1a5d44cf8fb61f5db36d2e7d4b27f7ddb4a4896993b1b27a065ee2ec0aafdfba

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SetWindowsHook.exe
Size

418KB
MD5

09a00f3eb6d7f5c01d158eb17e904be8
SHA1

fd4d59c010049f4bcd501c5edb64342d13c0a674
SHA256

1a5d44cf8fb61f5db36d2e7d4b27f7ddb4a4896993b1b27a065ee2ec0aafdfba
SHA512

a9e3ee4cbf73b5c8c8b0821c920d6c4c59b924069ac072e3840189a4b36a17adf808a8486b7d8caad0daf8e17a1803d6e034b9774f4f64084cfd10749b165a76
SSDEEP

12288:mpSi+MuPVQyz21vhljSXrZnuvserfR1yCk8V0:mMi+M25z21vDv3L/yCk8a

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Office loads VBA resources, possible macro or embedded object present

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1496	vlc.exe
3712	WINWORD.EXE
4080	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1496	vlc.exe
2588	shvlzm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	firefox.exe
Token: SeDebugPrivilege	2424	firefox.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
2424	firefox.exe
2424	firefox.exe
2424	firefox.exe
2424	firefox.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
1496	vlc.exe
2424	firefox.exe
2424	firefox.exe
2424	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1496	vlc.exe
3712	WINWORD.EXE
3712	WINWORD.EXE
4080	EXCEL.EXE
4080	EXCEL.EXE
4080	EXCEL.EXE
4080	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2516 wrote to memory of 2424	2516	firefox.exe	34
PID 2424 wrote to memory of 3000	2424	firefox.exe	35
PID 2424 wrote to memory of 3000	2424	firefox.exe	35
PID 2424 wrote to memory of 3000	2424	firefox.exe	35
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 1588	2424	firefox.exe	36
PID 2424 wrote to memory of 2380	2424	firefox.exe	37
PID 2424 wrote to memory of 2380	2424	firefox.exe	37
PID 2424 wrote to memory of 2380	2424	firefox.exe	37
PID 2424 wrote to memory of 2380	2424	firefox.exe	37
PID 2424 wrote to memory of 2380	2424	firefox.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SetWindowsHook.exe
"C:\Users\Admin\AppData\Local\Temp\SetWindowsHook.exe"
1⤵
PID:2548

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CompleteEdit.au"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.0.1202735144\469525601" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1172 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4046e71-9285-46cc-a4c2-b7f3f8dede03} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 1304 42d3958 gpu
    3⤵
    PID:3000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.1.1804457406\371224240" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {379d9226-b539-4f76-b413-fd29cfb37a93} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 1508 d72b58 socket
    3⤵
    - Checks processor information in registry
    PID:1588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.2.1430985713\654420346" -childID 1 -isForBrowser -prefsHandle 2240 -prefMapHandle 2236 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 912 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdaf9579-f73b-41bc-af04-7b60bdc9b822} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 2252 1ae99558 tab
    3⤵
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.3.1087687265\1627055315" -childID 2 -isForBrowser -prefsHandle 2508 -prefMapHandle 2504 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 912 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb001186-1d76-45d9-9e67-5503b87136f2} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 2480 d68d58 tab
    3⤵
    PID:340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.4.1544825797\995632767" -childID 3 -isForBrowser -prefsHandle 2860 -prefMapHandle 2864 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 912 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {127d155a-77c5-43e3-aeba-e7360be66042} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 2876 1cf38e58 tab
    3⤵
    PID:396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.5.283864226\990826080" -childID 4 -isForBrowser -prefsHandle 3868 -prefMapHandle 3008 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 912 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {144a24b9-433a-4b82-8a50-b232e79d13f0} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 3880 1dbc9c58 tab
    3⤵
    PID:2900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.6.791972756\1196008665" -childID 5 -isForBrowser -prefsHandle 3992 -prefMapHandle 3996 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 912 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8790f3f8-5223-4ce0-82b4-2d598cd66800} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 3864 1dbf2e58 tab
    3⤵
    PID:1696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.7.2079507931\1148592381" -childID 6 -isForBrowser -prefsHandle 3908 -prefMapHandle 4152 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 912 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae5fdafd-8c54-4abf-a270-a838bf5e17e5} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 4252 1ed95a58 tab
    3⤵
    PID:1096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.8.1473660559\1000001111" -childID 7 -isForBrowser -prefsHandle 4436 -prefMapHandle 4428 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 912 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fe5e588-f96d-4232-8b63-be6373f58d1d} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 4464 2244de58 tab
    3⤵
    PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.9.1858372973\1137217325" -childID 8 -isForBrowser -prefsHandle 4648 -prefMapHandle 4588 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 912 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64b8cc4e-e63c-4108-aa9b-03c963752014} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 4636 2244e158 tab
    3⤵
    PID:1724

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3596

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ClearMove.docx"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3712

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde /n
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4080

C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
0fe5d25b76e9406c34be4d4f47200f4b

SHA1
bfe846c698955421fa3ab5e7d30e1a587e1d14a0

SHA256
929fa30d1a27caefaa40e01661518ba8e0429fb81adc7367993fe6efbcadb0c3

SHA512
9af3437559ad6bd15288fa66f282f4f06b7ad04ff32bfbf43b1f7c9e22f0c3d3d31db5b238f74fe98d270f61abc4551fdc4986f5247fcdf91d23bafda7f6615c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\55D71BE0C23DB7040DE3A36A66AA0CEA2EAE9A44

Filesize
218KB

MD5
e7c83b4c9e0a6d15cedc08c781becec4

SHA1
39d59727f4605cf5f5352d1644badcad617fe277

SHA256
8efaa34435d088e5c4b1eeb96b11f769bf854c4a5f305233401e73c8ed7c4647

SHA512
51a36733f0f78d545e84c3f09b4385c4eac811b5f1ac9a7bd36df283eddca73736fc7baee3b26a84b68ba372b7fe7d31e3b2b3e7f533921e2f124a94be24e621

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
449B

MD5
1b0d510b36e8cc9e60093a5eb99938cc

SHA1
66bfeb915cc6b922d1c4160db5fec335d9db3e0b

SHA256
6dd3fe1b06f12c8b0ac8d8b140c7b5913cadf1d9d57f0069367f87aca372c499

SHA512
3edb949845c288d89b7d615352aa37ba703989a6db8250434fef072b1e2f79eb47c22bc2b4e5321b8bbd64d395afc8785aae17813f78433a4e14027e3fd75332

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
18669bd8b12f3efd0d5c2e2c27cc5f40

SHA1
fd334e4761dea1406523e88493d5f1fd5ef79db4

SHA256
18d0d0e56dc19b7bad6b245cdd00d01c100d36b2f5e830de78249942149cef7d

SHA512
7bad6cfd8583b3fe1c81cc66df1c93e86060889607224d4681ef68a564d38182a68fba5d6dc68e2618878b725d4a4fee2c897c25f37d9f7f400f40024ab73ede

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
b0e05f7127b8dc932decb94519adc0d9

SHA1
2e6a2511e83a7d81ff795549df3a876dd528e396

SHA256
c96f77666fe136495b02a577e065e219218210021be9788512a0f1d226254fa3

SHA512
baf9f63bde0b7756eb36a023cdce733c436b7648e17da0232fa9d0e6e60c20012e627f91bef12830ec7f969284e1c48154a40111d2b5157207683a824d160809

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\pending_pings\59f23f30-ed49-4d88-bb32-ef05ff28433f

Filesize
733B

MD5
71042fed71850725878f526843887e2b

SHA1
89143d8f827bbd565625d2f86d50f141cc857fd1

SHA256
b8e2825a800e86db671ecb55b2e3b9ea0130e2eb50abb29c49cccc079815ae7e

SHA512
086a4628105460b874d43ab7365174073bc8c64d59cafb9f452d4f43e40431ec9a688d283f278c648db15be7e1d47143c4bd26e6186a46ca260bb3580259f915

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\prefs-1.js

Filesize
6KB

MD5
1f94f05ad9ae300e95986be21e39889b

SHA1
dc7eeb22ef4b88beb7884ed678455316a50732ee

SHA256
e9328ed12afe3d8e0309a0fbdea721a46064abd14b238eacffdadb02d326daee

SHA512
7b804d4fecadfee384d170fb449e0aa6b7991da2dc63beb03843255e2be62ff28e8ec84ab2006fd855df5caff986d09f23b547574edab61449b3b08728f7d3f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
cb83032ebb5e714c012f092609df5ede

SHA1
4e6a27926c04d63974d39c194c2a2d15e42b1f2c

SHA256
eb86d9ce165d14893f2383932713123a8e4ca17ede2d012e88ba61b95fe87454

SHA512
78a6f3bc00c07d24b31bb7a51a7b57c73cc5be615bb758b400787a8ece1574f79ced8a0730f206af6e1cdaf4a282515fd71576483ec8d40edaba052f9af1a1f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
1bdc18b15aabeb5f24c4820d7416d4ae

SHA1
70fd5c9abade4ce8b4239342cb054fd6fef6b268

SHA256
9d3b7e177a9f9f9f6e99f5037e9f5d4e9925186af73c46973b11ec50e996cb72

SHA512
476eff6358a8fc6c25769405fe94cc4ca13b1119e8eb7b056ed7af8ef87fd7ad9aeb8268c8ffc025bafda99bb97573d815fff60c9eeef60c4d5bdf91cbc6ba11

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
76B

MD5
34e7236a6c0e7b4bd1e6a5b2cd5d88dd

SHA1
1a1c8c9f33735c8dcac4167643bd089d692baf78

SHA256
aec0cfa5ea18a92a4148a15ebe46deefcb4b19210f110ff33fa167170908aebd

SHA512
a013ec7deffc5654edcc6a3a6825bae958636f4ea85d1e744beeddf5e3f0b1c75eaf3ff65f222c887f7e6c52eaf97ed06b5f3dcdd3e44454a22524c34a251ad7

Download Submit
memory/1496-32-0x000007FEF7850000-0x000007FEF7868000-memory.dmp

Filesize
96KB

Download
memory/1496-31-0x000007FEF7870000-0x000007FEF7891000-memory.dmp

Filesize
132KB

Download
memory/1496-19-0x000007FEF7AE0000-0x000007FEF7B14000-memory.dmp

Filesize
208KB

Download
memory/1496-33-0x000007FEF7540000-0x000007FEF7551000-memory.dmp

Filesize
68KB

Download
memory/1496-34-0x000007FEF71A0000-0x000007FEF71B1000-memory.dmp

Filesize
68KB

Download
memory/1496-35-0x000007FEF7180000-0x000007FEF7191000-memory.dmp

Filesize
68KB

Download
memory/1496-36-0x000007FEF7160000-0x000007FEF717B000-memory.dmp

Filesize
108KB

Download
memory/1496-37-0x000007FEF7120000-0x000007FEF7131000-memory.dmp

Filesize
68KB

Download
memory/1496-48-0x000007FEF5340000-0x000007FEF5351000-memory.dmp

Filesize
68KB

Download
memory/1496-50-0x000007FEF2B60000-0x000007FEF2B77000-memory.dmp

Filesize
92KB

Download
memory/1496-49-0x000007FEF5320000-0x000007FEF5332000-memory.dmp

Filesize
72KB

Download
memory/1496-47-0x000007FEF5360000-0x000007FEF5383000-memory.dmp

Filesize
140KB

Download
memory/1496-46-0x000007FEF5390000-0x000007FEF53A8000-memory.dmp

Filesize
96KB

Download
memory/1496-45-0x000007FEF6720000-0x000007FEF6744000-memory.dmp

Filesize
144KB

Download
memory/1496-44-0x000007FEF6AB0000-0x000007FEF6AD8000-memory.dmp

Filesize
160KB

Download
memory/1496-43-0x000007FEF53B0000-0x000007FEF5407000-memory.dmp

Filesize
348KB

Download
memory/1496-42-0x000007FEF6AE0000-0x000007FEF6AF1000-memory.dmp

Filesize
68KB

Download
memory/1496-40-0x000007FEF6B80000-0x000007FEF6BE7000-memory.dmp

Filesize
412KB

Download
memory/1496-39-0x000007FEF6BF0000-0x000007FEF6C20000-memory.dmp

Filesize
192KB

Download
memory/1496-38-0x000007FEF6C20000-0x000007FEF6C38000-memory.dmp

Filesize
96KB

Download
memory/1496-28-0x000007FEF5620000-0x000007FEF66D0000-memory.dmp

Filesize
16.7MB

Download
memory/1496-29-0x000007FEF5410000-0x000007FEF561B000-memory.dmp

Filesize
2.0MB

Download
memory/1496-30-0x000007FEF78A0000-0x000007FEF78E1000-memory.dmp

Filesize
260KB

Download
memory/1496-41-0x000007FEF6B00000-0x000007FEF6B7C000-memory.dmp

Filesize
496KB

Download
memory/1496-61-0x000000013F420000-0x000000013F518000-memory.dmp

Filesize
992KB

Download
memory/1496-62-0x000007FEF7AE0000-0x000007FEF7B14000-memory.dmp

Filesize
208KB

Download
memory/1496-63-0x000007FEF6750000-0x000007FEF6A06000-memory.dmp

Filesize
2.7MB

Download
memory/1496-64-0x000007FEF5620000-0x000007FEF66D0000-memory.dmp

Filesize
16.7MB

Download
memory/1496-27-0x000007FEF78F0000-0x000007FEF7901000-memory.dmp

Filesize
68KB

Download
memory/1496-26-0x000007FEF7910000-0x000007FEF792D000-memory.dmp

Filesize
116KB

Download
memory/1496-25-0x000007FEF7930000-0x000007FEF7941000-memory.dmp

Filesize
68KB

Download
memory/1496-22-0x000007FEF7990000-0x000007FEF79A7000-memory.dmp

Filesize
92KB

Download
memory/1496-20-0x000007FEF6750000-0x000007FEF6A06000-memory.dmp

Filesize
2.7MB

Download
memory/1496-24-0x000007FEF7950000-0x000007FEF7967000-memory.dmp

Filesize
92KB

Download
memory/1496-23-0x000007FEF7970000-0x000007FEF7981000-memory.dmp

Filesize
68KB

Download
memory/1496-18-0x000000013F420000-0x000000013F518000-memory.dmp

Filesize
992KB

Download
memory/1496-21-0x000007FEFBC20000-0x000007FEFBC38000-memory.dmp

Filesize
96KB

Download
memory/2548-0-0x0000000000F80000-0x0000000001002000-memory.dmp

Filesize
520KB

Download
memory/3712-295-0x000000007122D000-0x0000000071238000-memory.dmp

Filesize
44KB

Download
memory/3712-294-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3712-293-0x000000002F781000-0x000000002F782000-memory.dmp

Filesize
4KB

Download
memory/3712-338-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3712-339-0x000000007122D000-0x0000000071238000-memory.dmp

Filesize
44KB

Download
memory/4080-340-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads