Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

COVID19open_closedPodsVACCINE_LETTER2B.docx

Microsoft Word 2007+

initial sample

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

PNG image data, 16 x 16, 4-bit colormap, non-interlaced

dropped

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0B411F14-70B5-11EB-ADCF-ECF4BBB5915B}.dat

Microsoft Word Document

dropped

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0B411F16-70B5-11EB-ADCF-ECF4BBB5915B}.dat

Microsoft Word Document

dropped

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{21E37B5F-70B5-11EB-ADCF-ECF4BBB5915B}.dat

Microsoft Word Document

dropped

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\lr5drzg\imagestore.dat

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\NewErrorPageTemplate[1]

UTF-8 Unicode (with BOM) text, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\arrow_blue0[1].gif

GIF image data, version 89a, 11 x 11

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\arrow_ltblue[1].gif

GIF image data, version 89a, 11 x 11

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\button-glencliff[1].gif

GIF image data, version 89a, 149 x 121

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\button-nhh[1].gif

GIF image data, version 89a, 162 x 127

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\favicon[1].ico

MS Windows icon resource - 2 icons, 16x16, 32x32

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\granite-advantage[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x95, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\httpErrorPagesScripts[1]

UTF-8 Unicode (with BOM) text, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\iconseal[1].gif

GIF image data, version 89a, 25 x 25

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\index[1].htm

HTML document, ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\jshowoff[1].css

ASCII text, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\largeA[1].gif

GIF image data, version 89a, 16 x 13

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\search-icon[1].gif

GIF image data, version 89a, 18 x 18

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\seniors[1].htm

HTML document, ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\the-doorway[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x112, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\translateelement[1].css

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\women[1].htm

HTML document, ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\400x25officialsite[1].gif

GIF image data, version 89a, 400 x 25

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\4MUVPDOK.htm

HTML document, ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\arrow_green0[1].gif

GIF image data, version 89a, 11 x 11

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\bullet02[1].gif

GIF image data, version 89a, 10 x 10

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\button-sysc[1].gif

GIF image data, version 89a, 149 x 121

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\calendar-graphic[1].png

PNG image data, 170 x 126, 8-bit/color RGBA, non-interlaced

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\carbon-monoxide[1].jpg

[TIFF image data, little-endian, direntries=12, height=292, bps=158, PhotometricIntepretation=RGB, orientation=upper-left, width=600], baseline, precision 8, 515x251, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\covid-alert[1].png

PNG image data, 730 x 50, 8-bit/color RGBA, non-interlaced

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\disabilities[1].htm

HTML document, ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\dnserror[1]

HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\errorPageStrings[1]

UTF-8 Unicode (with BOM) text, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\families[1].htm

HTML document, ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\icon-sp[1].gif

GIF image data, version 89a, 19 x 29

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\icon_flash[1].gif

GIF image data, version 89a, 16 x 16

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\jquery.jshowoff.min[1].js

ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\office[1].jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 300x150, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\print[1].css

ASCII text, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\teens[1].htm

HTML document, ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\textsizer[1].js

ASCII text, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\1000x100-jpg-header06[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 1000x100, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\adults[1].htm

HTML document, ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\blkbk[1].gif

GIF image data, version 89a, 10 x 1500

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\contribute[1].css

ASCII text, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ds[1].gif

GIF image data, version 89a, 1 x 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\emergency[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 515x250, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\flags[1].gif

GIF image data, version 89a, 133 x 27

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\flu-fighters[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 515x250, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\heart-month[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 515x250, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\icon-fb-like[1].gif

GIF image data, version 89a, 42 x 20

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\icon-twitter-bird[1].gif

GIF image data, version 89a, 21 x 20

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\icon_pdf[1].gif

GIF image data, version 89a, 16 x 16

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\index[1].htm

HTML document, ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\main[1].js

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\mediumA[1].gif

GIF image data, version 89a, 16 x 13

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\smallA[1].gif

GIF image data, version 89a, 16 x 13

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\urlblockindex[1].bin

data

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\1095b[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 515x250, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\arrow_gold0[1].gif

GIF image data, version 89a, 11 x 11

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\base[1].css

ASCII text, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\coronavirus[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 525x295, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\december-hours[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 515x250, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\element_main[1].js

HTML document, ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\favicon[1].ico

PNG image data, 16 x 16, 4-bit colormap, non-interlaced

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\fostercare[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 515x250, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\gcd-seal[1].jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 180x64, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\icon-html5[1].gif

GIF image data, version 89a, 14 x 16

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\jquery-1.2.6.min[1].js

ASCII text, with very long lines, with CRLF line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mcm-logo[1].jpg

JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 150x79, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mental-health[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 515x250, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\nh-carepath-logo[1].jpg

JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 150x120, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\nheasy-sm[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x57, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\school-safety[1].png

PNG image data, 150 x 49, 8-bit/color RGBA, non-interlaced

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\trans[1].gif

GIF image data, version 89a, 1 x 1

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vape[1].jpg

[TIFF image data, little-endian, direntries=0], baseline, precision 8, 515x250, frames 3

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EDE79FE8.png

PNG image data, 293 x 295, 1-bit colormap, non-interlaced

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A7F4CFE5-FD14-491B-BD17-FD822CEDA35F}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AD3EC36A-00F7-42F0-AE81-4807857507A1}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B4CD7B63-97C0-4A14-814E-1968BCE52029}.tmp

data

dropped

C:\Users\user\AppData\Local\Temp\~DF18054AB76B5B25D5.TMP

data

dropped

C:\Users\user\AppData\Local\Temp\~DF2979F9B86784BA93.TMP

data

dropped

C:\Users\user\AppData\Local\Temp\~DF901D34AC6B03FD18.TMP

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\COVID19open_closedPodsVACCINE_LETTER2B.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:16 2020, mtime=Wed Aug 26 14:08:16 2020, atime=Tue Feb 16 23:13:35 2021, length=22673, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Little-endian UTF-16 Unicode text, with no line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\W8HCR2ZX.txt

ASCII text

downloaded

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GBLNFL6087EMVG9NCJ7Z.temp

data

dropped

C:\Users\user\Desktop\~$VID19open_closedPodsVACCINE_LETTER2B.docx

data

dropped

There are 81 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	540
Target ID:	0
Parent PID:	584
Name:	WINWORD.EXE
Class:	word
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Size:	1424032
MD5:	95C38D04597050285A18F66039EDB456
Time:	16:13:35
Date:	16/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13f8a0000
Modulesize:	1437696
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary,	Process Injection

C:\Program Files\Internet Explorer\iexplore.exe

'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2420
Target ID:	2
Parent PID:	584
Name:	iexplore.exe
Class:	iexplore
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Size:	814288
MD5:	4EB098135821348270F27157F7A84E65
Time:	16:14:05
Date:	16/02/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x13f850000
Modulesize:	819200
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary,	Process Injection

C:\Program Files (x86)\Internet Explorer\iexplore.exe

'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2420 CREDAT:275457 /prefetch:2

Details

Is windows:	true
Is dropped:	false
PID:	2344
Target ID:	3
Parent PID:	2420
Name:	iexplore.exe
Class:	iexplore
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2420 CREDAT:275457 /prefetch:2
Size:	815304
MD5:	8A590F790A98F3D77399BE457E01386A
Time:	16:14:05
Date:	16/02/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x280000
Modulesize:	819200
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary,	Process Injection

URLs

Name

Malicious

https://www.dhhs.nh.gov/

http://www.broofa.com

unknown

https://search.nh.gov/dhhs-search.htm

unknown

https://www.dhhs.nh.gov/foryou/families.htmx

unknown

https://www.nh.gov/covv/R

unknown

http://www.ssa.gov/

unknown

https://www.dhhs.nh.gov/foryou/teens.htm

https://www.dhhs.nh.gov/foryou/adults.htmmt

unknown

https://www.dhhs.nh.gov/about/index.htm

https://www.nh.gov/covid198This

unknown

http://www.servicelink.nh.gov/

unknown

http://www.recovery.gov

unknown

https://www.nh.gov/covid19

https://schoolsafetyresources.nh.gov/

unknown

https://www.dhhs.nh.gov/foryou/seniors.htmv

unknown

https://www.dhhs.nh.gov/foryou/families.htm

https://www.dhhs.nh.gov/foryou/women.htm

https://www.dhhs.nh.gov/#translateilities.htm

unknown

https://www.dhhs.nh.gov/foryou/seniors.htm

unknown

https://www.dhhs.nh.gov/index.htmilities.htm

unknown

https://www.nh.gov/cov

unknown

https://www.nh.gov/covid19/resources-guidance/vaccination-planning.htm

unknown

https://www.nh.gov/disclaimer.html

unknown

https://www.dhhs.nh.go

unknown

https://www.dhhs.nh.gov/foryou/disabilities.htm

https://www.dhhs.nh.gov/foryou/teens.htmm

unknown

https://www.dhhs.nh.gov/ps://www.dhhs.nh.gov/favicon.ico

unknown

https://www.dhhs.nh.gov/#translate

unknown

https://www.stablenh.com/

unknown

http://www.dynamicdrive.com)

unknown

https://www.dhhs.nh.gov/#translateilities.htmt

unknown

https://www.dhhs.nh.gov/favicon.ico~

unknown

https://www.nh.gov/covid19://www.dhhs.nh.gov/favicon.ico

unknown

https://www.servicelink.nh.gov/locator/index.htm

unknown

https://www.dhhs.nh.gov/

unknown

http://coveringnewhampshire.org/

unknown

https://www.dhhs.nh.gov/about/index.htm

unknown

https://www.dhhs.nh.gov/foryou/adults.htmm

unknown

http://txkang.com

unknown

https://www.nh.gov/covid19

unknown

https://www.dhhs.nh.gov/foryou/women.htmm

unknown

http://ekallevig.com/jshowoff

unknown

https://www.dhhs.nh.gov/foryou/adults.htm

unknown

https://www.servicelink.nh.gov

unknown

https://www.servicelink.nh.gov/

unknown

https://www.nh.gov/covid19/index.htm

unknown

https://www.dhhs.nh.gov/#translate

https://www.dhhs.nh.gov/R

unknown

https://www.dhhs.nh.gov/#skip

unknown

https://www.nh.gov/covid19R

unknown

https://www.dhhs.nh.gov/index.htm

https://www.nhcarepath.dhhs.nh.gov/

unknown

https://www.dhhs.nh.gov/favicon.ico

unknown

https://www.dhhs.nh.gov/foryou/women.htmmr

unknown

http://thedoorway.nh.gov/

unknown

https://business.nh.gov/Sign_Up/cal.asp?w=grid&y=7

unknown

https://www.dhhs.nh.gov/foryou/women.htm

unknown

https://www.dhhs.nh.gov/about/index.htmies.htmp

unknown

https://www.dhhs.nh.gov/#skipj

unknown

https://www.dhhs.nh.gov/foryou/adults.htm

https://www.dhhs.nh.gov/jNew

unknown

https://prd.blogs.nh.gov/dos/hsem/?page_id=11170

unknown

https://www.nh.gov

unknown

https://nheasy.nh.gov/dcyf/#/

unknown

https://www.dhhs.nh.gov/foryou/teens.htmmr

unknown

https://www.dhhs.nh.gov/index.htmjNew

unknown

https://www.dhhs.nh.gov/foryou/families.htm

unknown

https://www.nh.gov/wai/index.html

unknown

https://www.cms.gov/

unknown

http://www.dhhs.nh.gov/

199.192.8.2

https://www.dhhs.nh.gov/foryou/disabilities.htm

unknown

https://www.dhhs.nh.gov/foryou/disabilitiesRoot

unknown

https://www.dhhs.nh.gov/foryou/teens.htm

unknown

https://www.dhhs.nh.gov/#skip

https://www.dhhs.nh.gov/#skip/www.dhhs.nh.gov/favicon.ico

unknown

https://www.dhhs.nh.gov/Root

unknown

https://www.dhhs.nh.gov/index.htm

unknown

https://www.dhhs.nh.gov/foryou/seniors.htm

https://twitter.com/NHDHHSPIO

unknown

There are 69 hidden URLs, click here to show them.

Domains

Name

Malicious

www.dhhs.state.nh.us

199.192.8.2

Details

Name:	www.dhhs.state.nh.us
IP:	199.192.8.2
TargetID:	3
Current Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking,

www.dhhs.nh.gov

unknown

Details

Name:	www.dhhs.nh.gov
TargetID:	3
Current Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking,	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking,	Application Layer Protocol Non-Application Layer Protocol
Urls found in memory or binary data	Networking,

IPs

Domain

Country

Active

Malicious

192.168.2.22

unknown

199.192.8.2

unknown

United States

unknown

Details

IP:	199.192.8.2
TargetID:	3
Current Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Country:	United States
Countrycode:	USA
ASN number:	19713
ASN name:	STATE-OF-NH-USAUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking,

192.168.2.255

unknown

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

w*7

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

`+7

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

7-7

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ReviewToken

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ECABE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

VBAFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Arial Unicode MS

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Batang

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@BatangChe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@DFKai-SB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Dotum

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@DotumChe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@FangSong

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Gulim

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@GulimChe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Gungsuh

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@GungsuhChe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@KaiTi

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Malgun Gothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Meiryo

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Meiryo UI

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Microsoft JhengHei

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@Microsoft YaHei

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@MingLiU

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@MingLiU_HKSCS

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@MingLiU_HKSCS-ExtB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@MingLiU-ExtB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@MS Gothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@MS Mincho

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@MS PGothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@MS PMincho

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@MS UI Gothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@NSimSun

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@PMingLiU

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@PMingLiU-ExtB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@SimHei

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@SimSun

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@SimSun-ExtB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Agency FB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Aharoni

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Algerian

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Andalus

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Angsana New

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

AngsanaUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Aparajita

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Arabic Typesetting

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Arial

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Arial Black

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Arial Narrow

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Arial Rounded MT Bold

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Arial Unicode MS

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Baskerville Old Face

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Batang

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

BatangChe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bauhaus 93

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bell MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Berlin Sans FB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Berlin Sans FB Demi

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bernard MT Condensed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Blackadder ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bodoni MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bodoni MT Black

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bodoni MT Condensed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bodoni MT Poster Compressed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Book Antiqua

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bookman Old Style

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bookshelf Symbol 7

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Bradley Hand ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Britannic Bold

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Broadway

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Browallia New

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

BrowalliaUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Brush Script MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Calibri

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Calibri Light

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Californian FB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Calisto MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Cambria

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Cambria Math

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Candara

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Castellar

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Centaur

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Century

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Century Gothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Century Schoolbook

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Chiller

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Colonna MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Comic Sans MS

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Consolas

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Constantia

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Cooper Black

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Copperplate Gothic Bold

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Copperplate Gothic Light

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Corbel

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Cordia New

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

CordiaUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Courier New

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Curlz MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

DaunPenh

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

David

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

DFKai-SB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

DilleniaUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

DokChampa

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Dotum

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

DotumChe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Ebrima

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Edwardian Script ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Elephant

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Engravers MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Eras Bold ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Eras Demi ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Eras Light ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Eras Medium ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Estrangelo Edessa

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

EucrosiaUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Euphemia

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

FangSong

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Felix Titling

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Footlight MT Light

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Forte

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Franklin Gothic Book

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Franklin Gothic Demi

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Franklin Gothic Demi Cond

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Franklin Gothic Heavy

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Franklin Gothic Medium

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Franklin Gothic Medium Cond

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

FrankRuehl

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

FreesiaUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Freestyle Script

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

French Script MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gabriola

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Garamond

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gautami

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Georgia

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gigi

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gill Sans MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gill Sans MT Condensed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gill Sans MT Ext Condensed Bold

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gill Sans Ultra Bold

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gill Sans Ultra Bold Condensed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gisha

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gloucester MT Extra Condensed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Goudy Old Style

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Goudy Stout

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gulim

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

GulimChe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Gungsuh

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

GungsuhChe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Haettenschweiler

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Harlow Solid Italic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Harrington

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

High Tower Text

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Impact

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Imprint MT Shadow

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Informal Roman

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

IrisUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Iskoola Pota

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

JasmineUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Jokerman

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Juice ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

KaiTi

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Kalinga

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Kartika

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Khmer UI

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

KodchiangUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Kokila

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Kristen ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Kunstler Script

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Lao UI

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Latha

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Leelawadee

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Levenim MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

LilyUPC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Lucida Bright

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Lucida Calligraphy

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Lucida Console

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Lucida Fax

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Lucida Handwriting

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Lucida Sans

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Lucida Sans Typewriter

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Lucida Sans Unicode

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Magneto

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Maiandra GD

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Malgun Gothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Mangal

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Marlett

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Matura MT Script Capitals

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Meiryo

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Meiryo UI

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Microsoft Himalaya

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Microsoft JhengHei

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Microsoft New Tai Lue

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Microsoft PhagsPa

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Microsoft Sans Serif

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Microsoft Tai Le

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Microsoft Uighur

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Microsoft YaHei

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Microsoft Yi Baiti

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MingLiU

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MingLiU_HKSCS

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MingLiU_HKSCS-ExtB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MingLiU-ExtB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Miriam

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Miriam Fixed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Mistral

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Modern No. 20

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Mongolian Baiti

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Monotype Corsiva

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MoolBoran

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MS Gothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MS Mincho

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MS Outlook

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MS PGothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MS PMincho

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MS Reference Sans Serif

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MS Reference Specialty

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MS UI Gothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MT Extra

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MV Boli

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Narkisim

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Niagara Engraved

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Niagara Solid

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

NSimSun

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Nyala

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

OCR A Extended

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Old English Text MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Onyx

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Palace Script MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Palatino Linotype

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Papyrus

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Parchment

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Perpetua

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Perpetua Titling MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Plantagenet Cherokee

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Playbill

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

PMingLiU

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

PMingLiU-ExtB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Poor Richard

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Pristina

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Raavi

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Rage Italic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Ravie

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Rockwell

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Rockwell Condensed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Rockwell Extra Bold

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Rod

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Sakkal Majalla

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Script MT Bold

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Segoe Print

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Segoe Script

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Segoe UI

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Segoe UI Light

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Segoe UI Semibold

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Segoe UI Symbol

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Shonar Bangla

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Showcard Gothic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Shruti

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SimHei

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Simplified Arabic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Simplified Arabic Fixed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SimSun

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SimSun-ExtB

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Snap ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Stencil

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Sylfaen

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Symbol

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Tahoma

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Tempus Sans ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Times New Roman

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Traditional Arabic

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Trebuchet MS

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Tunga

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Tw Cen MT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Tw Cen MT Condensed

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Tw Cen MT Condensed Extra Bold

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Utsaah

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Vani

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Verdana

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Vijaya

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Viner Hand ITC

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Vivaldi

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Vladimir Script

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Vrinda

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Webdings

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Wide Latin

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Wingdings

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Wingdings 2

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Wingdings 3

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Segoe UI

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

F40E7

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

WORDFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

F40E7

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Settings

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ZoomApp

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MTTF

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MTTA

C:\Program Files\Internet Explorer\iexplore.exe

{0B411F14-70B5-11EB-ADCF-ECF4BBB5915B}

C:\Program Files\Internet Explorer\iexplore.exe

ChangeNotice

C:\Program Files\Internet Explorer\iexplore.exe

@%SystemRoot%\system32\qagentrt.dll,-10

C:\Program Files\Internet Explorer\iexplore.exe

@%SystemRoot%\System32\fveui.dll,-843

C:\Program Files\Internet Explorer\iexplore.exe

@%SystemRoot%\System32\fveui.dll,-844

C:\Program Files\Internet Explorer\iexplore.exe

@%SystemRoot%\System32\wuaueng.dll,-400

C:\Program Files\Internet Explorer\iexplore.exe

NextUpdateDate

C:\Program Files\Internet Explorer\iexplore.exe

MFV

C:\Program Files\Internet Explorer\iexplore.exe

NextCheckForUpdateLowDateTime

C:\Program Files\Internet Explorer\iexplore.exe

NextCheckForUpdateHighDateTime

C:\Program Files\Internet Explorer\iexplore.exe

SavedLegacySettings

C:\Program Files\Internet Explorer\iexplore.exe

Count

C:\Program Files\Internet Explorer\iexplore.exe

Time

C:\Program Files\Internet Explorer\iexplore.exe

LoadTimeArray

C:\Program Files\Internet Explorer\iexplore.exe

88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977

C:\Program Files\Internet Explorer\iexplore.exe

2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81

C:\Program Files\Internet Explorer\iexplore.exe

Count

C:\Program Files\Internet Explorer\iexplore.exe

Time

C:\Program Files\Internet Explorer\iexplore.exe

LoadTimeArray

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

NextCheckForUpdateLowDateTime

C:\Program Files\Internet Explorer\iexplore.exe

NextCheckForUpdateHighDateTime

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

DecayDateQueue

C:\Program Files\Internet Explorer\iexplore.exe

LastProcessed

C:\Program Files\Internet Explorer\iexplore.exe

NavTimeArray

C:\Program Files (x86)\Internet Explorer\iexplore.exe

@C:\Windows\System32\ieframe.dll,-912

C:\Program Files (x86)\Internet Explorer\iexplore.exe

@C:\Windows\System32\ieframe.dll,-904

C:\Program Files (x86)\Internet Explorer\iexplore.exe

SavedLegacySettings

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Blob

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Blob

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Blob

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Blob

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Blob

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Blob

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Blob

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Blob

There are 366 hidden registries, click here to show them.

DOM / HTML

URL

Malicious

https://www.dhhs.nh.gov/index.htm

https://www.dhhs.nh.gov/foryou/disabilities.htm

https://www.dhhs.nh.gov/foryou/adults.htm

https://www.dhhs.nh.gov/foryou/families.htm

https://www.dhhs.nh.gov/

https://www.dhhs.nh.gov/about/index.htm

https://www.dhhs.nh.gov/foryou/seniors.htm

https://www.dhhs.nh.gov/foryou/women.htm

https://www.dhhs.nh.gov/#skip

https://www.dhhs.nh.gov/foryou/teens.htm

https://www.dhhs.nh.gov/#translate

https://www.nh.gov/covid19

There are 2 hidden doms, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry

DOM / HTML