vjw0rm | hxxps://tmpfiles[.]org/23921300/diddy[.]arj

Analysis

max time kernel
208s
max time network
212s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
06/04/2025, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tmpfiles.org/23921300/diddy.arj

Score

10^/10

vjw0rm discovery execution trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Vjw0rm family
vjw0rm

Blocklisted process makes network request 13 IoCs

flow	pid	Process
94	752	WScript.exe
100	4420	WScript.exe
111	752	WScript.exe
114	2376	WScript.exe
121	4420	WScript.exe
124	752	WScript.exe
126	2376	WScript.exe
127	4420	WScript.exe
128	752	WScript.exe
135	2376	WScript.exe
136	4420	WScript.exe
138	752	WScript.exe
139	2376	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3600	stdpx.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stdpx.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2423602651-1712563293-711691555-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\diddy.arj:Zone.Identifier	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2656	schtasks.exe
3968	schtasks.exe
6084	schtasks.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	firefox.exe
Token: SeDebugPrivilege	2996	firefox.exe
Token: SeDebugPrivilege	2996	firefox.exe
Token: SeRestorePrivilege	3728	7zG.exe
Token: 35	3728	7zG.exe
Token: SeSecurityPrivilege	3728	7zG.exe
Token: SeSecurityPrivilege	3728	7zG.exe
Token: SeDebugPrivilege	3600	stdpx.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
3728	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2816 wrote to memory of 2996	2816	firefox.exe	82
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 2672	2996	firefox.exe	83
PID 2996 wrote to memory of 6012	2996	firefox.exe	84
PID 2996 wrote to memory of 6012	2996	firefox.exe	84
PID 2996 wrote to memory of 6012	2996	firefox.exe	84
PID 2996 wrote to memory of 6012	2996	firefox.exe	84
PID 2996 wrote to memory of 6012	2996	firefox.exe	84
PID 2996 wrote to memory of 6012	2996	firefox.exe	84
PID 2996 wrote to memory of 6012	2996	firefox.exe	84
PID 2996 wrote to memory of 6012	2996	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://tmpfiles.org/23921300/diddy.arj"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://tmpfiles.org/23921300/diddy.arj
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27100 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {a0168544-249b-4e31-8238-67add653fec7} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27136 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2504 -initialChannelId {4c15fdd7-77de-446d-9446-f1788696ec3a} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:6012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3976 -prefsLen 25164 -prefMapHandle 3980 -prefMapSize 270279 -jsInitHandle 3984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3992 -initialChannelId {356ef528-7fb2-4013-9f4e-5af844386edc} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4144 -prefsLen 27277 -prefMapHandle 4148 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {c2e4c190-5f01-41ba-ba3e-fa8a8838bfa5} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2800 -prefsLen 34776 -prefMapHandle 2948 -prefMapSize 270279 -jsInitHandle 2712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4612 -initialChannelId {9a3382b4-7195-4472-98ce-5f7ce666bee1} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5260 -prefsLen 35013 -prefMapHandle 5256 -prefMapSize 270279 -ipcHandle 5204 -initialChannelId {fb0a3e89-3e93-4597-bda5-484616caacca} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32900 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5356 -initialChannelId {cc88e40d-e811-4d9f-a195-f00955ca0aa8} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {54187b4e-f0fd-4337-ac65-5f247fa15bf6} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5868 -prefsLen 32952 -prefMapHandle 5872 -prefMapSize 270279 -jsInitHandle 5876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {05451c6c-5c58-41ad-af90-817bf56f0e52} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5896

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\diddy\" -ad -an -ai#7zMap9522:72:7zEvent14460
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3728

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\diddy\weird\pajilla.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:752
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\Downloads\diddy\weird\pajilla.js
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2656

C:\Users\Admin\Downloads\diddy\weird\stdpx.exe
"C:\Users\Admin\Downloads\diddy\weird\stdpx.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\diddy\weird\pajilla.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:4420
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\Downloads\diddy\weird\pajilla.js
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3968

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\diddy\weird\pajilla.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:2376
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\Downloads\diddy\weird\pajilla.js
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
26ed57acbc69eb0d55d63a7735eecea2

SHA1
92e24a8a5a5ee54f789af2e5b031046a96ad4757

SHA256
12e278388854f076091bfba1eb8139841facc82dd7820bbd31c6f3cf1539d5b8

SHA512
848d55e3c0839b95430877307b953c74ff3c11d02154c998e8a827f6b7fc056494f7450986ffffaf2a180bc6c88772eff16fddceac890b5c217bfc7d55f210e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\AlternateServices.bin

Filesize
10KB

MD5
f8c7d8f986c1f9c029e5fd6da02257bc

SHA1
5578c9afc7633c41336793ffb5be074a5dd72597

SHA256
21c4784fb8fce93e4a877446e671936a9341ec969cc033497b77d26b30328ac8

SHA512
dbadf3a4dc966fe4f273ebe3a324eadc0d547c882e032913ee653d9a0131eb24c4cacedcf042234c622df6971307819ecdb344e95dde329696b1d1db72c8598a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
102d1b70c743a8e9e42ed6a93949aa18

SHA1
3bf8c4bf8c636c83b571cb9be3bc23673695652b

SHA256
e2805b100bcf65f2a08eab1ead6ef8395a309c82d7542bb71bd66aeed7b15d58

SHA512
1da520340b31767f8b5fb5ec854f35df6b92d9478f214671d0c24bd78f9cff9849df81e5dbf6b14a55f30b67693876543fac0ec273c5b412fd5e1f1890e86ce3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
d93f54d41d8f312ba710a5b29fbb7a12

SHA1
dba638fa41a6bb602c47efd6007ab46763b0c96b

SHA256
5a2788018dab990533f02e6a64dfe243aaf019f5fa0d0d69785cd63530885f80

SHA512
77757a5d658d21bbf4ac683174c85b934355f5f4c192aff77defb908d0b622f3891489581e6a3ee96a6346dcd7faf1e0a968e369ddc1462d12245743a16e545f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
33bda2ea590d9f0a3ec3194e9899edf2

SHA1
172d2f3a8467b72eacc8f0264e6f875297779a6b

SHA256
1fd3054d640b57aa2d02dc055da9067a8284c14825c89b1ee1cc3253573c0dd3

SHA512
c530748cc6e4e577f55b4ddb167543142e5303ddd0b2034336a0966854c23ed6d3192c427d33ed604602ff4fffa151ee5547e9056e04cef0824b5ea95d5131b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
3e2195b75c93f32d4a801eaf42ab212c

SHA1
bc353b0a306941d3f019d4c1b0e73557c0dd92b6

SHA256
39a2c7864dacfc03cdf1ecf83ce95507dad5bad97a0288199d3dd0f21a62ffd5

SHA512
a0d40128f6491b40f48c39fbf733431f51a57f5b13a10af8368399a592ef5047e6674bb03d01a9d44a149d96dd3460cc0a086a2b2bb0b9be5f7ea57b8a8c9139

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\pending_pings\011d00ae-fd97-416b-b6f8-a2a332d88f64

Filesize
235B

MD5
60706d44126d471d15c954e840faeca2

SHA1
2cb8137843d95f9df613d56cc76dbab30bac36cb

SHA256
7ef144eb0583a4ba025908bd4df9cd3ca175bdde4e25b02693a35b56b243d98a

SHA512
97707c531f1160398296600636e6f29407fd0d7e11ed42cfe73088095dba7d0aed4c6bf772efd05869afbc33334cb87a671a8040101c85d542121cea3e70695d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\pending_pings\67008b22-5150-4f67-9bae-272a8b15ccba

Filesize
17KB

MD5
0f034fcb7030140c177a610e2e8a51e9

SHA1
702c94f878eb3ff2cfa87c3dd5504a0961adb538

SHA256
e247612c89dad7b295081fa61c3b086034242a5b62346024d9a47dd69bd30390

SHA512
8e4dff00172f018a278b8a6ac32d58ab5274754b1e60d9f4233268effc4ac956d0ac9c174cc4d3398b3e686b874b0b417bb896b8bf8110e6f08c773b1dc9ccb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\pending_pings\8c118b73-a334-45d3-866f-2c9dd59c862e

Filesize
2KB

MD5
b12c9bf0e0dee472b0c283daefe32770

SHA1
e452bcec4cb6e87f967b43218d6796f5de67a837

SHA256
41c8a4f530249d197ba71ff7b0cace4723a1ba6eea0a41c54272f32ce91e3691

SHA512
e24d9536755a2cbcbbd5e603fe79c47d43cda76dad7ccbff5a7ca6a3e32b00db4c64b8f28bb2771b7a4aafce26c1402624ad55dee588748a1e74a419a2b39f00

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\pending_pings\8c6e0a83-4396-4570-a2e7-f01080c09086

Filesize
883B

MD5
59c5858276120eebe00c9d7519643c0b

SHA1
32f1c89f31056d80f72c8326535020badea39816

SHA256
ed3ce94ae566859ffd7d4b83e1a034318b7747f64b5e8215ee2bf9159d3135c1

SHA512
30995351b36a75eaa2e0cb603ce75d9cd8892e13ea2b185b2c86c8e1120ea0c953143ec5cb899f0a0fd21ccdad596bd9ff0ee9fdeb6a9fa1144f1413f489a9a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\pending_pings\c2ac48b8-ed92-4633-acd7-647808fc4ae9

Filesize
235B

MD5
41ce15e2299143b5b9426154e1be287b

SHA1
2679ce54c26ad474eac9f9ec9960cc1a80683e79

SHA256
3402d36a40fcb81eaa5f10079ae615914c07ba17b4874cfab4f2b366f6dd2b81

SHA512
532eebe2f7d503593e41d8815e031a5fb8db0421dae2ee4dac5bcf456fbbd2361676a6124b1a61680145b253e7d024c44309656a1a49e609c14e6a799b5019b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\datareporting\glean\pending_pings\d4043f98-5d8a-4220-a30c-23a84ccead6f

Filesize
886B

MD5
ab7115645f4450bc25d25246e2b98aa2

SHA1
9397ff933a6440496711a64e369024bae0c121ad

SHA256
c1b6da27fb84d621617b20b0ad98481fce47d2709839d148ef4246249bb7ca34

SHA512
fab5df91d3fe2040d74a234a476098e92dbaf7ac3024686f99e3342988b55393f9e59e0c08ad1d6fa58968ed56730dbce26c1ff8cd06acaba4f4aadf2a479b70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\prefs-1.js

Filesize
6KB

MD5
030f59697fbf5ab93cbd2552f72ec452

SHA1
508e1070fbc905b010db52c8902a0dfe35d50fdf

SHA256
975d2dc7684d5ce83218e69ceca217e114ebb9b3c43b85359e8db0531d1bb4d1

SHA512
0620d506ff03856464b9db9b72aa0753b53c5de987d696112eb23a6c027c92f105b5a1ded3a2703f9ff604d6d48d00a11b2490d6b209f99f292123fbcf824cf5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\prefs-1.js

Filesize
7KB

MD5
e73f012b748c9bc81ea7533e4453606f

SHA1
19245954fe2b89254634970d815247ff6ec7da98

SHA256
825df6bd0041f936fa7afa356a6b711c9114590368bf15d9912e9e574447be79

SHA512
bcc93a1bc1b143b7629d20599edf71832f9ec935e8fea54f4896d8d1c0653c512019d45f22a0e90808466ab54bd572e182749d8de89a527d1afae17b432fff51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\prefs-1.js

Filesize
6KB

MD5
3d61541bdf21ea566d48b2db841332c5

SHA1
a1882bd5bcf6529a3f6ad2628194675fef1d5c06

SHA256
b670269c6d4d1e6915b4ed03329f7c1139c2fbb230c3d840f6acdf4a1765575a

SHA512
2d4bba988b8201b0b1a62634548be8dd75ce486524cc0eaa896230ec6f35d6250fd59f63a947396f65c776e37ae3c7ce112d0f935ed398717e639f9a34a61e1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3dnsnfa3.default-release\prefs.js

Filesize
6KB

MD5
c32521aebe187296d4120e275cb7cae0

SHA1
adbdf46fbcbee6aa4110bc0de0c1492fbb7777a5

SHA256
23bb97dd9b39fd64e94e0c7608154bb7290b915f053372a754c6e88a6950b714

SHA512
c35568bdc29eddb752d7063f411b352babb8d6f45c2123a8d9d326f99fbfe7c7cba83f965127ef4bbd770d777111579dbfacff5e637eb5ac05209f0a88c89298

Download Submit
C:\Users\Admin\Downloads\diddy.sxSqqwlU.arj.part

Filesize
8.6MB

MD5
7cdf0bd0fc28087b46fb90baf1a7364a

SHA1
646a1f03a00cc98c17c954eaef9cb95012752003

SHA256
5eaad41a43d5b8fd135d070808bec7d12812efe0bafeda1c3d0d83cdb5efc2dd

SHA512
f3b1ec7dfcd0548d427185af3af09ba579ee8cee6510e0cfe4e018736f7802f37263e753a9d75001f480601952947564a0fbf36a45c7cbb7a3836eecff51e2a8

Download Submit
C:\Users\Admin\Downloads\diddy\weird\pajilla.js

Filesize
11KB

MD5
ffc3b6d64ad2b18d139f02dfca4b82e0

SHA1
5e93a7f4e1bc9f3fb2b467cf4de3879022c07682

SHA256
180264bc01ddae4f3a4f47085ea6840997d06d763d6d71ef586312c66d5971c8

SHA512
8c9f797ece08ea026edcd392c8adaa67f55c3fbca50b7af39d67839e5e1887ce1768b07a148d36e4a9bdcbf941831f28510b139e04153c05c9c77d071a241a9a

Download Submit
C:\Users\Admin\Downloads\diddy\weird\stdpx.exe

Filesize
8.6MB

MD5
c1aa8e20d0fe88e189fd5d060b448a4b

SHA1
d9fb786acd9c4ab7c75630c246305719bfe47eb6

SHA256
45529590edd3a3e2accc947aa3ba80b0cd10ff0c0a40127145ba4f167e50c292

SHA512
b301f90c7f125d56e9c53ef25845e4f1c3ec4249842196f00b40a59c4b2e127faa96fd38f32cda65f4c9b5fb8423c4c74f17e1ccee1ca3158b7d3cfed504ca29

Download Submit
memory/3600-436-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-462-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-421-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-427-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-430-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-428-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-434-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-422-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-442-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-440-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-446-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-448-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-450-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-452-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-455-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-456-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-460-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-424-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-466-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-464-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-470-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-472-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-474-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-478-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-482-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-484-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-480-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-476-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-468-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-459-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-444-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-438-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-432-0x000000000CF00000-0x000000000DFDA000-memory.dmp

Filesize
16.9MB

Download
memory/3600-420-0x000000000CF00000-0x000000000DFDE000-memory.dmp

Filesize
16.9MB

Download
memory/3600-419-0x0000000006D40000-0x00000000072E6000-memory.dmp

Filesize
5.6MB

Download
memory/3600-418-0x0000000009E20000-0x000000000AF02000-memory.dmp

Filesize
16.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads