A2D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 98491c658ce7cc40bac21f6bfb4b36ec0e7be299b78b2d3ab11128e8dd2b4aa5
MD5 da83d106f79464c353ca6537684302ba
SHA1 63125b190d4dddd144a577ed4af7d8010aac5cff
SHA512 7c45a97157e9cdbdfe91f4d010b73e49849c97828664989fe75bc16ef4fed99bb27c49290228ea4b0679b2f6923135e53d82c8b018f90bb362efe7fdfb33bb49
SSDEEP 6144:AQoXaASOdsOzixBO8TOtrOk0HOGm/SFyEE9:At0OdlzixjytrOjuGdF29
TLSH
T15F1412B88E234ED364BA9B8D355E350DCE71A357506EE6CC238477CE52C10C92BA6D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 c59a7e86e2f9aef60324d80a70e90dc83a88d52c7f50608ab7a66a1581d55e5f
MD5 9adbcfaad7ecbd3beeb2d6e0efe202f2
SHA1 099a26daf56eb14bbb83451fd1d4efb13667bd43
SHA512 264b5c09a8e09d4ec19ec1e506f511e14b757e167d54bd974f7be92fe6ed93fa92e84fa863062a54d1c9f77dba8bdcf1e59d49178a1f468901c15efae7eb5181
SSDEEP 6144:AQoXaASOdsOzixBO8TOtrOk0HOGm/SFyEE9:At0OdlzixjytrOjuGdF29
TLSH
T13C1412B88E234ED364BA9B8D355E350DCE71A357506EE6CC238477CE52C10C92BA6D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 834d5d16a9e11809c93101092ef883ff776cdc0ad0172efe183b390e28f30d53
MD5 0c9fe74ec562765a684e6e355f7aa28c
SHA1 36e1deccca4ce36cbb3511d845b873381e420c68
SHA512 08b544166646ea344a8bec0e5c6e55a081b5f942d125c4546455b51f4c1c0fbbd8541b9585cfece0f2260a518c778c533a4b0ec9bedc1b5905ad0c26f6e7ff28
SSDEEP 6144:TQoXaASOdsOzixBO8TOtrOk0HOGm/SFyEE9:Tt0OdlzixjytrOjuGdF29
TLSH
T1031412A98E234ED764BA9BCE395E740DCE719356106EE3DC238477CE52C11C927A2D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 3868c703771b5886959d35055f9218cb8e901fa5001098aa23e93454361d0bf7
MD5 cc779b4126fd105d1379356ed0c5563d
SHA1 57bd78549bd95129c1003d1b21ab5770cf68da28
SHA512 78fb55e44673426bd29a83a58835047042763ce89e9d35d45cac68a8e9a3507475c8cd300e22fbd66d47578a74292fb819d1e9fc2f1e1864f2f99f54c9acfd1a
SSDEEP 1536:gVcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:k3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1F49302BA5E2A46E7957E469176AE7809CE13130D70AFA8CC31AC539C21D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD1559.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7DC421BC1C5691655E814F866E9A0FB6.EXE

Path C:\Users\Admin\AppData\Local\Temp\{7F3AF188-A4A4-4B1A-B2B4-5065E993E297}\7DC421BC1C5691655E814F866E9A0FB6.EXE
Size 548B
SHA256 d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
MD5 370e16c3b7dba286cff055f93b9a94d8
SHA1 65f3537c3c798f7da146c55aef536f7b5d0cb943
SHA512 75cd6a0ac7d6081d35140abbea018d1a2608dd936e2e21f61bf69e063f6fa16dd31c62392f5703d7a7c828ee3d4ecc838e73bff029a98ced8986acb5c8364966
TLSH
T102F0909F5F12287F2E238571F4C35169CF680A57FB9925E28748011F7ACA04549F1FAD
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 242bc4683a5af439377c29f465f314d59c35500a8b1e6494184a88ccdb8b0571
MD5 343cb532ff0fb31008361f11a4be7bd5
SHA1 1a7292c415595ed5e994e61d1851abaeb929c91c
SHA512 800f27afe3f1e71291d89c936241818c0e802f1ef7182f9d1240643994ed9978c15e1f5cd2a30fcd17e699b94f59f46171914139192f1d3871c9573ed7ace07b
TLSH
T1ED61DD0266DF6F0BE00507768A36970AC7313C82E754B52DD2C4D36A6E74E089E5DB6B
MD5 SHA1 SHA512 TLSH

Submit Download

.ist0

Path C:\Users\Admin\Downloads\.ist0
Size 1013KB
SHA256 846958b3c9544672857916a54d4bcc9ca2956cfc63771a788138ca860afc85f2
MD5 d3c59a444ea15c95dd95676583adff8c
SHA1 7a7d75caa617f7b2f40ba64cbdfcf2d8e644afb0
SHA512 b62651acc4b3b510480644b55448c6591b5bd8b86cb1ed761ef148ca9fffbeb5db2f657374bd6c9bd822d3bc2397341db610ff0cbb25f1c79f4e8e0821e0e482
SSDEEP 24576:GDf0Efmt1TplA0tuKR4iGE1yeWg9rH3CsUhPH3/L6:ufCR452JdH3Cvxe
TLSH
T1DB2502AF1EA740FBC9C12498972BAFD233F795E609C24CB16AC5F08D61E2F747026546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260422184418.tar

Path C:\Users\Admin\Downloads\20260422184418.tar
Size 4.7MB
SHA256 9daea79c5a49748461f033f6329430e2ee85860dd07bbadd82ab1a28759f6041
MD5 b1a97f11363eee6715c1f42b154c6e9b
SHA1 0cf7628c2a8f03b08de52b037c3a0273595e2d66
SHA512 b52a64e88e7d7b52100f44fbef95d732e87c32deb84bfdc6cb6caa9d1b2159c4b808b0b3c45fff0ee5180c90eddab9ffb8810b69ff9a4fe903d388608374c431
SSDEEP 98304:Vm5lUvvuzDcPNgqytLbArr3cXkZx3Z3imdH3Cun:o5exNgScXkZxp9dH3D
TLSH
T177369D213DE74436C66323314F59B73833FDAD631B36828B5788FB1D2E742A2662516B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Assessment.Letter.1D27FFF720A99BBF8BD.EXE

Path C:\Users\Admin\Downloads\Assessment.Letter.1D27FFF720A99BBF8BD.EXE
Size 4.7MB
SHA256 2067856fa02a7e3a264ef8514a6189255927bfec16d4b8aa724580a72f7cd17d
MD5 3bcf88cddd9922b8bdbbc94c2d2238a4
SHA1 47d177b9e0906ed3607e592bdd8e72aa49bd2126
SHA512 c5dd3ba4a939ca01f3492fd08bec67ef65ab6b646bfee1d449fa65c5951a475f2195108c0ab52975b835d2529aa44a6967558ad7f1497259a2215d6dcf4b3ab8
SSDEEP 98304:zm5lUvvuzDcPNgqytLbArr3cXkZx3Z3imdH3Cun:a5exNgScXkZxp9dH3D
TLSH
T197369D213DE74436C66323314F59B73833FDAD631B36828B5788FB1D2E742A2662516B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

給与および職位改定ならびに給与明細ダウンロードのご案内.gz.crdownload

Path C:\Users\Admin\Downloads\給与および職位改定ならびに給与明細ダウンロードのご案内.gz.crdownload
Size 2.4MB
SHA256 d800e23ab94066c491c45f7b6ba6aa59125c679f3cb9cd5e4152e92f07fb899b
MD5 862adcf521f620df0c86f89153a49333
SHA1 56cca3c7ca357a3d128607b26eea01cec9a29de6
SHA512 00fa2e6ada36cbfaf21543be32ffc7e1ce06778826d7d94bdb15e5565fc2046681328ebd0bb6a916033097ed86973dd03698221400ec3b6251f5bc2e0e4d0e95
SSDEEP 49152:+aZauBNw0MFVPD+GRwa3eK8CZFIu+m1yRINXmJrBEbif/VfdJhV:DZjXwHrprFBEIN21f/RdJhV
TLSH
T1E1C533057B0DDA84D6977D95C102E9B0D0F5B8AF46C508E32BAC24313E6B8F48AB9DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2020-413-0x000002161AA90000-0x000002161AB2B000-memory.dmp

Download

memory/2248-285-0x000002C66B610000-0x000002C66B6AB000-memory.dmp

Download

memory/2852-426-0x000002233A560000-0x000002233A5FB000-memory.dmp

Download

memory/2888-275-0x000001CBC3CF0000-0x000001CBC3D8B000-memory.dmp

Download

memory/2980-416-0x000002531B1E0000-0x000002531B27B000-memory.dmp

Download

memory/3484-328-0x0000018D0AA00000-0x0000018D0AA9B000-memory.dmp

Download

memory/3920-250-0x0000011CBE930000-0x0000011CBE9CB000-memory.dmp

Download

memory/4120-323-0x000001ECD7DB0000-0x000001ECD7E4B000-memory.dmp

Download

memory/4220-410-0x0000019B762B0000-0x0000019B7634B000-memory.dmp

Download

memory/4460-312-0x000001CDA62B0000-0x000001CDA634B000-memory.dmp

Download

memory/4484-311-0x00000251244B0000-0x000002512454B000-memory.dmp

Download

memory/4672-46-0x000002AEC6C80000-0x000002AEC6D29000-memory.dmp

Download

memory/4728-319-0x00000269654F0000-0x000002696558B000-memory.dmp

Download

memory/4728-320-0x00000269654F0000-0x000002696558B000-memory.dmp

Download

memory/5116-8-0x00007FF8135D0000-0x00007FF8137C5000-memory.dmp

Download

memory/5116-2-0x00007FF7D3650000-0x00007FF7D3660000-memory.dmp

Download

memory/5116-0-0x00007FF7D3650000-0x00007FF7D3660000-memory.dmp

Download

memory/5116-10-0x00007FF8135D0000-0x00007FF8137C5000-memory.dmp

Download

memory/5116-13-0x00007FF8135D0000-0x00007FF8137C5000-memory.dmp

Download

memory/5116-11-0x00007FF8135D0000-0x00007FF8137C5000-memory.dmp

Download

memory/5116-12-0x00007FF8135D0000-0x00007FF8137C5000-memory.dmp

Download

memory/5116-9-0x00007FF8135D0000-0x00007FF8137C5000-memory.dmp

Download

memory/5116-7-0x00007FF8135D0000-0x00007FF8137C5000-memory.dmp

Download

memory/5116-6-0x00007FF8135D0000-0x00007FF8137C5000-memory.dmp

Download

memory/5116-5-0x00007FF7D3650000-0x00007FF7D3660000-memory.dmp

Download

memory/5116-4-0x00007FF7D3650000-0x00007FF7D3660000-memory.dmp

Download

memory/5116-14-0x00007FF7D13C0000-0x00007FF7D13D0000-memory.dmp

Download

memory/5116-15-0x00007FF7D13C0000-0x00007FF7D13D0000-memory.dmp

Download

memory/5116-3-0x00007FF81366D000-0x00007FF81366E000-memory.dmp

Download

memory/5116-26-0x00007FF8135D0000-0x00007FF8137C5000-memory.dmp

Download

memory/5116-1-0x00007FF7D3650000-0x00007FF7D3660000-memory.dmp

Download

memory/5116-27-0x000001B44E170000-0x000001B44E219000-memory.dmp

Download