Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/07/2026, 04:31
General
- Target citizen/common/data/timecycle/w_blizzard.xml
- Size 120KB
- Sample260730-e5mlbabg46
- SHA256 f50a2e34f7633ed04477a0ee6141c3dfe9022380faeac2c8424a1679dfaa39c2
Malware Config
Signatures
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\citizen\common\data\timecycle\w_blizzard.xml"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5188-1-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
memory/5188-0-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
memory/5188-4-0x00007FFC31D9F000-0x00007FFC31DA0000-memory.dmp
memory/5188-2-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
memory/5188-3-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
memory/5188-7-0x00007FFC31C40000-0x00007FFC31EA3000-memory.dmp
memory/5188-6-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
memory/5188-5-0x00007FFC31C40000-0x00007FFC31EA3000-memory.dmp
memory/5188-8-0x00007FFC31C40000-0x00007FFC31EA3000-memory.dmp
memory/5188-9-0x00007FFC31C40000-0x00007FFC31EA3000-memory.dmp
memory/5188-10-0x00007FFC31C40000-0x00007FFC31EA3000-memory.dmp
memory/5188-11-0x00007FFC31C40000-0x00007FFC31EA3000-memory.dmp
memory/5188-12-0x00007FFC31C40000-0x00007FFC31EA3000-memory.dmp
memory/5188-13-0x00007FFC31C40000-0x00007FFC31EA3000-memory.dmp
memory/5188-17-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
memory/5188-18-0x00007FFC31C40000-0x00007FFC31EA3000-memory.dmp
memory/5188-16-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
memory/5188-15-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
memory/5188-14-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp