hxxp://ps-land[.]com/#sales@cs

General

Target

http://ps-land.com/#sales@cs

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706c7de3b1d7d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343478644"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09288599-43A5-11EC-B8A2-E6DE94465761} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3730866043"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3730866043"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb00000000020000000000106600000001000020000000aa35e93ea18d08f6c2624e1b32d1dfdbebc6f0ddf32d8031b1f7d5a89ea0992f000000000e8000000002000020000000cc341c7ac9639f12261ff41739ed753e67ab3c5a9347621b52ba32577ed705e12000000046f6ef1e66bd135757e2ef14c1e01e0182cea0d98034add26f25d52df82a5b96400000006eacac7d670dc5d93c397a65c9dd6f3fe6e011c1b371d8970e8bfeae17ef509c2514f9f3722743b1e29897d240e92dc6e3e4c99384269e184c8eaef9e76bf5c4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3774617465"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb00000000020000000000106600000001000020000000057e219c5d7a2a0e6037b3e43e07c731f01021e5fc2e74b9857b7480204898d0000000000e8000000002000020000000d1464b1af34488c999acbab8109dc8eb85a83d264e97c6701a693edce1305ca320000000e2927a501b66c3ee62ffc5d78e3f414e7ef94ee589590f2aa43fd7f919c7297c40000000e12a74ef33d2a64f8bfd0fce65ef3436b462a68e633aa92e01f14bf36d9bc73bf7661dfc7bbe55f8e85a93766375540ef029bd09e290607d865ab3fbeaa516b0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30922673"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30922673"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30922673"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c341e3b1d7d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "343527230"	iexplore.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings firefox.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 3708 firefox.exe
Token: SeDebugPrivilege 3708 firefox.exe
Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

iexplore.exefirefox.exe

pid process

2488 iexplore.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

firefox.exe

pid process

3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe
3708 firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings	firefox.exe

description	pid	process
Token: SeDebugPrivilege	3708	firefox.exe
Token: SeDebugPrivilege	3708	firefox.exe

pid	process
3708	firefox.exe
3708	firefox.exe
3708	firefox.exe
3708	firefox.exe
3708	firefox.exe
3708	firefox.exe
3708	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exe

pid	process
2488	iexplore.exe
2488	iexplore.exe
1020	IEXPLORE.EXE
1020	IEXPLORE.EXE
1020	IEXPLORE.EXE
1020	IEXPLORE.EXE
3708	firefox.exe
3708	firefox.exe
3708	firefox.exe
3708	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2488 wrote to memory of 1020	2488	iexplore.exe	IEXPLORE.EXE
PID 2488 wrote to memory of 1020	2488	iexplore.exe	IEXPLORE.EXE
PID 2488 wrote to memory of 1020	2488	iexplore.exe	IEXPLORE.EXE
PID 1416 wrote to memory of 3708	1416	firefox.exe	firefox.exe
PID 1416 wrote to memory of 3708	1416	firefox.exe	firefox.exe
PID 1416 wrote to memory of 3708	1416	firefox.exe	firefox.exe
PID 1416 wrote to memory of 3708	1416	firefox.exe	firefox.exe
PID 1416 wrote to memory of 3708	1416	firefox.exe	firefox.exe
PID 1416 wrote to memory of 3708	1416	firefox.exe	firefox.exe
PID 1416 wrote to memory of 3708	1416	firefox.exe	firefox.exe
PID 1416 wrote to memory of 3708	1416	firefox.exe	firefox.exe
PID 1416 wrote to memory of 3708	1416	firefox.exe	firefox.exe
PID 3708 wrote to memory of 2336	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 2336	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 1108	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 3128	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 3128	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 3128	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 3128	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 3128	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 3128	3708	firefox.exe	firefox.exe
PID 3708 wrote to memory of 3128	3708	firefox.exe	firefox.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://ps-land.com/#sales@cs
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3708.0.1639488334\296686981" -parentBuildID 20200403170909 -prefsHandle 1508 -prefMapHandle 848 -prefsLen 1 -prefMapSize 219631 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3708 "\\.\pipe\gecko-crash-server-pipe.3708" 1616 gpu
3⤵
PID:2336

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3708.3.1899774558\2008086151" -childID 1 -isForBrowser -prefsHandle 2272 -prefMapHandle 2268 -prefsLen 122 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3708 "\\.\pipe\gecko-crash-server-pipe.3708" 2280 tab
3⤵
PID:1108

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3708.13.1693255135\1818089260" -childID 2 -isForBrowser -prefsHandle 3404 -prefMapHandle 3400 -prefsLen 6979 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3708 "\\.\pipe\gecko-crash-server-pipe.3708" 3388 tab
3⤵
PID:3128

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3708.20.2142809780\724010520" -childID 3 -isForBrowser -prefsHandle 4164 -prefMapHandle 4160 -prefsLen 7750 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3708 "\\.\pipe\gecko-crash-server-pipe.3708" 4228 tab
3⤵
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
d633bf57f34a752065c6fdd8dbdc3c5a

SHA1
bfb545f43eaa28e69eef2c32c660cdf00455c996

SHA256
a2ea371aa04230abe844fec44d8aadd66682f66dadd5b96a96a5072c2f4446c4

SHA512
93306b566a3215a66d441d280f8131269618894b393c552f3695616891b1e34d5b67a4d09167779fa4df41811a3e84b8ccf17d25f1b666c4ecea55f7a8a9a1ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
1b1edcd28dde800df2ab875c51e20d12

SHA1
c556fbc6a0b473e71a45f13dafcbfb54d998c131

SHA256
e7a809aa38b62e43ec35f1b4b8c0bff6ce80f006d870281a5517b5a2ddf954a1

SHA512
9b3aa76abef0f6936a6ee5bf62f4eb71c28baa44e29e616c3327727dc411bf718848912f69e97ea1036385afa91f4f5805f372b311a36a3aab90fae6e5dcc106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\YOG43OUX.cookie
MD5
f98f4077b62ed47ea6b1d942123a0aa0

SHA1
c12c7e9431fdd0c632a9350ff98ba3904aa33d04

SHA256
4d555fad79308df2cb83e54f8b05b134ecc11066c610e4ad7019f8536b4eaf56

SHA512
dfc84e1827ee0a31e3003f321096ab1d567079d3b649ad6c9390416c72f4a2be437298a4e76a0b28e0699f3c16156e4784dec4e5227230124ce4c33545b1d483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ZF2LXK7Q.cookie
MD5
971629a523ca1d8bfd5ec287356a64c6

SHA1
1e5c134152b2f052d1fb14f13fb74ed6d745dcb4

SHA256
2a7783df8b49c38125c024295afd89b3d72708ecfe5a13b5460afa1da9e6f7f1

SHA512
cea2fd40d9d12196edc971274a20f1162799499695ff2b85a626939ca148db2c89ac944382fa2d3a162a8bf9e15649ddbecc46076512b9290307f74c3e54d832

Download Submit
memory/1020-141-0x0000000000000000-mapping.dmp

Download
memory/2488-143-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-150-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-124-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-125-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-126-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-128-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-129-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-130-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-132-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-133-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-134-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-136-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-137-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-138-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-139-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-122-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-142-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-116-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-145-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-146-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-148-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-123-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-151-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-152-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-156-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-157-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-158-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-164-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-165-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-166-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-167-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-168-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-169-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-170-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-174-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-175-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-178-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-121-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-120-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-118-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download
memory/2488-117-0x00007FF849BF0000-0x00007FF849C5B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads