2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad

Resubmissions

16-06-2023 08:15

230616-j5mnjadh48 10

Analysis

max time kernel
576s
max time network
578s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
16-06-2023 08:15

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

eicar_com.zip
Size

184B
MD5

6ce6f415d8475545be5ba114f208b0ff
SHA1

d27265074c9eac2e2122ed69294dbc4d7cce9141
SHA256

2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
SHA512

d9305862fe0bf552718d19db43075d88cffd768974627db60fa1a90a8d45563e035a6449663b8f66aac53791d77f37dbb5035159aa08e69fc473972022f80010

Score

10^/10

agilenet discovery evasion persistence trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\mrsmajor\\Launcher.vbs\""	wscript.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1"	wscript.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 16 IoCs

pid	Process
4492	winrar-x64-622.exe
1128	uninstall.exe
980	WinRAR.exe
96	WinRAR.exe
2796	winrar-x64-622.exe
4736	uninstall.exe
1916	WinRAR.exe
3132	WinRAR.exe
4772	NRVP.exe
2372	WinRAR.exe
2696	MrsMajor 3.0.exe
688	eulascr.exe
2292	MrsMajor 3.0.exe
1376	eulascr.exe
1940	WinRAR.exe
2880	BossDaMajor.exe

Loads dropped DLL 9 IoCs

pid	Process
3132	WinRAR.exe
3132	WinRAR.exe
2372	WinRAR.exe
2372	WinRAR.exe
688	eulascr.exe
3132	WinRAR.exe
1376	eulascr.exe
1940	WinRAR.exe
1940	WinRAR.exe

Modifies system executable filetype association 2 TTPs 18 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/688-2140-0x0000000000990000-0x00000000009BA000-memory.dmp	agile_net

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001b175-2100.dat	upx
behavioral1/memory/4772-2114-0x00007FF715670000-0x00007FF71567C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240651187	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-622.exe
File created	C:\Program Files\mrsmajor\def_resource\@Tile@@.jpg	wscript.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-622.exe
File created	C:\Program Files\mrsmajor\Launcher.vbs	wscript.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-622.exe
File created	C:\Program Files\mrsmajor\def_resource\Skullcur.cur	wscript.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240596453	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-622.exe
File created	C:\Program Files\mrsmajor\mrsmajorlauncher.vbs	wscript.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-622.exe
File created	C:\Program Files\mrsmajor\def_resource\f11.mp4	wscript.exe
File created	C:\Program Files\mrsmajor\DreS_X.bat	wscript.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-622.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\Cursors	wscript.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	NRVP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\NRVP.exe = "11000"	NRVP.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133313769846195472"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r02\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r03	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r14	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r19\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r22\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r12\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r08	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r17\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r07\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r09\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r05	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r11\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r19	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\eicar_com.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MrsMajor 3.0.7z:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NRVP.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\BossDaMajor.7z:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4280	chrome.exe
4280	chrome.exe
688	eulascr.exe
688	eulascr.exe
1376	eulascr.exe
1376	eulascr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1916	WinRAR.exe
3132	WinRAR.exe
2372	WinRAR.exe
1940	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe
Token: SeShutdownPrivilege	4280	chrome.exe
Token: SeCreatePagefilePrivilege	4280	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
980	WinRAR.exe
96	WinRAR.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1916	WinRAR.exe
1916	WinRAR.exe
1916	WinRAR.exe
3132	WinRAR.exe
3132	WinRAR.exe
3132	WinRAR.exe
3132	WinRAR.exe
2372	WinRAR.exe
2372	WinRAR.exe
2372	WinRAR.exe
2372	WinRAR.exe
2372	WinRAR.exe
3132	WinRAR.exe
3132	WinRAR.exe
3132	WinRAR.exe
3132	WinRAR.exe
1148	firefox.exe
1148	firefox.exe
1940	WinRAR.exe
1940	WinRAR.exe
1940	WinRAR.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
4280	chrome.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
4492	winrar-x64-622.exe
4492	winrar-x64-622.exe
2796	winrar-x64-622.exe
2796	winrar-x64-622.exe
2796	winrar-x64-622.exe
4736	uninstall.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1916	WinRAR.exe
1916	WinRAR.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
4772	NRVP.exe
4772	NRVP.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
1148	firefox.exe
4328	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 1760	4280	chrome.exe	68
PID 4280 wrote to memory of 1760	4280	chrome.exe	68
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4760	4280	chrome.exe	71
PID 4280 wrote to memory of 4776	4280	chrome.exe	70
PID 4280 wrote to memory of 4776	4280	chrome.exe	70
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72
PID 4280 wrote to memory of 2880	4280	chrome.exe	72

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\eicar_com.zip
1⤵
PID:4268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff85b049758,0x7ff85b049768,0x7ff85b049778
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:2
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4384 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4696 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4916 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:4220
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7d0bd7688,0x7ff7d0bd7698,0x7ff7d0bd76a8
    3⤵
    PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5068 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3024 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3200 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4988 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1000 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5432 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5404 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5652 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5584 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:856
- C:\Users\Admin\Downloads\winrar-x64-622.exe
  "C:\Users\Admin\Downloads\winrar-x64-622.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:4492
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 --field-trial-handle=1768,i,1466140101272187716,14797537050774023140,131072 /prefetch:8
  2⤵
  PID:3744

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4672

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\SkipExport.zip"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:980

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\CompressMove.001"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:96

C:\Users\Admin\Downloads\winrar-x64-622.exe
"C:\Users\Admin\Downloads\winrar-x64-622.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2796
- C:\Program Files\WinRAR\uninstall.exe
  "C:\Program Files\WinRAR\uninstall.exe" /setup
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Registers COM server for autorun
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1012
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.0.1139577443\88340157" -parentBuildID 20221007134813 -prefsHandle 1652 -prefMapHandle 1640 -prefsLen 20810 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d0095a9-64f5-4ca9-a5a6-5b727f90bb11} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 1576 20eadf17d58 gpu
    3⤵
    PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.1.265592019\1807752097" -parentBuildID 20221007134813 -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 20891 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b935d4d-90b3-4c4d-a58a-42c7f3f619b7} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 2088 20eacbfd858 socket
    3⤵
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.2.1924289318\1834883947" -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 2868 -prefsLen 20974 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36d67d0d-5edd-4e7f-b9de-0b0f4f6e9d9c} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 2560 20eb0ceda58 tab
    3⤵
    PID:2200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.3.175267815\434925625" -childID 2 -isForBrowser -prefsHandle 3360 -prefMapHandle 3356 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfc13757-83e8-42ee-a136-01630a2676f9} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 3396 20ea176a558 tab
    3⤵
    PID:4964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.4.2145279374\125746825" -childID 3 -isForBrowser -prefsHandle 3716 -prefMapHandle 3712 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee36bca2-1652-4b81-9a46-df810d90d050} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 3724 20eb2093f58 tab
    3⤵
    PID:2924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.7.693265516\1859466973" -childID 6 -isForBrowser -prefsHandle 5184 -prefMapHandle 5188 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecfaae47-80ea-4d58-9b5e-8e2feb86eb2f} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 5176 20eb303c958 tab
    3⤵
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.6.173055502\649865277" -childID 5 -isForBrowser -prefsHandle 4984 -prefMapHandle 4988 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {232ed226-3e5e-43af-8346-ac55273a0ade} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 5068 20eb303c058 tab
    3⤵
    PID:3996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.5.657725159\528421531" -childID 4 -isForBrowser -prefsHandle 4800 -prefMapHandle 4808 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb46f250-786a-46be-ad20-6095aa1ec4cd} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 4820 20eb303de58 tab
    3⤵
    PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.8.140306735\334734447" -childID 7 -isForBrowser -prefsHandle 5636 -prefMapHandle 5628 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58424c16-ba52-4ce3-9042-b7af3b34c5f4} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 5648 20eb55df858 tab
    3⤵
    PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.9.789866508\1012857083" -parentBuildID 20221007134813 -prefsHandle 4548 -prefMapHandle 4552 -prefsLen 27136 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8ac46d8-ca18-44d9-84cf-1b28036387f8} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 3236 20eb605b058 rdd
    3⤵
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.10.460418227\2061438839" -childID 8 -isForBrowser -prefsHandle 2676 -prefMapHandle 2936 -prefsLen 27136 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3c22c70-cfa8-4c0f-9b13-216889e236a4} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 5816 20eb6198b58 tab
    3⤵
    PID:4596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.11.1770392617\1842439051" -childID 9 -isForBrowser -prefsHandle 6092 -prefMapHandle 6104 -prefsLen 27136 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {453d952e-0913-4e09-a24b-b8a9af918c7f} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 6108 20eb6af6858 tab
    3⤵
    PID:3616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.12.286835148\1942716519" -childID 10 -isForBrowser -prefsHandle 4104 -prefMapHandle 4088 -prefsLen 27255 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96383402-8f9a-4dd1-b52c-0cc1b6e2bcf1} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 4356 20eb6a41e58 tab
    3⤵
    PID:1452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.13.1518540944\416768947" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6428 -prefMapHandle 6424 -prefsLen 27255 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff446aa3-6780-429d-85f5-9f1780a75ba5} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 6392 20eb7c58758 utility
    3⤵
    PID:2068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.14.675312105\97181793" -childID 11 -isForBrowser -prefsHandle 4996 -prefMapHandle 6260 -prefsLen 27255 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ca98b58-9673-487c-88f0-c79eb5951821} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 6376 20eb6011158 tab
    3⤵
    PID:3444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.15.1124660683\783303366" -childID 12 -isForBrowser -prefsHandle 6848 -prefMapHandle 5996 -prefsLen 27264 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80c5951b-9264-42d6-a1a3-29b77be0cbf1} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 6800 20eb55df858 tab
    3⤵
    PID:2372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.16.627815076\1158752172" -childID 13 -isForBrowser -prefsHandle 2656 -prefMapHandle 2772 -prefsLen 27264 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c644e368-e99c-4985-aca2-6f8d59181d9d} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 5604 20eac988658 tab
    3⤵
    PID:1536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.17.1002561232\139096105" -childID 14 -isForBrowser -prefsHandle 4548 -prefMapHandle 5824 -prefsLen 27264 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39697e0d-2c7f-4b7a-9f21-2c4e4c9c80ea} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 2812 20eac988c58 tab
    3⤵
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.18.1153258821\844453744" -childID 15 -isForBrowser -prefsHandle 4148 -prefMapHandle 4624 -prefsLen 27264 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af3ba1df-a153-4f43-a317-ceff22d4a4fa} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 6004 20eb71bb858 tab
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.19.245818670\1523348212" -childID 16 -isForBrowser -prefsHandle 3528 -prefMapHandle 4624 -prefsLen 27264 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bb8d4ed-33b5-421c-b216-b818889b96fc} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 6292 20eac9fd958 tab
    3⤵
    PID:3416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1148.20.505329997\898135069" -childID 17 -isForBrowser -prefsHandle 6352 -prefMapHandle 6292 -prefsLen 27264 -prefMapSize 232645 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4af1b78f-06c4-4998-beb6-46f21212c02f} 1148 "\\.\pipe\gecko-crash-server-pipe.1148" 6568 20eb55df858 tab
    3⤵
    PID:4740
- - C:\Users\Admin\Downloads\NRVP.exe
    "C:\Users\Admin\Downloads\NRVP.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4772

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\eicar_com.zip"
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d8
1⤵
PID:4920

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\MrsMajor 3.0.7z"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3132
- C:\Users\Admin\AppData\Local\Temp\Rar$EXb3132.36994\MrsMajor 3.0.exe
  "C:\Users\Admin\AppData\Local\Temp\Rar$EXb3132.36994\MrsMajor 3.0.exe"
  2⤵
  - Executes dropped EXE
  PID:2292
- - C:\Windows\system32\wscript.exe
    "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\508F.tmp\5090.tmp\5091.vbs //Nologo
    3⤵
    - UAC bypass
    - System policy modification
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\508F.tmp\eulascr.exe
      "C:\Users\Admin\AppData\Local\Temp\508F.tmp\eulascr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1376

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\MrsMajor 3.0.7z"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2372
- C:\Users\Admin\AppData\Local\Temp\Rar$EXb2372.33350\MrsMajor 3.0.exe
  "C:\Users\Admin\AppData\Local\Temp\Rar$EXb2372.33350\MrsMajor 3.0.exe"
  2⤵
  - Executes dropped EXE
  PID:2696
- - C:\Windows\system32\wscript.exe
    "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\D11E.tmp\D11F.tmp\D120.vbs //Nologo
    3⤵
    - UAC bypass
    - System policy modification
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\D11E.tmp\eulascr.exe
      "C:\Users\Admin\AppData\Local\Temp\D11E.tmp\eulascr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:688

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\BossDaMajor.7z"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1940
- C:\Users\Admin\AppData\Local\Temp\Rar$EXb1940.40274\BossDaMajor.exe
  "C:\Users\Admin\AppData\Local\Temp\Rar$EXb1940.40274\BossDaMajor.exe"
  2⤵
  - Executes dropped EXE
  PID:2880
- - C:\Windows\System32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\D80E.tmp\D81F.vbs
    3⤵
    - Drops file in Program Files directory
    PID:3764
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:1284
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Program files\mrsmajor\mrsmajorlauncher.vbs" RunAsAdministrator
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Disables RegEdit via registry modification
      Modifies system executable filetype association
      Modifies Control Panel
      Modifies registry class
      System policy modification
      PID:3296
    - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" "C:\Program Files\mrsmajor\def_resource\f11.mp4"
        5⤵
        
        PID:2336
      - C:\Program Files (x86)\Windows Media Player\setup_wm.exe
        
        "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" "C:\Program Files\mrsmajor\def_resource\f11.mp4"
        6⤵
        
        PID:3160
      - C:\Windows\SysWOW64\unregmp2.exe
        
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        6⤵
        
        PID:2916
        
        C:\Windows\System32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        7⤵
        Enumerates connected drives
        
        PID:4708
    - - C:\Windows\System32\shutdown.exe
        
        "C:\Windows\System32\shutdown.exe" -r -t 03
        5⤵
        
        PID:4812

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad6055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\Default.SFX

Filesize
128KB

MD5
ceb0f674352094da77a57315cb3a2c54

SHA1
e505810e17b83820d6fab8f4cf912b746a6d168c

SHA256
bdc20ed25fcaab9559d12072032fcb1f692cf079b753df5455a667ee17d8d088

SHA512
81112c736960c6e180a2e0ecf03b3d76e62ad27aad02e141cbd213761c968672037a1515a994f5b37d468531ac8188173453467d102a8aca49e4c29b26dd1e44

Download Submit
C:\Program Files\WinRAR\Default64.SFX

Filesize
64KB

MD5
46319d9842922c4f17abf74f8c26fe80

SHA1
e0a1275ebbedc53509b9b5184d4b4945d134b929

SHA256
612a527655beee3de6d335668472bb518e688aeacf1659ff21905401f89309a8

SHA512
db5191619b63ee2ebf9a4daeb6376fd84bf897eabe85420c772411e1958c1554764d5c1a6bd1eb7a8ec2329a69709a1e7721e7b7c455f55fd9b853a14890a0f4

Download Submit
C:\Program Files\WinRAR\Rar.txt

Filesize
109KB

MD5
18eeb70635ccbe518da5598ff203db53

SHA1
f0be58b64f84eac86b5e05685e55ebaef380b538

SHA256
27b85e1a4ff7df5235d05b41f9d60d054516b16779803d8649a86a1e815b105b

SHA512
0b2a295b069722d75a15369b15bb88f13fbda56269d2db92c612b19578fc8dadf4f142ebb7ee94a83f87b2ddd6b715972df88b6bb0281853d40b1ce61957d3bd

Download Submit
C:\Program Files\WinRAR\RarExt.dll

Filesize
664KB

MD5
608f972a89e2d43b4c55e4e72483cfd5

SHA1
1b58762a3ae9ba9647d879819d1364e787cb3730

SHA256
dd989631b1b4f5450766ad42aec9a0e16718a0d23bc694fa238a4d54b02be417

SHA512
3c410d19aaa780e4fe25b331f85bdd8ccd0a9f585d538afdf216dfcd5c3a6ee911924bcca9078af689c4610f23a31e5a89c7c84144356e8dedceac7fb020960a

Download Submit
C:\Program Files\WinRAR\RarExt32.dll

Filesize
572KB

MD5
b3e02a550a85e7d1348736a49efa4fdd

SHA1
e0fcca8e5ad25bab458d6ade20fe96a6f3d0c696

SHA256
37bcbcfde4016ae378b07a8cdb2ad3869724d6b91fdde899ed2eaabf0de645a5

SHA512
6aab0178029b5bce6bc8e8980cd84ae7d5053467310f3c68b45052c6dcab711146f58295a4ee7496b02d36d0d16446ca13ec91914d2d139aad4a39fd884ff206

Download Submit
C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png

Filesize
4KB

MD5
ec177cbe676473543e8c9b5d9fb0b797

SHA1
0d1bb7649d090831d2ab1f2fb44f580e0d4004d3

SHA256
5e3c8bbcd81cd0c08819edcbe04772dbd157f79373a0171b7bd914cf7a2cdef9

SHA512
925a86b5be1c9fe91cc587b71a3e0d2fbf8eddef06093a8356bffa955b63c296a041729db38a9538dfc811b723e0aca4b7a183ab0e9d12d0a302d1239db12374

Download Submit
C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png

Filesize
6KB

MD5
248fa2b659874a14b43b5e0e17ac1cff

SHA1
b6b0671e015104ee7f4bac4e6abf961ec55fdb12

SHA256
ed99246ebc6fad80103f1e887dd8388f67eb509fcbba187aaa13556b8d884ab2

SHA512
1a8e9f0c13d565cdae77cc17942792e33861f056f73422eb2df79fba5dc241a37106c0bf7173f9ba83f517e2016e9d3b8e117df2bd2d5972155781dbf147f90a

Download Submit
C:\Program Files\WinRAR\Resources.pri

Filesize
1KB

MD5
43cb15c1f1cc705305aeba33b0a9ee73

SHA1
52b4cbf1c3ed4494837f54eafa3e7294ba8e5485

SHA256
a7bb097441d9f06dd7a8d08874d70e7495626760c05284ca1ae3a208c11b52f0

SHA512
179dda1518aec276ae01bd7966272bbd545072077b34fb07396ec47c5b11adbddd00ab385d4ee2131a3c1c5265857434a51be4f33ac7ccd8c4e4b4dfda8d9c6f

Download Submit
C:\Program Files\WinRAR\Uninstall.exe

Filesize
437KB

MD5
36297a3a577f3dcc095c11e5d76ede24

SHA1
ace587f83fb852d3cc9509386d7682f11235b797

SHA256
f7070f4bb071cd497bf3067291657a9a23aab1ca9d0ab3f94721ef13139ce11b

SHA512
f7a3937f9ffb5ebaac95bddc4163436decdd6512f33675e3709227a1a7762588a071143140ed6bb2a143b006931e5c8b49486647800f0de2e5c355e480f57631

Download Submit
C:\Program Files\WinRAR\Uninstall.exe

Filesize
437KB

MD5
36297a3a577f3dcc095c11e5d76ede24

SHA1
ace587f83fb852d3cc9509386d7682f11235b797

SHA256
f7070f4bb071cd497bf3067291657a9a23aab1ca9d0ab3f94721ef13139ce11b

SHA512
f7a3937f9ffb5ebaac95bddc4163436decdd6512f33675e3709227a1a7762588a071143140ed6bb2a143b006931e5c8b49486647800f0de2e5c355e480f57631

Download Submit
C:\Program Files\WinRAR\Uninstall.exe

Filesize
437KB

MD5
36297a3a577f3dcc095c11e5d76ede24

SHA1
ace587f83fb852d3cc9509386d7682f11235b797

SHA256
f7070f4bb071cd497bf3067291657a9a23aab1ca9d0ab3f94721ef13139ce11b

SHA512
f7a3937f9ffb5ebaac95bddc4163436decdd6512f33675e3709227a1a7762588a071143140ed6bb2a143b006931e5c8b49486647800f0de2e5c355e480f57631

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

Filesize
103KB

MD5
eaeee5f6ee0a3f0fe6f471a75aca13b8

SHA1
58cd77ef76371e349e4bf9891d98120074bd850c

SHA256
f723976575d08f1001b564532b0a849888135059e7c9343c453eead387d7ae4c

SHA512
3fc5994eefce000722679cf03b3e8f6d4a5e5ebfd9d0cc8f362e98b929d1c71e35313a183bfe3ab5adbd9ce52188ade167b8695a58ebd6476189b41627512604

Download Submit
C:\Program Files\WinRAR\WinRAR.chm

Filesize
317KB

MD5
11d4425b6fc8eb1a37066220cac1887a

SHA1
7d1ee2a5594073f906d49b61431267d29d41300e

SHA256
326d091a39ced3317d9665ed647686462203b42f23b787a3ed4b4ad3e028cc1e

SHA512
236f7b514560d01656ffdee317d39e58a29f260acfd62f6b6659e7e2f2fca2ac8e6becac5067bab5a6ceaeaece6f942633548baeae26655d04ac3143a752be98

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.5MB

MD5
04fbad3541e29251a425003b772726e1

SHA1
f6916b7b7a42d1de8ef5fa16e16409e6d55ace97

SHA256
0244b889e1928a51b8552ab394f28b6419c00542a1bbc2366e661526790ec0a7

SHA512
3e85cf46dd5a7cadc300488e6dadea7f271404fb571e46f07698b3e4eaac6225f52823371d33d41b6bbd7e6668cd60f29a13e6c94b9e9cb7e66090af6383d8b2

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.5MB

MD5
04fbad3541e29251a425003b772726e1

SHA1
f6916b7b7a42d1de8ef5fa16e16409e6d55ace97

SHA256
0244b889e1928a51b8552ab394f28b6419c00542a1bbc2366e661526790ec0a7

SHA512
3e85cf46dd5a7cadc300488e6dadea7f271404fb571e46f07698b3e4eaac6225f52823371d33d41b6bbd7e6668cd60f29a13e6c94b9e9cb7e66090af6383d8b2

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.5MB

MD5
04fbad3541e29251a425003b772726e1

SHA1
f6916b7b7a42d1de8ef5fa16e16409e6d55ace97

SHA256
0244b889e1928a51b8552ab394f28b6419c00542a1bbc2366e661526790ec0a7

SHA512
3e85cf46dd5a7cadc300488e6dadea7f271404fb571e46f07698b3e4eaac6225f52823371d33d41b6bbd7e6668cd60f29a13e6c94b9e9cb7e66090af6383d8b2

Download Submit
C:\Program Files\WinRAR\Zip64.SFX

Filesize
128KB

MD5
d79151327fa238dd5d0a5806fc7b2331

SHA1
ac18d757b94d1c499699387fe1d5a255e2a37e86

SHA256
25c40b407fe23910b543d89e4a91c25abf0860f0ecbd2d74c09e18e62384d6b0

SHA512
682dc69f18a475352a1b8e1e19af82a1f84d7f14e2b05d5a129ec7304221a71f11efc47a1350abbec74a3c6876ac5bc848fa295da5631644439181411efbc3ff

Download Submit
C:\Program Files\WinRAR\uninstall.exe

Filesize
437KB

MD5
36297a3a577f3dcc095c11e5d76ede24

SHA1
ace587f83fb852d3cc9509386d7682f11235b797

SHA256
f7070f4bb071cd497bf3067291657a9a23aab1ca9d0ab3f94721ef13139ce11b

SHA512
f7a3937f9ffb5ebaac95bddc4163436decdd6512f33675e3709227a1a7762588a071143140ed6bb2a143b006931e5c8b49486647800f0de2e5c355e480f57631

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
c6ca9a511f929af5c4ecfa15a71fe2c3

SHA1
bc032dd6fa30a922ac19dcd2e2b1df2d44b329c8

SHA256
6d9109d48cf6fd4960c85f61dff77bd1a92b0b899c0d702452aa6a509a77bedb

SHA512
d25c503b796f8b8a453d44e9ae3082c6de6944eb2342c95b4ebb9172b8d9eff4c5d21f602c2cfd58c4599461940a8d5631ffd2c803ddbdc1e2c5ea15263cef31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
d9a18af284e5aeea76897746f4a941c3

SHA1
64ffc9f817cdfb170a3130fb7f2b6a91db7fd006

SHA256
13ad9817fae528f782c0e0f189d9f668ae10ba33898e039ff9805f8dbd2c9456

SHA512
e709279cdb7fcf995cbb5ad20d1bc0b3ed222ad308bd6f80b31a526b33edefa59ca581cb355d0bfa2e6201c8e84a70932141d355f3c7b07233d80d33508df962

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2342b3b290b5a884c0286d8d1ad7ff8e

SHA1
b97395e865a8d07efcd1c5901c2727e9a52304a8

SHA256
619d6a705214c8e1a8fee3f4087aa8eb92478da3aad2533c3750cc5772a19bed

SHA512
4f216d1445ab6116e0b4f3e835c00eb8b7a3b9020430be41338becc2ac0d019bd2de746aa0e8f47f536b974235e43f749c27cedc6cebcd89763e16cc85cd73b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
abc0a32cbe3458a379f26d710ffb27a2

SHA1
de2487aa716489cce16801066ceb79b59bad133f

SHA256
89bcf6ddbf98579f6b7908e69ba22f27cf2e8430d4a322bbb914878c1f016209

SHA512
6b9cea3db7f475c045b775f74a1ca132ecd40145d1dbba81fa10f109bb16f2e9c7a95e6e9f37be6323c8ec8b7133b236365db2e7ff4f86f31658c6ff0373c22c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
30bf01c99df177cfdf6784c443af75b1

SHA1
9f34810c328a723ec7ffefe7bacbb404505ea8c4

SHA256
187b0367c9ee150adbbdadc2bfb00e4572429a30e7787f6bc860cf44ad6dd6e6

SHA512
cd9a420664dfc69227e4b87875345a36428dc9d9f69d49a918cd90794f12d71d434b5511d799e978faebe97e5481f49f957ea5c3f0f601700376f232eb6f6a62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
a8b96a93f68bf50f5a30a5f885c96314

SHA1
a715f4a7fd270c445ffcb476712d9757d9e4a3fe

SHA256
5475d3fede537cfd81dff40dceb8d3a11ac7837d047bd0826b17828bdb8945e7

SHA512
f4a4229d9acb0b9bb54bc9e9883d6a8595c7689ec5e46f6a0aa4eb391c2dd28e19edb8d923144697b65cdc55e65e022bf857bca7f0c929694229db7b01de34e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1fade6552bdf72a1e2a85c6b54aaf73a

SHA1
3b93134dcfd10673431ac629e5379fd0a9fd77c0

SHA256
c858254844965747adad7e5c7c35a48206535c7e7cc3b188b46139f469274226

SHA512
df97bc10a04c4ebd305b7d54017c329369c86f09c067e1fc59fa4ee29469c2467148a60bfca9b723ccf68dc025a3edf3b3b796d89043e10bb7fa2efb6fcb9672

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2a68da021d25c98be81d36f16a5f78a9

SHA1
52960bc7f08126230e279804189ed2dc9ce2b8ce

SHA256
c34a84d3836f410a19b511c5a311586a096d719c1492cd248cdc842f2eec7084

SHA512
8bc31851bcbc39f6aa6decc42659223ead166b854cd59f97fe4cee66d69b48efbb1246c11de7b7f9d339d726a99fd11194e83fcac6b473bd52b363011dba866a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
184c56f78bfc492368a74ffbcf20e800

SHA1
d6a39670f405225bd13143ca13d9bd11bec93764

SHA256
b21568ac4a6598ec5ad94f34788324af0dc6a3c65cd66430c00066aba2de0705

SHA512
4a04ccdd4ac8dbe4a17223c56b11bb95610c9a12d2e39f2f702b7c4c990dbfd5783d6adf8862ecf6ec729df304eed2d5b042cdc5bebb9fbda2e6cd5e904950d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2d659025a4ed2bec2100758a1be2716c

SHA1
83f7cf7f3cec2237122306b90072a7b999a34f72

SHA256
a1f544dc5d2ee788a088f9925662329d109c1f35d692e0683b85d8fe860dfa75

SHA512
6fc31c7ca6d0232d1cb1d3db67f8443afdf6766516adaba80ce04d462c4099e36ca2a46987375cdb9c816a8082a6e0cb2ef7a7ef092c2f22d35da0a113274bee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
0aef5507d44ac86b533f6367be2ed5ae

SHA1
9d9f70773f6fbe19e16758120267648a942e21c6

SHA256
be4604376cd02f04ee24506db90599bad3e2d88ebc93bd712018da4bd63e5a8c

SHA512
8d6fb3ed2e269efc9d710f10bb4bd2b9bd82428346657acfafe50d8411ac59b7024a1317c065257f423e8eea158292da53aa951186913f9b45b73941b71c14f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
161KB

MD5
b9fa8a3b2bf388b8dcee09a8ed2af6ae

SHA1
ea352cbcca1a468b4295d0f2e99aa48c685de5f3

SHA256
5f058a2fa5429d284c6c3a9fc50982b4dfcfb009f13204e58542c14c5bc86ea1

SHA512
26a33ddd10ed532cff7014d8ad4c138aa38b38e43ea01f7ad725644422396cd44d7c9a0e0ecdb6313ab1ef3569a4d54bc9bcfb7154f046a9bd12244a3f7c08fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
161KB

MD5
f2a57479cfece8c6078527092d216622

SHA1
3b274407e88ad24491298df43f53f806720b764e

SHA256
54f9fa3c39623023ab80b8f2eb190682dfa17d4d6a7922f2d1ccda901bad7190

SHA512
2ec259fa3f6b2006115ced43eef8a67292e72a138f3329bfe8fcc45129aa2db9a0856e4fdce6c8c3645f5ee0c36df413ce43f20b22dcb27909ad297460fafaff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
161KB

MD5
64bc635acac2c28c2eac9d0e87c7446d

SHA1
6939d9b4fa08f48127531e8a2aac77fa28985eb6

SHA256
dc48718ba05a2eb913b699e4a1d30248d57d4c601275bf372148d468b519a45e

SHA512
88cfd439329c8cde87dba8f9aeff16340d185c046a8522782bddbb39d9c4735d5ea68ee55e9c3742b1631191abd8c74362f9a1d653fb6f6f1c10c1b53c9821ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
111KB

MD5
49ffe00f8c41e8b9f6745ce4ee46af37

SHA1
14b307f51c9410de248213a093d03195ada91951

SHA256
558f754e77b4bef6153680793deae7869fd7c23ccce8e176387cfe0c74d2c70c

SHA512
37de56657e84da023a842e80eace6329e1ded5890f13cdcba1c5a8afd4cd6be8ab1f31266c1b613d2a26036925aeb2dabced9ee2fcfdbc42e74a7a44d7b86ada

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
99KB

MD5
41a8424ecb4009aa48ca676d7a93d485

SHA1
cf476c292eb5c1260a02bd4cb626f5af0e51b9a8

SHA256
f39f668c6180f3a3062d3ca7576f64d64aeb3c17f700f24e71744477774a39df

SHA512
a165a0371e6aa897feab4767c89da9f5a18d37287d33abe4cf58791b7a4013159d0bcd3b7d39d84e280775da78cc05d37a5fffc015bf134ad80e75d69ab1b216

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe56f169.TMP

Filesize
93KB

MD5
b8c4c00b33027b39edfda6dc92786748

SHA1
cb05e8238d465e63be4bdd2fb6110439327a0760

SHA256
714fcd94d8bfbaa53bb86b4724e07ddc1c6812ec770297e514bc7821dae33a49

SHA512
f9894e24a32c7da116534a839ec2cf8552a6f2321eb07863ec5f4fb735fd6787c289de8b63db38736d55b14721e340b578230d4ac1c2a2a3ceb85d2d31a9c280

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
98df921f667bf303621c789390ed9f2e

SHA1
d9c82e51534cf1c2eb5a255286de6a09ca364d1a

SHA256
8b8497d37fa9ddd44e275aa7631d7c7173c384a501d11e73e3d4401513c4bbe3

SHA512
58e896295763c2729c5a19986356e7cc7706265bbda5cd9cec98201ec9ce86c4b68a3e388c86aba198870ca4b8ab1a7876f2d8e1fff7437216dd2789b3ed3796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
ebdf341cf5f82c8b406dc0142e1f322d

SHA1
499efe6085b50bf98b4875bb082ae55be4695346

SHA256
b1ae2cf2e8640726eb2186bb2794c92dab61f775195636ef010d3a29ff0ebc8a

SHA512
2ad606a0f887d526cc716c44520c14dacd625b11ce10d6001778318d591fc7e0dc0ec47b51c831766b20ce579824a5bad933b71fb0c52dedd503b3fd17cc086a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\activity-stream.discovery_stream.json.tmp

Filesize
147KB

MD5
8a7228d271c2b3e2472f88b2634c0980

SHA1
2af34f71ad688af6806b1e80bcfacc97903e7216

SHA256
57a1164c7a8c871db8c988fd969e738ac20566d0bae183f98d5289856f000108

SHA512
2f9da1ef91c00fb187367f84df2e77458f8834c9f5dee92427bc3f90ffd51d237bdd88a09b2994a60090d53d75c712958b836186470d8af18efe90397c81e71b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\doomed\10516

Filesize
16KB

MD5
de4f80323cb7dc32cd59af340f00a25e

SHA1
f45dcd67408c1a9fb92ee29e7a95dc0a67385917

SHA256
fbc61c8e86baaf6a759b75e022e952b81779d6a62969cf0bed6c0c2b92c0ed34

SHA512
fe78460973660d8a719b75c2420a9f04b89b2a0772b9594e12585b037e5bc9de09dd185fd55a338b25c1e4ed57be05ede276ab193bddd11af3cf211c95cc9dab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\doomed\10717

Filesize
15KB

MD5
0c2fbe0f40392a936d0459c9c470243c

SHA1
b9302cdfcdef3bf7129f09ff3125698b57573109

SHA256
fa11cdd88a2e8dab2add336201350e36fa0bf922a8c7ef85d2e87ebe04c952f1

SHA512
5dba242e8a1b776ee8cba42a0dab8b9e11a8f1fecc7338cc6af027d210894acccf21d63baa0b8976e94036c9d173f135401386359d646e52be57fa1f4f369687

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\doomed\19803

Filesize
9KB

MD5
243e7312be156e3ae89a5d60105f3ead

SHA1
fd26c2398c99843954aa1e7d44e47c741b438c69

SHA256
8b376d7b1e3b7f178c88e61e2f72a0a9106d4b4b007f3e3aa5ae67921bffa1d2

SHA512
a438cae0d471701973ef3610ff7ecd04bd5cc5559fff7ca22a64c8463588a2b20c379a149a64ddb86077c61ad07d0339f4e071856e0e2a281907d729fac2cd74

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\doomed\4869

Filesize
16KB

MD5
d32af9a20c115078642b2f63a0f72280

SHA1
44491b14c43b203a2dbc6241c6a1abd7fd2a770d

SHA256
d0b6ae7af126c41d83e6c4501f6e4541a9b55dcb379e8b3ab8ec8f53c1d0459c

SHA512
8cea76a447bb99ab2c388f30bae5f851906c76a9174ca4b19f993aa405784da8a79874affda11bb9ef2a037086a2a45442691455205201440f2cdb7bbda95c5c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\doomed\8380

Filesize
14KB

MD5
e1c1a6c9ad06dcf1fedbd25bb5c58c1f

SHA1
0cc32c3c65e5c80ff36080bd9806fc63e1ef828c

SHA256
7160a7ab9c76351f05c665012cb2b9f96bc53a6849bffdded6ee911b1bf8522c

SHA512
dbd5358fdf3368d24aa37a209f2f8dd72b089d8291d47b0467e5d1058e0f851f35f84b121c46367e7d3847c2f15f7f7b9e49b4f6e29d79cbc6755b33cd84da6f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\3144C63326074BA16816636045F137CF28BE23A6

Filesize
41KB

MD5
f0c59d3076c60672be0e04e37fe31040

SHA1
1cf4ab660589fffe001effb6fc17abaedb2b5480

SHA256
78f9692c9d8239ebba8a99a7e4fbcc6b88e4e5ebbf8449e6841aac09fda69850

SHA512
812159ccf7eb058e0659080812374161300aec3324bb1582e8421b3c6e9cd73c66c68850f3bcaa71e1e6c5c8a8023b402c99c12753c2c9b15ec3285c202c2f23

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\45B175656F39A9D2B3837ACAF71417318FE35B7F

Filesize
74KB

MD5
e6b15d987540f6e23e8114803ff3c763

SHA1
1e3c45006772d3bd89e2d79d1ecaf5a4c9921d5b

SHA256
3d776b0cb00cb7909f2953c53df6b796320a0290e4184e6355f9e8485c054d3c

SHA512
f23a41b36a7e1ae5c06990eddb909fdd92933a9d1599db19f66243cd12f178a85f832e4812e2d75774a9f828a75a0f2a38a6d52d9901e2e8fdff861d5e6440f2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\45C9C81D1849496E04A27F36F21E22B18F92F0E5

Filesize
757KB

MD5
53ff0fa912d396cf48b6413c7cd6f389

SHA1
58be23ffb16d86e1a456dc3d2637d8fb43ac821b

SHA256
a2bf2ea48c08aa4111bb3f731a9a77ad642b494e762ba9bc1948a71314723588

SHA512
47111e042738cfe7aa6de6bf7c70d26f4f7c0de1bff11625f11c7939f5901856ab9a9461ec45b4b2f03dd0df3abf54866b16f071c78b3f4a771e819e3e873bf8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\4885A1AF3D9711FDB8E283622A73B8DBC019221F

Filesize
175KB

MD5
f3ce69520779cc7ef2b9db69d6eccbf2

SHA1
6dcecf6c10805d3dd94d064d2e89e5df5a56c820

SHA256
8987c85b06c31e08fda83accb7675ec5857a6915442f3467934d3d0f06ca8c4a

SHA512
59416557945124bab2ca6c959f53627a451c61da80ff633b39fb02e0413f99469c9fbc632a5c9fc0221d7d3eebc19b61e8442f7f9ce4af2b45c4beeb0aca545d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\48C3C6C6A6714D0A52853598C8E686C450E7377E

Filesize
95KB

MD5
75fc5d9310a4e2975ac07e2a62303e5e

SHA1
d409d2260333ac8ed93a40e7f6e3fc3f53f96418

SHA256
cf01d906956765932b702f16f8826aede82575252d095e86a93b0965db493b12

SHA512
57d075ab8f467a17866d67133ade2bab3c968bb086600286542039e70228c06c450e3f6080e9869f5a70bd536b371f5e7795674dc3ecef4de17e5d8466f9d5b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\54CB5BD3DA9D54437AB17ACA5AD2A8CDAEE4959B

Filesize
125KB

MD5
4bf81665d7fb790a948c5b8812ec31e1

SHA1
dc529a0a7dc03dc0da470073d7c8be61d22d6f78

SHA256
889e19f8a2236b3b3e59244d65a94ef21bcc999f6c660e6f77621498aeccf964

SHA512
958d1db5f2b006e25bd4539bc66b8519d82a6bf375c78e28e1104367b97fc99f7f46d77a4c3ae30efa4e0d282a832c76c631f282ab14d19b16bbaaa97d665ceb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\83694C4B0C983BDAFFBCCD945F9254E4CA2AF6FA

Filesize
47KB

MD5
74d1bc4e14692859ca6e984e536e955a

SHA1
ca9457ffa6f5ea29d92d59dc6828cd3b2188564f

SHA256
67ef110a35e64f489d0a5bd6ad26f3c48c0dcf56dc8ce08734caeadbd195cdf7

SHA512
691b18fc8b2c939da50b4f65f6a2eb3eb3e2a55e5eca9f9edc71112c46b2201163467aed151e165f0ddbbf371f67f4514f2fb55e3c0720129d622725359a9e78

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\A752BE816C32A166B4212612D41570FEFDA0B4E8

Filesize
24KB

MD5
9b0df2e9990cbb5a9082ea52e03f07a3

SHA1
cc2223c2f56831fd31b94ef5fa9d03c2d562598a

SHA256
b9937926d65da42bfc20927b5bdb7c034beafe1cb04ff907dbd858f3d0767cbf

SHA512
601e5b4ca7141a6b06bda6c405ac892539d9cfedf1aaf472a5a84294e31fffe6cc2deffa6320664943efb8d9aa8c3796d8cac15a51fb0f5e3f02922f46ef3c64

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\DB7A07839D5BECB555910B0D8184748FEE6FC367

Filesize
4.8MB

MD5
822d3f2c457e9d0254ab0324698d19ea

SHA1
0cbfbecf9cf9f7185980db4879a99bff19da68d3

SHA256
dfaf82b1a8e52b2f7d8428b49b099737242e9faced637c15d827b33a091f4836

SHA512
152d2e8352345fba10cc95ec865bfcf9e459f3aadfbd213f9004e9f78b18b49edb0804672ba8b987b5aa84b2c90bf2e1685b1104c6fca12800ea087b4aed11a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\entries\F96A1A8368D3C3DD1FA81D170326E6C1C65D342F

Filesize
30KB

MD5
b02f591acf2bc064d2d968906fb8b553

SHA1
31d4e14b0a4b3f2a05ea71da059c231edd740ed9

SHA256
bad52a72a8ac7c7a001a60fd126ebb774326d6a8f3a1b1cb0a923559d79d86bd

SHA512
d85207ab25753f394654253aab1607ed45e3af146667c41e3fa30fc848b3a2b3f4004394a08401a6ef0eb2126ff9fb72152b6d5c54de6da7926fac81f6414873

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\jumpListCache\87ADAZkDs6s_83vMB_Txkw==.ico

Filesize
691B

MD5
42ed60b3ba4df36716ca7633794b1735

SHA1
c33aa40eed3608369e964e22c935d640e38aa768

SHA256
6574e6e55f56eca704a090bf08d0d4175a93a5353ea08f8722f7c985a39a52c8

SHA512
4247460a97a43ce20d536fdd11d534b450b075c3c28cd69fc00c48bdf7de1507edb99bef811d4c61bed10f64e4c788ee4bdc58c7c72d3bd160b9b4bd696e3013

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll

Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$DIa1916.11432\eicar.com

Filesize
68B

MD5
44d88612fea8a8f36de82e1278abb02f

SHA1
3395856ce81f2b7382dee72602f798b642f14140

SHA256
275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f

SHA512
cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXb3132.36994\MrsMajor 3.0.exe

Filesize
381KB

MD5
35a27d088cd5be278629fae37d464182

SHA1
d5a291fadead1f2a0cf35082012fe6f4bf22a3ab

SHA256
4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

SHA512
eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp02750.WMC\allservices.xml

Filesize
546B

MD5
df03e65b8e082f24dab09c57bc9c6241

SHA1
6b0dacbf38744c9a381830e6a5dc4c71bd7cedbf

SHA256
155b9c588061c71832af329fafa5678835d9153b8fbb7592195ae953d0c455ba

SHA512
ef1cc8d27fbc5da5daab854c933d3914b84ee539d4d2f0126dc1a04a830c5599e39a923c80257653638b1b99b0073a7174cc164be5887181730883c752ba2f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp04156.WMC\serviceinfo.xml

Filesize
523B

MD5
d58da90d6dc51f97cb84dfbffe2b2300

SHA1
5f86b06b992a3146cb698a99932ead57a5ec4666

SHA256
93acdb79543d9248ca3fca661f3ac287e6004e4b3dafd79d4c4070794ffbf2ad

SHA512
7f1e95e5aa4c8a0e4c967135c78f22f4505f2a48bbc619924d0096bf4a94d469389b9e8488c12edacfba819517b8376546687d1145660ad1f49d8c20a744e636

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
13KB

MD5
ab1fa07d1b66ed96b78e87d08b93cfbf

SHA1
973e38d459fd888f571def4082e3809da7384804

SHA256
edffaf8d2057bd51ae8bcdb4cc93e97a90ca7c28a21a102ed4c81371c6f78475

SHA512
7955e1ca91b34449fb9e74a9aa3dcc8c2c4bc41f39597254bbc7ea17533cea459300f0774098c891550a59d2293047cdb1e67191eaee1ae8cbd4935c1f87d20a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\prefs-1.js

Filesize
6KB

MD5
f0caead3e377c291773b44876d0c31cc

SHA1
055fcd5f77551f83a9f1030733c8dde3e4277ee7

SHA256
fa30ef819b45e72698ac554f27175a4f579a2f7040c91b5af10e2523ce48945e

SHA512
ae96a7a3421d68f95ae9df6fe2a316c25644a2ba38b8069c4125fd9ddc837d04b13a68176e05f3e6dff80ce63cfd9d49d04f6cd178d40cef41570dd86bcf63ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\prefs-1.js

Filesize
7KB

MD5
23470787ea6c176459144c937ea7a0e1

SHA1
40447fc95921e98f99af93fefb8fb033a27e488a

SHA256
79ffbc209f7ffc2ae9cc0a1af59cb0130eb4509060ab43824b8086743dd42f14

SHA512
e5d0cdb1af0b1094ab357f7a69fdbbe72cb9c0f7655c7d032161fa1c756928da80dff33d84b92867cf25d90c2f93e4b8d9c1cdd21240ab67d63ed4cf5ec39774

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\prefs-1.js

Filesize
6KB

MD5
9cb8119e403f9f96658db142ffeb8561

SHA1
2111bfbc66ae7decbc45b87b98cb81ed6bea10e6

SHA256
e34047cfd30a5315e4139e87fbde16b312927df87c804a5f23523a91701e55f5

SHA512
189ffcba5b23859f16054a058567bc5fbbe0bacd589c14ee7dd810ee60ab51a2dc4d18658464cb6b13c4891e9992d9554e76d14178f91175c58093de2b752493

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\prefs.js

Filesize
6KB

MD5
cdb5a91b7898f75f98e448e80b41dba6

SHA1
c749651f98e32a2320d2e52fd467fd6217660535

SHA256
ed56bd19352777293cf7195af0fe1412d52e25af6a9a8e2bb04e3e32056556dc

SHA512
b99bca03a398f7e068691852106fe03a90489d1e8230720749c25703e59874765ef706e9e27c9215251372efee84d9c9d0eb636a54e45035d5d2095304fee97b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
ab355620512cc1ef202af43c545fb5c8

SHA1
24cf6e0a2fcc510dd03c704cd69da5e2c895bf29

SHA256
d161ec527337594ca595b296b3ee3add7a4da82682a4b6f12d49ffecf0c69d05

SHA512
791e0f537db46319fbb1ac9e3bb0ef81509cd98d5504dab52082d0bd393461abddbef40359738cc68977b67b330e59a8beeed364ff2a4bd2c418653ec40d683c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
5bbd8c0af8f10efae7ed867bfdb27fc0

SHA1
8d24d236556e546263f4b33b8d588b15cf3b3f5c

SHA256
f4683fb276dcc9fa0e0d66bb7f3df4e4f91e2ffabf2174e623a8c97d436d85f7

SHA512
af4e156b9eb43803cab7ac41e2593d18328aa074a8b31927dfde34bab12d2c80a1a651d7a862f623d9fdfc9f2967380bfc134d316b02bb25f2625e79664ce196

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
20KB

MD5
c80eba811f3649d32d8300b44d02d714

SHA1
cac8fa2811a96b8d69cdc37569f0f5269210867f

SHA256
fc59bcb6e15cacca0c4d70ac74d90c8c302215aa1be1ed70d799e4cdbdd901cd

SHA512
942a0c19b43874e62f7f49ab25b8e11b67a4547cf1ed1daafab70c4b6537bf4830f7627218b135870ddcb213aba2234feb20d28f8e3eab28c98d1a03ad3cc226

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
d7a05bde0ec398ecfd0905faacc33334

SHA1
ddb93a80f19d2525562024048072ad2852551687

SHA256
563ac9af95fedab12d9e326a6d4b6a85b91780a7871631fba612533928527d8c

SHA512
0439596efa2e0e9c02f10da29f7d61905233bcac1d7593e14ef4bb3fb2557246639d3521b9164029dda85404c3ce69feb9fb36cbe495dcd044f2a704f87f2ca4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
37KB

MD5
d0abe2f3622759d7d143941488dfc792

SHA1
5756151568764f4b0760fc86d8b753e830a76ca4

SHA256
4b8c3f77f1dda17899e66fc38f961cbc73cfc3d55f6e75afd3c824776863e510

SHA512
e32b9bdc5343f379c5841ea69bd374e115a2af94b07d04b76360e1e181f5c9ddf3e865bb6c3a26e93ef265cf7c84bd746326a0cbd7f1f043ee2fcbce6ec0aab5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
33KB

MD5
2c25eb91e6188d83b0bdf14ba8fbc3c0

SHA1
3d501a0f58f6d4a67e819362f1854a1a48c6f943

SHA256
863efcd33c98fd729f1991fd3ccf950f7643ac5ca775f9840a510665e5c0bfe6

SHA512
ab3fee124ebc12c521315d07a62ef534330a8ce526e8cc765530a2d37429a4ec71f85bf172aaff3b58352b42b2ff9daa890ea7c5b30ff7ebf6ddd83f40c7f1f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
21f55dd4f127de5d73052fe9dceb10d4

SHA1
c1ab2a523acf6216d1ed83eb5ceb73514146b558

SHA256
dac925bf610435ff18f119d0110f686d99a439d7e0e1aba3a800adac41b7a0e0

SHA512
25f7938888695be5710ac413870ae5e4bddbe81fb53aaa24f95256294b9b7dfae812375ae9448402ed61dad0887c82da9aa801f756f0d12ce967fce12b94f229

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
36KB

MD5
d1ff9228fffadd6b3b795dbe4f4d60ec

SHA1
2eced0510000598f002cd73ba11a4bfba863d8b4

SHA256
e10820a60ed8b589b3b3f683d47699389fb54535d64968129811fd21e99654b4

SHA512
ca56c26fab57e89e87a9a203f4a50f7a2b39a534d47feb6ff1e719851133c4a5949189525d4340d10b1b8b07d9d1ec1ecf8069ac8c2f2112f1ebcb31c0dce1ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
430a8484e9461291c016bcd6e90ed392

SHA1
cb7329d3ebe8e000f57cc369266e5ab004701a28

SHA256
810ab6c9b18502e0cfc7f1b15254359538fca10a7fa12024d4f2ccc74513367a

SHA512
3bbb84c7a2f2912551f13a3839e9b272c90ecd6ac84b892a26a5ec335e436341aa940714d5d4ee85cf0ccf7b976141327ac5dcfce06122ee40e83fb2254c19c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
7bd380bb5fa31817300e46e605490bca

SHA1
3e5d0e62a87a1e4775c72b3efb94d4bae3596608

SHA256
ec5ce00a66c6b6eccaf27e7e0c368681593cf284ac5777b41b3996877123b127

SHA512
a882ad10d270f2f0947733cf3ba6b1167513633a3a61f0ccc06faa05d195b76baaad91f8ca814dee156918bae10ed2108ac2f70705c9eab7f87a4d03d6503a50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a9305156f04d2d41302c2f6b6799db7d

SHA1
844558bc1e84af6ff2320fddb0381407b10b4fb2

SHA256
18ee343f9a9070fd537e6ae5828f183dcf688da3b6a3718349dae12f78671f13

SHA512
fa9d7969b9c719df02855d17f3411302713278ee0254c3ed6fe9cfe098554f3203c4b2b65bcce86db4158dd4d130bbc5c9c0675422933d5034d9603c8926a0ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
4fe35cfb5cac6563f32f44d538402f64

SHA1
6219194bbd0556a3ad1724757124b97c6e2ffe65

SHA256
3b2e8a4b668ea93a9ef8a0d24a9c4a839536bea590020af0745b3b4e1a3d2eb7

SHA512
b22db39c78cf64bec082a7e89aa3117bf1d48f7b9256c22a2fced825c863e524901ca95758fbaf9ac4f6763112aed38711fa105755ffe114cf3c6e13c4351c71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
692c31683006463e643178883ac99784

SHA1
32e0c50b7614cdf7fcdf935e35c2b60e6b02d2c6

SHA256
2012740de22ed7026c7baf1e3cd02c2a06c8b88de45115fb2aeebd81c9140ad9

SHA512
ddeeabf09e36077e8b30ec0075a54be47a60127587001dcd70261a22dd6852b7fc981cb351c5c3bfca47cc98bb487a7e4effe96563967d4dfefb0dcc20101986

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
6af68ecc2eaae5ee80cea8ef47d68cbc

SHA1
022936b3f525acd095ecbaac7d3ca2e29e9ad30e

SHA256
0cfdcf4e9069aec023065f356b1754118ebfdf63cacb3505f6dd0eae38e9d1f1

SHA512
d28f57d80ea6a5d161eb81309b6a241f2938d76625ebd6b6c7da36c438438229cdf63cf3c165766bed03a83eae4a6cad163704077393e108033bb6b87ff4c89e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
f63a5e9294dbe66006720d960d2e4db8

SHA1
9738288a6e3980016777d37f9a09a7e5bb4bd198

SHA256
4cbb65847bc89a924ec99eeb0b4db0d6af1a6ad6be85ac69aacdf733a6fe7970

SHA512
bcfcbb4ca244d8399019ea3aca42d240806ec7d206ba5806951c8798ff7c1ae26fd37ad6d9f8eaacd41fe38c008fdd3adb0a0b1b3d7a2a81c3f16314fa449559

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
3136458286f5a2c5f3bfae08d48fcf8b

SHA1
93fb86e2a1d41779acf773a3570945108848b5e2

SHA256
fc45f9416e1cf3da6afc5589a48fb8909a21cd295671278c1e661be5adcf6212

SHA512
8939706aa9b6ac5422e3f5c00abf0346135ac983f972bdafc89bfabb5aa49ac3f30e7e431173b9464b3b7eaf6a8e0704d572bd7543197acf4d920b91be7fef99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
35KB

MD5
b228909f92ddb5e732da4d9e75046168

SHA1
c042e6679c46ae47d91650d444e729fc252636dc

SHA256
c10f84b9321f04e0fa3f2f0c255c1ab95cb40ce78ff0a9a2e3c11bbca3f6d205

SHA512
6b6e8ebd97e7b0a68667f9f50344ed940653cd1b45d2b3e40993c7f8382e5ce0d4d564af9115eac9c1fae6e9cca4c976f5c03867477cca413b3ab1ca228e04ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
37KB

MD5
cbbef9ba4b409c7aa72f2f3a2d306324

SHA1
d0a7f10dee120541bc05ef095756dccc5b176339

SHA256
5380ee8c360d8552fdd74a97564d90fdd3e847228e1cb0d080760cdc24c58fdd

SHA512
1b19a0746101fa649dd7e22956198b4afd38e703342e09d159c47991b1bc5c44641521d0e2a3e2fb38435963840b305fd8e46c20fbf860740e7558750b1e66b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore.jsonlz4

Filesize
36KB

MD5
05593cbc84d57fedcc90481286cf8ca5

SHA1
d23049082b3b69151249fec1dcad0f4cbb052b84

SHA256
5ff1a1660d65d42f1d381852a05f93a9bd9ba9dbe908b28982f3fd1245515fc7

SHA512
c56402944088425e437a2c51fae6102e5b3d3d01a6493c4710d94600ba6314d112e85b4ace48287ac51b47ca3b668ac43303e55de305826cb9d68ee3da9b5eb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
7d5a6c3f3eb8528b96d418104b11637b

SHA1
648f7cc215256d069ca665fec2029e62ea5ff3ca

SHA256
ce46af63e2f14497598e111c5c83320ba64c1263e47583368321cad31aaf9483

SHA512
88bc55842b1bbb407db1e2370dcf968566fcac1f9e81e7a0c90f4b3cdb5b5fc7fe70acce6caaa9c7d0ebc60e0655bc65bcf36b7af8938fac37679b509565843b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
f695e423b784532b4ba7a0e2558e1c56

SHA1
e087d669b2d0e6afd0ec00e6c889adc0f402278a

SHA256
07effd26cc830fe54def7954c90a5e3aca74728729cc97238e4a2cbcb4fb6cba

SHA512
6ae684343ec5ba20bd8e6f8509b7f95041ff16a275b23297cf9ad0320e6070acea2383a5e202c4a414d44daf67690b367eb70d4d14dbf5b12fd6e138ec3dbb19

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

Filesize
12B

MD5
a6a5739c250a935d6bce36d86be69056

SHA1
08ec94c9a35c0eae6b4fd3718b701a386ac9814a

SHA256
2304ae63ba1312a3be9e1d1d472dd238253cdb367f0fefc7519e85ef2a53ee13

SHA512
89aa5e751ca5bbb8a2efe4d10b6861dc93e295cd1f10db8e502e02ef013bd9fd94e6e65e07f7c70e95ca60923fe88242403853da3570a0653a34cd580033586b

Download Submit
C:\Users\Admin\Desktop\MRS MAJOR WANTS TO MEET YOU 5.txt

Filesize
27B

MD5
e20f623b1d5a781f86b51347260d68a5

SHA1
7e06a43ba81d27b017eb1d5dcc62124a9579f96e

SHA256
afeebe824fc4a955a673d3d8569a0b49dfbc43c6cc1d4e3d66d9855c28a7a179

SHA512
2e74cccdd158ce1ffde84573d43e44ec6e488d00282a661700906ba1966ad90968a16c405a9640b9d33db03b33753733c9b7078844b0f6ac3af3de0c3c044c0b

Download Submit
C:\Users\Admin\Downloads\BossDaMajor.nX90crCs.7z.part

Filesize
51KB

MD5
25b8ef396b37ecf751b19340d3e1cfed

SHA1
d93895a9dbac523c5566f095882a2d8f6e94cca9

SHA256
b229278906bca8faa5fd267579671e1ac5a4df5ceea73ffd1bde60d5a908dc4f

SHA512
0e6e1aa4e77920dc2d8d3a0c18f6b723f723c992a49ddfe89a6f21410e52ccf1fed05545f17e785f544236d4417a0dcc6b48d868f69a450d489410015dc1b94d

Download Submit
C:\Users\Admin\Downloads\MrsMajor 3.C8vV4G4O.0.7z.part

Filesize
234KB

MD5
fedb45ddbd72fc70a81c789763038d81

SHA1
f1ed20c626d0a7ca2808ed768e7d7b319bc4c84a

SHA256
eacd5ed86a8ddd368a1089c7b97b791258e3eeb89c76c6da829b58d469f654b2

SHA512
813c0367f3aeceea9be02ffad4bfa8092ea44b428e68db8f3f33e45e4e5e53599d985fa79a708679b6957cbd04d9b9d67b288137fa71ac5a59e917b8792c8298

Download Submit
C:\Users\Admin\Downloads\NRVP.exe

Filesize
8KB

MD5
4289384a6a0f6106ab457e8789f48098

SHA1
767c05eae651fb1966d9679b3ccbe82cfaf5c1c8

SHA256
b4ab3210236533130998c707ec5379176dc6bfe80709414916f3275adf577a52

SHA512
6403dfe0fbf42a048b407598688ec50834a84f7f1e5fe512fff1564368bf14d7c97607a41b6ec6eb4806e94a38d8a43348bd4ef1e08fb3791c430af261ef3b83

Download Submit
C:\Users\Admin\Downloads\VeQHYuxu.zip.part

Filesize
184B

MD5
6ce6f415d8475545be5ba114f208b0ff

SHA1
d27265074c9eac2e2122ed69294dbc4d7cce9141

SHA256
2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad

SHA512
d9305862fe0bf552718d19db43075d88cffd768974627db60fa1a90a8d45563e035a6449663b8f66aac53791d77f37dbb5035159aa08e69fc473972022f80010

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.exe

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.exe

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.exe

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.exe

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
memory/688-2149-0x000000001E160000-0x000000001E686000-memory.dmp

Filesize
5.1MB

Download
memory/688-2150-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/688-2148-0x000000001DA60000-0x000000001DC22000-memory.dmp

Filesize
1.8MB

Download
memory/688-2147-0x00007FF8463F0000-0x00007FF84651C000-memory.dmp

Filesize
1.2MB

Download
memory/688-2141-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/688-2140-0x0000000000990000-0x00000000009BA000-memory.dmp

Filesize
168KB

Download
memory/1376-2183-0x00000000015F0000-0x0000000001600000-memory.dmp

Filesize
64KB

Download
memory/1376-2184-0x00000000015F0000-0x0000000001600000-memory.dmp

Filesize
64KB

Download
memory/1376-2182-0x00000000015F0000-0x0000000001600000-memory.dmp

Filesize
64KB

Download
memory/1376-2180-0x00007FF8463F0000-0x00007FF84651C000-memory.dmp

Filesize
1.2MB

Download
memory/1376-2181-0x00000000015F0000-0x0000000001600000-memory.dmp

Filesize
64KB

Download
memory/4772-2114-0x00007FF715670000-0x00007FF71567C000-memory.dmp

Filesize
48KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads