hxxp://helloworld[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://helloworld.com
Sample260425-m6921af16w

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1212	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "https://web.telegram.org"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	WINWORD.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215887713649714"	chrome.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
2856	WINWORD.EXE
2856	WINWORD.EXE
5392	WINWORD.EXE
5392	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
5252	chrome.exe
5252	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe
Token: SeShutdownPrivilege	1240	chrome.exe
Token: SeCreatePagefilePrivilege	1240	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe
1240	chrome.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
2856	WINWORD.EXE
5392	WINWORD.EXE
5392	WINWORD.EXE
5392	WINWORD.EXE
5392	WINWORD.EXE
5392	WINWORD.EXE
5392	WINWORD.EXE
5392	WINWORD.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 3112	1240	chrome.exe	84
PID 1240 wrote to memory of 5012	1240	chrome.exe	85
PID 1240 wrote to memory of 5012	1240	chrome.exe	85
PID 1240 wrote to memory of 1212	1240	chrome.exe	86
PID 1240 wrote to memory of 2128	1240	chrome.exe	87
PID 1240 wrote to memory of 2128	1240	chrome.exe	87
PID 1240 wrote to memory of 5020	1240	chrome.exe	89
PID 1240 wrote to memory of 5020	1240	chrome.exe	89
PID 1240 wrote to memory of 4352	1240	chrome.exe	90
PID 1240 wrote to memory of 4352	1240	chrome.exe	90
PID 1240 wrote to memory of 5060	1240	chrome.exe	91
PID 1240 wrote to memory of 5060	1240	chrome.exe	91
PID 1240 wrote to memory of 3192	1240	chrome.exe	92
PID 1240 wrote to memory of 3192	1240	chrome.exe	92
PID 1240 wrote to memory of 2624	1240	chrome.exe	97
PID 1240 wrote to memory of 1096	1240	chrome.exe	112
PID 1240 wrote to memory of 4864	1240	chrome.exe	113
PID 1240 wrote to memory of 3524	1240	chrome.exe	114
PID 1240 wrote to memory of 5252	1240	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://helloworld.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb3a75c728,0x7ffb3a75c734,0x7ffb3a75c740
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,11318581458602787832,10472520410011414158,262144 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,2015060026502488918,3501810524304496380,524288 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,7963189197377498329,12156624443496551866,524288 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,15237515317010189655,2636124985276139618,2097152 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,4676682230907789524,16497301422476929923,2097152 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4328,i,4312112338706413700,12951147486755021128,2097152 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4348,i,16246379096872898043,14546864086164288581,2097152 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,1516879238264520187,10961367430213795845,524288 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,11535280380298477465,10750375861491568872,524288 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,17720098897045967823,5507007887257039706,524288 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,12585363065315070227,8373291693364905653,524288 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4980,i,7597535715007583773,5062195585934281568,262144 --field-trial-handle=2008,i,3638287334390129880,15344069006641453127,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1668

C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2856

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\https.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
Size 2KB
SHA256 98814d04cf26bc30ee38ed1fe82e229e994e2a78369e9b7a359df7dd6510102a
MD5 810d9f69e74390cc46127029d994a2b3
SHA1 2531aefa6e11e89ca44a2a87b14ee8e522722c79
SHA512 acf96b63e73100892b0e05cc1c8dc02f9cf8faa1f5eef2a0e6b3843a05acb03c7b71c2179975fe6ae466d6c08b4e7ec785769fa451df74ee941dbdc676c2505a
TLSH
T1D241FB5F6FB989E1FF385E815E89D9952CBCE7136984005E30799218087DF90B71716C
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 96429d52c32852acc75a47a97ab6f77a7214c834ae6a4e74dd41f7033727754d
MD5 57e7614534a36a836da9796a9f17ea59
SHA1 50ce81052a688a12f188ec96c6589f57e7d3d994
SHA512 9ca56d7e56e337a853cc4f2bc1a0853a151a3a75689309fdbb0c23e6a2b028abe9f24379400141458d39eed74f694a02fcaddc715044f2531a0eaee9a02d4d40
TLSH
T1D7F097A294B4D4513E2A54DD29F052297920E8ED11982C4A64FAC4A26929AAED23E23D
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
Size 560B
SHA256 170ff58db641a5c95a819d3d0ebcd96eee6143e447105f51c0a763f665e2a65a
MD5 a1de602514f05c7d98d42dd6568c6ddd
SHA1 fc49f6f065184784252fe3bc848537193263994b
SHA512 94fff2316dd58a045093b9c41a6f8da07a9ed99e48dbab999cca49cb08985c98cdcbeb944e7d2fe19672e810d612dbee27b18bc710abe97596842446f89a55f9
TLSH
T1BEF059186DF9452EE23ADB3D9BF4966FE92BF22314004B2C229007091502E561D6272A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 1cfd1b2247ecc494cd2e6857b9550d687794c2674a38fbd516c8004b6dac4668
MD5 0c29f4157856f508e8b3896e91aa6283
SHA1 7c31ee0b2c142dd67c556e78f6db8354966a90a7
SHA512 b654a273a5026d02c3669cf0e519c18067a33acd98a5e28d6b54886eec4ef123bf6fb8906c5af3743db7c6deda1b9675e959e2c66baa556bf95835141ce49188
TLSH
T1C3E0C62814FA421EF8F8D7398BC9B42485AAF0210421E2B610E02B0FB302A00EC22E34
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a6da039cbabc61504819e02b1cab77151504d10b8310a427072b3af30f681ea9
MD5 eaf456abf419b8a456ea575f57734969
SHA1 e84de22759583b9336de1f5850ae3d728de83570
SHA512 c6b5f029c0e9eb5f3f87d11453408e5a8688fa48ac949639e78c3fb27a1b67fb4efbba103f65dfe8b3b25619c3cc7c5f4aac6640ddddc3e95350cbfaa7168ea8
TLSH
T10AE022AEC826EC3B1CF90B2861045B41E74427572781484F3B3CDA0D8FF06BA4A8A82C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 51aae43e4920cef385b965d16bab66a4a3848681c73ae880e969e9ca55091037
MD5 b7d4261ea1213ba62ec747a0cc9b0abc
SHA1 b8be1fe7010bec3cd1ea2f1d4337bf4409f63b3e
SHA512 98e0b842fb7d242e0f12d0b7eed511fe461f2edca948902d79b94b3e0ea884e2a0fa6b6d9d2d2b3df10a8aaa97ae856e3e0700ce06495cbcc5ae2dfde785f6fe
TLSH
T16CC092D2C588E1A4C7C0A1728C6235EA79100A14F2802613BEE105ACB411AA1A292200
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d4913242-fd41-48dd-83d0-bcb64c35c496.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d4913242-fd41-48dd-83d0-bcb64c35c496.tmp
Size 2KB
SHA256 800b6e7ad7a983a03333420dbbbfc355ecc2a1f8b8315260ce9d12566a82e538
MD5 022bc47bcf649deb00a11902b46e2787
SHA1 98e3506b44e73c0a06790373081c22f90eacf0e3
SHA512 a6c7ddaa41fed76aaa60cbcd40cd0912f02b3d77474fa69a91e2a7a5233326f9e9fff242d802d742f91c4788f374fa382049edd31f02a913df8b61055e087dde
TLSH
T18C519DF793B48A7ECA1192E4EB156E1FCE6D0524135C7C6689E4AE1B53F2872E10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7798ade2a1e942b053fff36f76b1487ceffd5c4b0d5b3381f2030b742f7d36d9
MD5 403e8c2a514b21a65035f4d845200d60
SHA1 de945abdf26731e44e63e824b060cf8e25f433ad
SHA512 3a956d384701fd34eb20cc73eccb16878c6c785a22b2cbe33a48578aa6e53c62534bb020c7aba2a43fec0ab69b0f8d99a6d5403e82f05521b5c6fbaafda157b8
SSDEEP 192:cRSXymn5Gv7rpAPRp2Z698Hsb+WNn8eUyZ2al2afUuYaVyIsnAUge:cRSXfyHUXh6wpr2C2SU2e
TLSH
T1A142E72EB914797B9CDAD229F9257717E7F6102160843EC8EAFC8A3C14D7ACD2217067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 714d5c64e07624cc3531d4f1df349fdf08e2ff5d742f8bf275ce5fb961e9e6b1
MD5 bb9da637306e3234bcbf58286dd603d8
SHA1 560e85ce57fd414e01305261838fca42a25c8e2c
SHA512 d974bf14167e82c7669c5920b0bdfac232fc35d45ef14ebb7d75bb53fd76de510e4597d07a447297381911d71ce30bd93586fdb2f07f53cebc23c22efa1b71b3
SSDEEP 192:cRpXymn5Jv7rpAPRp2Z698Hsb+WNn8eUSpMKl2afUuYaVyIsnAUge:cRpXfJHUXh6wp/My2SU2e
TLSH
T17042E62EA914797B9CDAD229F9257717E7F6102160843EC8EAFC8A3C14E7ACD2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f6ceb4c16e0e2b1e7862b1471509eb7aa79a0c515bb44047a34b0bdfad2bfbb1
MD5 1e391625f692f2d353d0c97b01fa8b83
SHA1 5e1fff02c686487a597053b639fe646c9262fea9
SHA512 f0458ce5a1763af3293da889ab9135bb99a74551705ce0a29160b2a2cc22dd86a2a07d57332b87e35957dea8ad83682a42453eded37b86dd438226eacca264d8
TLSH
T1CBB02222C2032302C00203B02AE0C0C83020FF2BC2032202E2E02E3ACC3223008B0AA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7e95e4a4e0981b23b9809f16512e69dabb949fd39c2cb2d4b4ebd7a668332289
MD5 22a115086593458b2b05732e8588327a
SHA1 648005dcf188a0c03b0a9b3f00bbeedd3cd36ae4
SHA512 f7f427bea49f9693b709cf02ab31b90d9741d4c1cd2f404b362f1fd8dcb8f409fe6e3c945bb28f28a1255f637713007740c744a8af343ab1958677681786b9be
TLSH
T173B012E08401D501C00302F816D314C87614DF21C7051B1163E47D7598261905014151
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 147754b633199f02c5f18ff1c6e2748ef5882e7a6561105193315ed272c90dd1
MD5 136f919a6d827441ecbc6bed3cb998a1
SHA1 d42c79a8fb00124efbac45724395a41edb0f675a
SHA512 f0c1d3b3a8fd49eab9766d5307d14849fadee8eda32ad2f893fd532cb41f741978620cc51d55d732b51491d50f56bfbcf0201535645a18c464764a353943dd97
SSDEEP 1536:9l1cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEL:Z3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1729312BA5E2A4AE755BE56D1765E380ACE12130D719FB8CC7268538D21D41C82F73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 18194e8a6d345817405a082ae52868ac2640d868879e8697fd54107e03470dd9
MD5 42a0a414d768ff7a7eefec642835b6ea
SHA1 b7253f8fee522c8a73a6c3b71ea24095cd872081
SHA512 e99fa645566545f616aee44badf5d25b1ab0bb4f2a26d728390e74ef1b027202658782f66d183c50caed76f140daf08f33e2b12ac1d279282788d33619656e02
SSDEEP 1536:9mTccYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:IY3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1D49302BA4D2A19F795BE5691729E3809CE12130E716FB8CC7168578D21D41C82F73E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 206a5d7b936dbbceea952ecdd9e84cc6e050de1f40aabe9d00307d20afa35145
MD5 3f153726370d05c9aab3e84d0add1a31
SHA1 36e070d07674e27438ce26d56ece611b09246984
SHA512 7ba5e48a91e5f015daebd7b2cbb8d93f6873b333029958bdb93d4157f4ed6b6ef7a70b464005fb23198f0a022fef28aa2e3be09b8486bfafcea21ed338256224
SSDEEP 1536:gHcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:G3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T15A9302BA4E2A46E7957E469176AE7809CE12134D70AFA8CC316C539D21D01C92F73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 dbf7247ef8ca693fd5e4de77e13f2f97ebaf64c8145bd8f0c0414cf9275086b0
MD5 0f957094c393518a5083a6f5e49748cb
SHA1 509733511a712e44232407c0b1d8919ccbb6c2b5
SHA512 91b8fa7ef823a61b6ec630c3827183bb7f44820355c06a831d3ca49b108fd6598178bc43734800afdf1bd74dc3067fd90ecf769d834a8d2b1365471368e6e748
SSDEEP 1536:Ml1cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEL:w3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T14B9312BA5E2A4AE755BE56D1726E380ACE12130D719FB8CC7268138D21D41C82F73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B502A191-182E-4C96-97AC-94922F1088F3

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\B502A191-182E-4C96-97AC-94922F1088F3
Size 187KB
SHA256 6a4f82749c95a13862946a4ed3031c5723efcfa7af3c23286d75137ed5931b23
MD5 5796b15acbfee023afb3c347590486d0
SHA1 a15081fa1c6e65513bfda2c3d73b0dd305f309f5
SHA512 87166f2606fa65ce590f40e91526097b1da3127f1310f009f87d6e1e0570f6169c5d0a4c06fc662505287e7feac4206fb7c95c0bd4e57e01cf57084f992905a6
SSDEEP 1536:hrVe3b3yFK13SllbQ4sghEz1e7HW6Dkjj/mtXcAZl1p5ihs7VXXbEKD0aO7na3Y1:Fue7HW6Dkjj/8Xo57ai
TLSH
T1E01402A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
Size 325KB
SHA256 49533a266989d32732021688bea757c750da29a6c93a1839b5602ca1643a1892
MD5 46299825342ddaaefc1236b3051d76b6
SHA1 6333d34cf2a1890489a3d8dad0947cc291cad020
SHA512 0cda9de41db530b82593b97b8267ca682dd0dc671248c55dca253ecc484ea9c5ba8c68b68c0566dcbf3ffa10fb4bafda35c7a80933e0f38bb9027f327dbf623a
SSDEEP 3072:VO4D0tEtLU8KPe1u6uSivsUQK75IthgXV:VO4D0tEtAg1u6uSivsUQK75IthiV
TLSH
T1DB64DD87F012A5536B8E263D53B085FB0DF4815BA6C79C42705027FDE863CEA0D96BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 12KB
SHA256 b3c4071f52b960003c7af9df3ef65741b329fef6867d4e75bef23ebb695bfe26
MD5 394153cc89152f2afbd96e563acfdbbb
SHA1 7a27acd6803c4cec51f31c498817798152501d49
SHA512 5b72d215f526f838fe60cfca42f11b7fd37a9b96a05e386dc17376ad577c7904666c95d4aba768ad2910a55ba3a9164e081f83a32028637f0d68adaa3e2bda99
SSDEEP 192:JjA69q4zDxZqXj4i9UmzIOZHIzmjQa9U2zSGZbc/jPVpV9yKs46ZLz4xOPZQY:E4Jm6zt28bDyKs46ZLMxC
TLSH
T11D421F6387ADC9FB95357F2763C237924209345A36DB34095B2C034932CB6088BFAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db
Size 24KB
SHA256 b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
MD5 8665de22b67e46648a5a147c1ed296ca
SHA1 b289a96fee9fa77dd8e045ae8fd161debd376f48
SHA512 bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da
SSDEEP 12:TCmqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TDqt8VtbDBtDi4kZERDEe
TLSH
T183B24CC26A786161E05A51B7C9B313661779D1A90433936329F254A19CC288A98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 fb0dd499f844646221020b726484f3afa101268cd845b276e423cd3303ecc9f2
MD5 dfa595ba3a96039d6f4d8142d5da476b
SHA1 3b9e6db577ee5781945900c097854fd204d6baa2
SHA512 4f60bb8ed47c07fea425d1f759cce40b3fd8545e7f194269d443814e101d45e3966b328b92fb05e0ca086ab613763ec38faa946b5a18b7758a9b16745cec1f3a
TLSH
T1C2416E5CB6FA1148B3B77F1A9BF6A86D487ABC372E06D15D00110E4F4A22B40DCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres
Size 4KB
SHA256 14c49354acdff6757de8415e2c5bdbe0ed3f4b5d7fc45a1294cee42c5688ad6b
MD5 c807572a4377fea6e222c9d5002c8e24
SHA1 465d8e3be59ac47c6b3a6cea2494749de29db566
SHA512 4b78e0b23563de908e7ea859e10ed1fe77b0e4a3b7b7034da29ab64b0ed538f8a5cd96497b356170cfc242be9b7cfcd46142e839d83fbbb9de9bcbc9ed85dbe7
SSDEEP 48:uiTrlKxAxtxD9Il8u5HI0ezQdoBeJgWXbxcvgSqo0+TB9gVbjABDViF7QioHgVuA:XYA0ez8gWLFeHXmwViF8DqD4kCzBYGG
TLSH
T14B91A06C7AFA5008B273EE665BF5746E887FB9732F07849D10510E4F0623A01EDA173A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD75E.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

https.docx.LNK

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\https.docx.LNK
Size 1KB
SHA256 5780775bf660f76ba46577778beb94cc40b6b05be241d2c4c13e608afa7b5d7b
MD5 e2037af2b4bbbbd0739a1ec7a0275710
SHA1 d9edbf6790ec75ad395b21917ff83c780aafc3ab
SHA512 59af4bdaf17d6ed6250d2106da47a6b4883065e6f155cfe02550edc6f306784d843c30c825bac31ee77d5c67895dea5626eaf5501a00b85a2a2f1f1f41a8b2b1
TLSH
T19F110C04966F1F22C3E9C472EE97373ACF34AC06FF655F06459096880D48B08AC60EBD
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 246B
SHA256 42b9a3d11cc3dc5319803da52f2d50fbf5b121283790be69a16199e2a3195db3
MD5 9b5ff58be6222689636b490455a7718f
SHA1 6da55671f40b10b6af3d72dfbeeefcf309b49865
SHA512 0e0c1c0ca289f0cd1be0f8aa7f483869390cf757b7073960b5a5972adb44c81acbf4086a8463c2fc3f95cc66c7b43372ce2d3bd93cfdebaa9efe015d90f55441
TLSH
T17ED01737A310E3F1337C005139BCACC8BBF20C2AC36E115808ED0C618E7114308A7888
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 a0a3eb799ab551bee15f487ddce77b2df723238248e05544970386c6e3c8205a
MD5 94cce6358f3cd97c4cc8e05d764a34ea
SHA1 a5af2f04d532b403f987d7b3f800d81a2198f02d
SHA512 7c0c69336dee6f66e89a5d53e65e60fef84e20c6f3d1184563051a0a205f605e8a93087cebc8a66c4f2207216b2ba68e0d279087f2f71d95d63fbc7de7745e8c
TLSH
T122410202469F9F5BE0C243724625972DCF703C57FA39A10E57C8A62E6D70E006F4AEA8
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 5221aa10dcf5ab22af14c9d31fab738e8ac236ac89fc33cf7c4f53ea18016dfa
MD5 34f7f209e6e918247b0326a48eeb81be
SHA1 6cf8628f896d88f0159178c40f59ec6ec26a868a
SHA512 9c3719fd0efbd2ceae4610412ce04bedcf3c174c987a093f3fa846e834a41ff0d047519cdbd141ffa34d29358769d662f33fd9848a654027437f2534e975eedb
TLSH
T1E821D303865F6F5BE08643328665871DCF307C5AEA39610D5788963EADA1E005F49F95
MD5 SHA1 SHA512 TLSH

Submit Download

~WRD0000.tmp

Path C:\Users\Admin\Documents\~WRD0000.tmp
Size 11KB
SHA256 f72689812839e2b2f6b77d9798837859291ffebe38a2abfa289350adc727b1a6
MD5 b78a8586bf18478c1f447e167e7345ea
SHA1 5a6155be6a18d1527f1f3d1180c0ab7042039356
SHA512 9b6a1d970a261502b6ec9de7174cbf7524e42fc9fe051a478b483002f2f271b97c493d81a97f70b4b989d658d566202de05135fc1d2b1bbc0e9eb97caad2ab98
SSDEEP 192:CtacVH7O5wSZ5NxtpgoZ22NN2Mkl5ag2JAzjqNu4DhLyY1Uv9eBE6WysocoQ:aRp7O5wwNxt/ZtNNMSYQub9ePs0Q
TLSH
T1C8427D3DF5266451D1329A39E02D93F6F66480457B20EAB6320CF78E8798B871B173D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2856-223-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-191-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-222-0x00007FFB49FED000-0x00007FFB49FEE000-memory.dmp

Download

memory/2856-193-0x00007FFB09C20000-0x00007FFB09C30000-memory.dmp

Download

memory/2856-743-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/2856-746-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/2856-745-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/2856-744-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/2856-747-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-180-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/2856-179-0x00007FFB49FED000-0x00007FFB49FEE000-memory.dmp

Download

memory/2856-181-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/2856-178-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/2856-182-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/2856-192-0x00007FFB09C20000-0x00007FFB09C30000-memory.dmp

Download

memory/2856-224-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-190-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-185-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-184-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/2856-186-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-187-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-189-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-188-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/2856-183-0x00007FFB49F50000-0x00007FFB4A145000-memory.dmp

Download

memory/5392-755-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/5392-754-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/5392-752-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/5392-753-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download

memory/5392-751-0x00007FFB09FD0000-0x00007FFB09FE0000-memory.dmp

Download