hxxps://ballsdox[.]com/

Resubmissions

02/08/2026, 10:38

260802-mphw7a1brd1

02/08/2026, 10:35

260802-mmmgla1blh3

02/08/2026, 10:29

260802-mjd12sgp8y3

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
143s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ballsdox.com/
Sample260802-mmmgla1blh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2888	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301405346783605"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	POWERPNT.EXE
Key created	\Registry\User\S-1-5-21-125073035-2952146151-721812867-1000_Classes\NotificationData	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac040000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1612	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
5636	chrome.exe
5636	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1612	POWERPNT.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe
Token: SeShutdownPrivilege	4608	chrome.exe
Token: SeCreatePagefilePrivilege	4608	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe
4608	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1612	POWERPNT.EXE
1612	POWERPNT.EXE
1612	POWERPNT.EXE
1612	POWERPNT.EXE
1612	POWERPNT.EXE
1612	POWERPNT.EXE
1612	POWERPNT.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 572	4608	chrome.exe	80
PID 4608 wrote to memory of 2888	4608	chrome.exe	81
PID 4608 wrote to memory of 2916	4608	chrome.exe	82
PID 4608 wrote to memory of 2916	4608	chrome.exe	82
PID 4608 wrote to memory of 1252	4608	chrome.exe	84
PID 4608 wrote to memory of 1252	4608	chrome.exe	84
PID 4608 wrote to memory of 1956	4608	chrome.exe	85
PID 4608 wrote to memory of 1956	4608	chrome.exe	85
PID 4608 wrote to memory of 1416	4608	chrome.exe	86
PID 4608 wrote to memory of 1416	4608	chrome.exe	86
PID 4608 wrote to memory of 2516	4608	chrome.exe	87
PID 4608 wrote to memory of 2516	4608	chrome.exe	87
PID 4608 wrote to memory of 3832	4608	chrome.exe	89
PID 4608 wrote to memory of 5016	4608	chrome.exe	91
PID 4608 wrote to memory of 4956	4608	chrome.exe	92
PID 4608 wrote to memory of 2272	4608	chrome.exe	93
PID 4608 wrote to memory of 5636	4608	chrome.exe	97

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ballsdox.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0d6dc728,0x7ffd0d6dc734,0x7ffd0d6dc740
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,7522720258114989996,14490085531601391031,524288 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,989379076324697565,4953537481324351443,262144 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,11739784592988332460,8278615828812711498,524288 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3008,i,15560938853614940661,17100006321385138037,2097152 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3004,i,15152356742456728354,3613739373187677052,2097152 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,2245965358955209047,8114976989568442537,2097152 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3888 /prefetch:9
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,17476574238419599701,9376216632989934421,524288 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,16390881126866200075,6434888831160607365,524288 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,8667505497664980256,11770509572529806916,524288 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,1846068428648894790,8233707049205145974,524288 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5740,i,6710776328995067351,12452760709159269838,262144 --field-trial-handle=2028,i,7333502582420689181,11272042713947721333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3464

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 326e462778e2aff0e6c7bb95188a40af9da686505e5126b5bd9588e6799b706b
MD5 01dd50c5867d5faec96abf1d7019b152
SHA1 97ae62a71d40ae753002a0ba81601d83e5ed940c
SHA512 80f383cae473dbd3e00419f45282872cd38cbc643eeea5fa94d313b286aa5e3d1bc84a6139011aea9916ce347eec4c02c03ff504efd2044582cf128afc04ec77
TLSH
T133E02BA9C816EC3718F90B9C20504706F79013676A428A1F3B3C51198F75B370185C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 ac0a144ae738176f40291c2fb22a76514afc6be3718bc0d4eb9ae0c5736cb03d
MD5 f32b7be0d0521c7156ac37dbd39dd0f5
SHA1 a2ca96b14a1c963b13c1f1445eda64a44d659f1a
SHA512 38a8a59c9ecffc3a761ae6c2b14fc0d56138c8021970a31d479c0153b5f630497431bbf908cad7e9875ad0eca8bf519cea5b5bf0dc8ee5645d28f265bc56e0d3
TLSH
T192B0123037C1D393CF40C17701E11C83321007352139170353800084C03FED5C4000F1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 16eb0e3c9ea28c538885c005d84b22f0dad63ab7793b0fccc9bad8c87b43ce1a
MD5 5b14cd58ea89323c48b03197ed408540
SHA1 a493a90290ccbb342dbdf60a9dbb064d3217828b
SHA512 f75d73fcf195a8b981a2f595c2b438c827d00da17ca8ccff853646de3cc7a29c698cb648fbbcb812addfbca13642dc6399ac5f385a1baa6f975e56e889117ccf
TLSH
T1284148B7C7D8897D890196F8A7156E1FCE690E14532C3D5788D8AF0B63E2875D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9943fd112e08a6b3c842f2c61d2df538edc9e59a92d671979cd2bd29e11f8646
MD5 347fb67d2696e5f8731fd632af787d80
SHA1 d3b25ab861fff0b2b326881bf5df7f1670f8fd80
SHA512 27e2dacb06aa977ef77c11b6133012f6303e101e857495aff5a79ea29f39f4dbff471669079c29813c5fbad156c3834618fdf34d71c29e553a8b8fa8fbb97789
TLSH
T150816CF787E4952ECD6156F4A6162E2FCE690924532C3C6BC8E49F1B93E2571E200B4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 71a9eb080d7fff148b7fc589d8e34f69d437c5a0238b3c3d47afffa113c9f95e
MD5 7ab16ccc972599e302f7e1ec250e2f05
SHA1 4197c6ffa38ca6752ec884bcbf1aaac95b0fe091
SHA512 4758eb98581bc8627af1f457893e741508059b043b2b57c3a8835f51f9e4faa194c3ad2d097d63c2c19b3b6dcae3bf4408f1f5880c686e4f83aa619245161242
SSDEEP 384:4R8ndv2bVF7xy1Cyo8ZUX6rwgg24GVtwaZe:hndv2bVF7xy1CyosRrwuTk
TLSH
T14F42D52EA910693B4DDFD32AF9653B53E7F9102121941E88E7FC896C15D7ACC3227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 73600b4bd2f1bc68e5a3cf5d8a5e76c95c3449cc3d550eb69f730b9c2effa15a
MD5 f67a6dbdf8ac32ec2ec908283119abbe
SHA1 3ab0f5254e3f2de2feb2c34071f3feb7f6933dae
SHA512 2f9955df381419567b12967528aa5ea08d0e2fdb915246f9be8a05350a9b079470e736029256fcc69d24a8f857d76bef4bbaa8ec1c8f882f64064d297fa45ef4
SSDEEP 384:4R8ndv2bVF7xy1CyowZF1XzrwgcehGVtwacE:hndv2bVF7xy1CyoAjrwKaD
TLSH
T18352D62EA910693B5DCFD22AF9653B53E7F9102125841E84E7FCC96C15E7ACC3227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 014d02e92ff2d103a33e0e721da902dfa73a11a46bf3c6002b0aa9233470f55d
MD5 15fcf2bc70611b6ff764305c9064fc7d
SHA1 ac248ca98bcf719ead733d7c4659aa3856fb25de
SHA512 46aada5d255ebf9c83a234b2f2edd115883d542dd5651070dbb1dbe0f8d3b1913ce02be6afeec9a0cc797ac3972ab097e5501d9b291516ddbfea857fa248813b
SSDEEP 384:4R8ndv2bVF7xy1CyonZF1XzrwgcebGVtwaZe:hndv2bVF7xy1CyoZjrwKgk
TLSH
T10842D62EA910683B4DCFD32AF9653B53E7F9102125942E88E7FC896C15D7ACC3227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f1abff548c5e40050f5da3f33240bd5a273536dccabc5188f6328cf3801cba9e
MD5 6d699943f3a53ce8447e63e503a12919
SHA1 a899b13638d288aa4331a17dabd8a744817657a2
SHA512 ab1bcea4cf2ceb7b6ccf2de01b0206498d5bfb12f25ae692f60f01e30c9494928576a2f396bbbcb9d5607532efd7e4e8d2318ec363f98b32c8d28a0f149b6e2f
SSDEEP 384:4R8ndv2bVF7xy1CyoxZFUXmrwgAYaGVtwaYE:hndv2bVF7xy1Cyo3nrwYJP
TLSH
T16052E72EA910693B4DCFD62AF9267B53E7F9102121941E88E7FC892C15D7ACC3227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ca89f5b5898cb927412d49787f608cbdee5b2385d0c34186ab2f19317b2682a0
MD5 fc4982fdc3cd9a930df0770f25c73eef
SHA1 049197566b22bdd110ba47fa93a623440dae609b
SHA512 98a719010de78b745aac3d10803b22c0a2d3250c2c97b5862725f098c4ae48c96dc81f99f6c326ec647863e7a12a12db973569c369deb7bc99fc1510d9f02ede
SSDEEP 384:4R8n0v2bVF7xy1CyoxZFUXmrwgagYGVtwaYE:hn0v2bVF7xy1Cyo3nrwizP
TLSH
T10752E62EA910683B8DDFD62AF9253B53E7F5102125941E88E7FC892C15E3ACC3227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 90ca602312df83e8da8904a732514d0d49a6379bce1b458b4864f726845543be
MD5 9c69f84f061e3a4ea7a4af14b45cf664
SHA1 61faf4bedc18fcf822ce6c93382d3b401057231c
SHA512 7c2b5cc2c004bf1f52da9077e72db3fafc2caf62173b81b7700ccd66ab17378b5d7f997c24f2e02ca584148c4ae5a7166c75a23b4306604b138dbd8f5d95a158
SSDEEP 384:4R8ndv2bVF7xy1CyojAZF1X8rwgAYsGVtwacE:hndv2bVF7xy1CyoUsrwYPD
TLSH
T16352D62EA910693B5DCFD22AF9663B53E7F9102125C41E88E7FC892C15D7ACC3227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 125eaae4e8f6744ffa4d4ee52d8f12e78c7ccee1c5a5a30476db0f9ef66757d2
MD5 b2703120dba5c08fbf4cee3fd27fda09
SHA1 ed334e08dc75e40a23f615201b72e9fe5a5252c6
SHA512 19a2d6ce692715f4d8147be269ffc83eb54c29850ed229a78c77e408ee4a1d11dd7eb01177f54706beef65bbe253f903de5e7ed1700da0e369327b10c8200ae8
TLSH
T1F2B012809042D202C02202F4114314D872149F15A60E170283E0AE268C251A0C015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a5b1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a5b1.TMP
Size 96B
SHA256 5eafdfecc14656e1b0424c2f47bb2cc9087db2c551f6de0f9edafbb44f7a7602
MD5 0d80379cd1b2de4e0be42ea6a0cc1a66
SHA1 40faa7ccb17f4c27dc70606df5134be8dcf7ef7a
SHA512 a73640fa7c62312c6e39d9829ba85de2c8b43b9cdc6149838a62048a3e6c58fdf2b960e5b7a5eacec743b5f88ad0cd1190bc257846b8a69627b1c68dd4eb4d4d
TLSH
T1C0B02280C0032222C0020FB03C8880C8B0A2CF22C203020383E00E32CC2032280308B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 46f3ca1d84fd5d5411af6207c3183ca8f5f64948dbbfae6c87e7f0a927f8e4a3
MD5 7580aaca5a4f3c5d7754432e80e57622
SHA1 a8c46eb9def1382917f3056ab89e8fa85f891e86
SHA512 4c33db2fcf8b8881545dce52b8ad14a2959fb7d9daef1c0acb6e48431307fe84def462776c7095201a5ea01b6c070650ad4e0c0b30fc425f3262fede7a9d3fd2
SSDEEP 3072:h5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:h4m7Rkm1tYpBeh2BAoi
TLSH
T180C312375D75E83659BABB1EB04E0B1F1EF149B2C920DE52C8D85A0437EA7CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ad156ca07336f12c97ae2c62aaf62f6da78a725c20126f0db708c7e7d593c425
MD5 75b807a903244988e218ea567c841c33
SHA1 73238c87f7d668ca9761e01616a57eb0821745f9
SHA512 f40fc573ed8198ebd951f89675ec572de00e5cc5327625f40837561ec5f50f8bd32abcdf1768d6b69f749f5897054835118e0b36bcbf2c8070d8c57ea2ae33ce
SSDEEP 3072:YGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:Tm7Rkm1tYpBeh2BAoi
TLSH
T171C312375E70E9375D79AB0EB48E0B1F2EF149A6C820DE92C8D85A0477E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 175KB
SHA256 576c4db720a3b385d55fe6888fc4c8978b9e5a30f026c2481058c5e18bc1eaf6
MD5 e1908be24548552f9637cbd83d899632
SHA1 1c0fd7f25e77df10dee6e459c9148a5f6f75237c
SHA512 b6b8089de4fa00101d4c8d0ddc8d8dbb94c3a9734ec83c658be7baa0aa7ce4ba682dc99345a482b279be7e0555d135b72edcbe970d8b002e2521161bb7dbaecf
SSDEEP 3072:ql8n9aTTUlhlBIVa63qfkr/WN4rGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:AO9aTYJ6Va6zr/lym7Rkm1tYpBeh2BAz
TLSH
T1210412378E28AD7D4EBFB719A10B1F0F2AB219918920DC45CDE43E48B7F66D90D05A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b66ac19c404629a31f224f019318dab468dcdace11dc3048a3497f7973f9ee90
MD5 aa35a6474b65fe8d70af1dc14392d899
SHA1 938e3805a980ef3b174df4c0c8c8ae0e123d8ad5
SHA512 821835f7d08deeeb14cc2e5948ece2947ead2e3764417176f9400d08810f230d3100a0f079030bb67c8fb9f66ce4fb2be2ec01d1f9704658e30f2deddccada2b
SSDEEP 3072:a5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:a4m7Rkm1tYpBeh2BAoi
TLSH
T158C312379D75E83659BABB1EB04E0B1F1EF149B2C920DE52C8D85A0427EA7CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B1926971-5922-4A64-B1B4-693697830824

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\B1926971-5922-4A64-B1B4-693697830824
Size 1KB
SHA256 2fb3e7ca57b5ec8657ff2b909c74dee246e7ed2b30abd60dec96fc4fb88bd165
MD5 85ad173999ed440af6120f3b4fd436fa
SHA1 eebe3bae40b0c82db581b905e2a4c4a90055c9b3
SHA512 3c506252a27bc4a3d718fc2ad89036850ee3c9d5fd79966fc5e28debe1844d96e8d2777e160e8537034129fd8109dff027bf5eb4a082c99d0db93730ec31427e
TLSH
T112312CD33FE517F792E95B713F4119C1AAB371D6011FC606098F75455234321740543B
MD5 SHA1 SHA512 TLSH

Submit Download

DDF3270E-C3FE-42B1-806D-15924C8E0426

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\DDF3270E-C3FE-42B1-806D-15924C8E0426
Size 397B
SHA256 57d6315a8f1f11aaa111a9956ddd0d560f791f757c379ed77bbb5a1b5b577f52
MD5 2f82426450332b558a61ae9ca551abd9
SHA1 abdbf8f8bdd7572bcdefbd1e0b7da8d3cf17144d
SHA512 dbc43dab6cbde98647c5a88cd508a1528ef79c030286cf82cb4cb03c4af81930ad1c3b2644ead9eceea27cd5772324f42a51f04f1693102254567205a6abf0b5
TLSH
T143E0F1E4304F2538D3E9A6D3054268100033C3985108D7E91E440065A57AF41C4E4D1D
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 233B
SHA256 cebafe0489fd141bab1e027c40c69e93ee7d418f6fb3dc84cb1cdb90256656f0
MD5 3f86473cc9d7e175c8d4ab8c3fe84223
SHA1 859c42dd8558da6230bb51695b578380ba3b6e4e
SHA512 f6116cc14e8c3f8ac6e0c5b4ab102abe394fe8dd74ff8b0b0eebac121f28f0950bc288c43fcf0927ce31cbc64c6803524a5bed0324054814ca5fd450f3429a05
TLSH
T15BD09E679354FBF69BBC41A574368CE8E9F8449CDE5E112035C88C851C580339197D48
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

hello.pptx

Path C:\Users\Admin\Documents\hello.pptx
Size 31KB
SHA256 cb1f786597ff19fca0cc186b5cd95c651641838dd8d9490f8259d6cf712b4e57
MD5 6532496609a1ce9f48ab0f70d9303a49
SHA1 ec3a36f9dc7eb18369c2e6570525a277028f1cf8
SHA512 b5c557d8e3087fa7b999a45d9a1b9746b1a3c12a1d690a8e784fc82237db23e58f9ca37e58432cd317cb65b5cc496c9c1a204689604b82fb111ba10007bc1ae6
SSDEEP 768:nWrJfQt3u9K5o/ClLSyIFVYC/naOXJowrdnAUdIMS0bS02S0dS04S03S0yS0JS0t:ndt3VuDjnCOZowZAULQ/q5uv
TLSH
T1EAE25C06C0112E5BD173E73DFD398CD15AE99D43A016B9CFA5E9350A0728EA71B4E3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1612-367-0x00007FFCDE330000-0x00007FFCDE340000-memory.dmp

Download

memory/1612-375-0x00007FFCDB9E0000-0x00007FFCDB9F0000-memory.dmp

Download

memory/1612-369-0x00007FFCDE330000-0x00007FFCDE340000-memory.dmp

Download

memory/1612-372-0x00007FFCDE330000-0x00007FFCDE340000-memory.dmp

Download

memory/1612-376-0x00007FFCDB9E0000-0x00007FFCDB9F0000-memory.dmp

Download

memory/1612-374-0x00007FFD1E2A0000-0x00007FFD1E4A9000-memory.dmp

Download

memory/1612-373-0x00007FFD1E2A0000-0x00007FFD1E4A9000-memory.dmp

Download

memory/1612-421-0x00007FFD1E2A0000-0x00007FFD1E4A9000-memory.dmp

Download

memory/1612-370-0x00007FFD1E2A0000-0x00007FFD1E4A9000-memory.dmp

Download

memory/1612-371-0x00007FFD1E2A0000-0x00007FFD1E4A9000-memory.dmp

Download

memory/1612-366-0x00007FFCDE330000-0x00007FFCDE340000-memory.dmp

Download

memory/1612-368-0x00007FFD1E344000-0x00007FFD1E345000-memory.dmp

Download

memory/1612-365-0x00007FFCDE330000-0x00007FFCDE340000-memory.dmp

Download

memory/1612-867-0x00007FFCDE330000-0x00007FFCDE340000-memory.dmp

Download

memory/1612-870-0x00007FFCDE330000-0x00007FFCDE340000-memory.dmp

Download

memory/1612-869-0x00007FFCDE330000-0x00007FFCDE340000-memory.dmp

Download

memory/1612-868-0x00007FFCDE330000-0x00007FFCDE340000-memory.dmp

Download

memory/1612-871-0x00007FFD1E2A0000-0x00007FFD1E4A9000-memory.dmp

Download