Analysis
- user interaction
yes - max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 22:21
Behavioral task
behavioral1
Sample
metrofax.doc
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
metrofax.doc
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target metrofax.doc
- Size 221KB
- Sample260508-191jmae15s
- SHA256 b13b29772c29ccb412d6ab360ff38525836fcf0f65be637a7945a83a446dfd5e
- MD5 28e855032f83adbd2d8499af6d2d0e22
- SHA1 6b590325e2e465d9762fa5d1877846667268558a
- SHA512 e401cbd41e044ff7d557f57960d50fb821244eaa97ce1218191d58e0935f6c069e6a0ff4788ed91ead279f36ba4eddfaa08dc3de01082c41dc9c2fc3c4b0ae34
- SSDEEP 3072:zVIfFuR6AqFMa2fL3NtkWL90y7K4mlQCww7zDTW6HNRn0nPmaw:zVIf8RsOtZclptz78Pk
- TLSH T1CB24AE23F6E1CC72C81342300952CAE56BB9FDB11B524247B78D3B6EAD356B0672A356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\{DD158B43-0B48-4EAF-B294-C048E090CD21}\8tr.exe:Zone.Identifier WINWORD.EXE - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\{DD158B43-0B48-4EAF-B294-C048E090CD21}\8tr.exe:Zone.Identifier WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 4480 WINWORD.EXE 4480 WINWORD.EXE 5764 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5960 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5960 taskmgr.exe Token: SeSystemProfilePrivilege 5960 taskmgr.exe Token: SeCreateGlobalPrivilege 5960 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe 5960 taskmgr.exe - Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 5764 WINWORD.EXE 5764 WINWORD.EXE 5764 WINWORD.EXE 5764 WINWORD.EXE 5764 WINWORD.EXE 5764 WINWORD.EXE 5764 WINWORD.EXE 5764 WINWORD.EXE 5764 WINWORD.EXE 5764 WINWORD.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4480 wrote to memory of 5824 4480 WINWORD.EXE 87
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\metrofax.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:5824
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5764
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5960
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3636
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
- Size 2KB
- SHA256 7b9786a20388fd1f9d31ec1323cb9f4be6e54fba945e0ded97fcf760cb28e936
- MD5 e8a8e8c27a42cb9cd31f3c50062a4c3d
- SHA1 8e05cd26e6788871744e69fdb5a00a11a1b698d4
- SHA512 9da43153f05975b40ac69b903392404c5fde15f2b1b9266a81749bf240093f50052582eeca65264f5ff3c1a3670ec2f8f686cb293c1cfe078027fa4a3f8249f5
- TLSH T19F41294B97F88CA0FE745491DA829A792CECEB439C2804593C2811158CADFE4BB0146D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
- Size 471B
- SHA256 0a70c15464c4553a6369001e63e6946c0ce35cbbe1fede420f4c36855171271b
- MD5 96592b148dc7e854984b8f08633283cf
- SHA1 cc132d1890e22f1cfbabb9329327f24623ccef57
- SHA512 85aebf869dbb330176dd5c85fc21378761684f0d9afba2837fa7463275626e97a0bcd7f23a3efc6ed5168da621eef8455dc43a9523b98f5dfc65a9c738b59ed7
- TLSH T19EF00E53409CE804AEA36CDC10B0DAF33425A46400D16089709DA9E10C6BDA6B63F039
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
- Size 560B
- SHA256 dac415790e287aead4dba42a95baf93b8417dbf082c805e2660a35c16df58561
- MD5 7f194472b5a01eafa7f444fd9483589a
- SHA1 154ea32aeb5941f543a5ba0bd97803001a8186b6
- SHA512 ab204ae4d7c498775d8af9ea903d66e658a237da121ab12a06a5d3b55eaa0e49fd2ca11f9a1913419417e10358b2064f88d750bfd4a643a1a1fb7a4ed5e42179
- TLSH T1FFF02E642DFE523DD2719ABDEBE494EF6929F56338055F3D125006082603E920D6373A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
- Size 412B
- SHA256 8adf544d27a53293786338f9b652b4756a29495e4d1090aa89250922051e3fba
- MD5 e5a57c4fb1f236dcbf85ad66529fc964
- SHA1 b822a687863e682fabea4a0aae4cbf0ea0806937
- SHA512 f0d1c2f14068b6010d014a757cec49390c6e8affb0e5b10dbad5f88467fec14f95244a6ae81400de128b4bcad907f69c69b6ea90beeee3cdf264dd451d63d184
- TLSH T1D2E0C02425FA422EF1F6E23806D5B971C157F0110460A3B255D43B057202A00EC52D35
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\3C205805-A076-4F12-9A40-3DABC3A5E618
- Size 187KB
- SHA256 7b845509a1b2d0ff545c240dd3b0b3bc786ff1b730ef3c21204aca1eaca40ad1
- MD5 345c6953c1059b3ae39f3b19fff7db6d
- SHA1 d6b8f5351517ac76d971675d314853139dace911
- SHA512 93b9237b76233720ef12815e4e83e6641ee1a08763848cb80312383e4db87111f841bfa65fd071603a565054dbc2cc744378611ce8be70dc7b609874943ff9fe
- SSDEEP 1536:BrVe3b3yFK13SllbQxsghEQqe7HW6Dkjj/mtXcAZl1p5ihs7VXXbEKD0aO7namY1:2we7HW6Dkjj/8Xo57Ni
- TLSH T1001402A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
- Size 7KB
- SHA256 0d643149ea5c2c885bde5eb817f33c77f5e37a6e8d78d45b50713bd67f6e15c9
- MD5 6d165c2aec181c1780ca702947e76fb8
- SHA1 7fad81eace5e85a93d18fcf2be0680f396ab2968
- SHA512 f5493f8a1bb850e0858aca272aa7690576a1ff461ac51b43aa9ed9a0c665fb2e09830ec0dd5b5850ff8cfd09cab5bbca6988f478c4255163effc64ac4e69046d
- SSDEEP 192:FjBb9yxzagZxoRjGo9C8zxZZqRj4i9Wmz0:Uxk48LmY
- TLSH T132F100A291AEC8EB94347F0367DB37914495355E2ADB700D5B1C024E318AB189FFEB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal
- Size 8KB
- SHA256 8dde4f588055477ec467db037b37b6214f9ce58e5f89dc78b57991f0691e267d
- MD5 744570c17c7a4c04c60b52e1ba53b0b2
- SHA1 3d69a2ca6e8aedd499697982292fe549b5fe30a6
- SHA512 013edbca6f839f982f1daa9eae36b64e8bfa5e29a3a5f03dedbdc0c1bebbb0c5fcd23a1986c4b400f311003398941055c84d150dc073f3f3b5e1956bf2d7cb37
- SSDEEP 24:KQbDqt8VtbDBtDi4kZERDpUTqt8VtbDBtDi4kZERDf:jDO8VFDYMWTO8VFDYML
- TLSH T18102E4C1A5787121F05A51F7C8B313A7177D92A9043392632EB265929CC18CED4255FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
- Size 2KB
- SHA256 234d790067e72445728626654994b3a9394156a6ab8827fd98010e3f098f86f5
- MD5 6ba5fed70db7443a676d43c6738d7396
- SHA1 62bc15580ef03d888b6464e2e523f5c678573cea
- SHA512 263721d639e0e332b13c46945a22680dd1ca3162b61e51c5a8ca5c83b151ccc87717c2b385870acfadebe07bd0110c670fc4ad6bd5008d86b20f02879f7693ec
- TLSH T176412A9DA6FE1158B3B76E5A9BF7A96D483B7C372E06D45D00120D4F0A23B4088A1B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
- Size 2KB
- SHA256 b3a5678b6ef8c461552326764819bd5d45031a92315e373a5fde5e2e359a4fef
- MD5 22d8ca5eab418cea71aca270e9ef39ab
- SHA1 927fa5f901a61df53419cbc87d374f22480540b2
- SHA512 ccc3bf8bcac52493c96f5554c799952810c19803538384d57e439fd407afa120a6f9ee11253247f4e78355dd8847b5fa45dfcc0dbd498bf464eb4d0f0decdfae
- TLSH T1EB514C686AEA1118B377AF595FF6B96E487FBE732E06D45D00110D4E0623A40CCE1B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1F8837DD.emf
- Size 5KB
- SHA256 3e430584cd9774ea3b21d8e19b485b48212fe356776158dd5f3c5f63a5bde7d3
- MD5 0ed5bc16545d23c325d756013579a697
- SHA1 dcdde3196414a743177131d7d906cb67315d88e7
- SHA512 c93072d11058fa50e3b09ff4da9f3dbe2637c2b5df05e616bd8ddd04557ea1e8b0db106b1545fad334619118c467776f81cf97ca52d3f2fcbbe007f30032b8af
- SSDEEP 48:ZzCbf08888888888888888888883FSjciCwt2:kY888888888888888888888sy
- TLSH T10FB1C80532B0CA29C4559634DD9BCFF95E92BC03CE21826773A5FF8F39B23946603611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD479E.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vbhja.rtf
- Size 816KB
- SHA256 200bcc9144c1587e9bbca952f6035e37bd4bc4f9715fa354de6339d4bf7c142a
- MD5 17fea2e5665f2d4e8460c48cb1823e90
- SHA1 9e43298d7fda64a084ea4129857c5eaa9b954ddb
- SHA512 0d1ec36ed01af37032d2e2ba3e8a3d609921bda52f53ff8bd73304d33f2bdfbc633204dc5a739d1eccc169f2eb4d184c51289c282755452e7013bfb4a4ff922c
- SSDEEP 6144:ucUnvHbZOtIrgZGzXHtsg7uBDIjrbYgxjD/cznPsRNK1:nUnTZO+8ZGTHGWuBDiIgZwPsRNi
- TLSH T1D0059768914B1498F2D7A519254FBB48253AFB534EC34E8333ADD9B11F96AF3EDC2804
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512