Analysis
- max time kernel
149s - max time network
174s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 02:34
General
- Target Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT NOISE Overlay.mov
- Size 244KB
- Sample260724-c2sbaaeb99
- SHA256 1bb2373238bfa4976b72ff5bbd2bbe239cce59150b3aecb6a4fbd4971f8e8c17
Malware Config
Signatures
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 25 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Ryanherrick - ULTIMATE STARTER PACK\ESSENTIAL OL\RH- VERT NOISE Overlay.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1720-0-0x00007FFAFE48D000-0x00007FFAFE48F000-memory.dmp
memory/1720-1-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-2-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-3-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-4-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-7-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-6-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-5-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-9-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-8-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-10-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-12-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-11-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-14-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-13-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-19-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-20-0x00007FFAFE1E0000-0x00007FFAFE496000-memory.dmp
memory/1720-22-0x00007FFB10240000-0x00007FFB10274000-memory.dmp
memory/1720-21-0x00007FF6CFA40000-0x00007FF6CFB38000-memory.dmp
memory/1720-27-0x00007FFB09020000-0x00007FFB0904B000-memory.dmp
memory/1720-26-0x00007FFB09050000-0x00007FFB09072000-memory.dmp
memory/1720-25-0x00007FFB0B100000-0x00007FFB0B119000-memory.dmp
memory/1720-28-0x00007FFAFD740000-0x00007FFAFDAD0000-memory.dmp
memory/1720-32-0x00007FFAFD4A0000-0x00007FFAFD736000-memory.dmp
memory/1720-42-0x00007FFB067A0000-0x00007FFB067B1000-memory.dmp
memory/1720-41-0x00007FFB067C0000-0x00007FFB067D1000-memory.dmp
memory/1720-48-0x00007FFB043A0000-0x00007FFB043BB000-memory.dmp
memory/1720-44-0x00007FFB04580000-0x00007FFB04618000-memory.dmp
memory/1720-47-0x00007FFB00A10000-0x00007FFB00ABB000-memory.dmp
memory/1720-46-0x00007FFB043C0000-0x00007FFB043E5000-memory.dmp
memory/1720-45-0x00007FFB043F0000-0x00007FFB0443F000-memory.dmp
memory/1720-49-0x000002267DF20000-0x000002267E2B0000-memory.dmp
memory/1720-50-0x00007FFAF7440000-0x00007FFAF7685000-memory.dmp
memory/1720-43-0x00007FFAFD290000-0x00007FFAFD49B000-memory.dmp
memory/1720-40-0x00007FFB08990000-0x00007FFB089AA000-memory.dmp
memory/1720-39-0x00007FFB067E0000-0x00007FFB0680D000-memory.dmp
memory/1720-38-0x00007FFB088E0000-0x00007FFB08906000-memory.dmp
memory/1720-37-0x00007FFB089B0000-0x00007FFB089C8000-memory.dmp
memory/1720-36-0x00007FFB08FB0000-0x00007FFB08FDF000-memory.dmp
memory/1720-35-0x00007FFB089D0000-0x00007FFB08A11000-memory.dmp
memory/1720-34-0x00007FFB00AC0000-0x00007FFB00BA3000-memory.dmp
memory/1720-31-0x00007FFB08A20000-0x00007FFB08AF2000-memory.dmp
memory/1720-33-0x00007FFB04440000-0x00007FFB04528000-memory.dmp
memory/1720-30-0x00007FFB08FE0000-0x00007FFB08FF1000-memory.dmp
memory/1720-29-0x00007FFB09000000-0x00007FFB09014000-memory.dmp
memory/1720-24-0x00007FFB0D3C0000-0x00007FFB0D3D1000-memory.dmp