d675201a8e9ad567887a2453e81738fff5126afc96da9e8aba16e0203c08ea52

Analysis

max time kernel
429s
max time network
433s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18-04-2024 19:20

Sharing

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-18T19:29:02Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win11-20240412-en/instance_6-dirty.qcow2\"}"

Report Analysis Logs

General

Target

Eater_VF/runner.vbs
Size

93B
MD5

7c861e1ebf06eaad679172b27a2611d8
SHA1

3c9ed87e8faf3c6e9a6b32af0804e868b3d3a19b
SHA256

257e018fbd4aa6fbbdf66503d194fcf893abe74ab7b2f5b371724a72cd5b56b5
SHA512

fc2732dbd57e44b8b8e32235bee50e9f10502eccac52e12bb1d3e6008889f1387886e56a6e21e7fea85ad2be5760f72eb0e6c31d5b3fb61fb9b6506936d07b4b

Score

10^/10

agilenet discovery evasion exploit persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\MicrosoftWindowsServicesEtc\\xRunReg.vbs\""	wscript.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1"	wscript.exe

Disables Task Manager via registry modification
evasion
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exe

pid process

5088 icacls.exe
3856 takeown.exe
2948 icacls.exe
4736 takeown.exe
Executes dropped EXE 4 IoCs

Processes:

eula32.exeeulascr.exeGetReady.exenotmuch.exe

pid process

1036 eula32.exe
2488 eulascr.exe
2292 GetReady.exe
4024 notmuch.exe
Loads dropped DLL 1 IoCs

Processes:

eulascr.exe

pid process

2488 eulascr.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

3856 takeown.exe
2948 icacls.exe
4736 takeown.exe
5088 icacls.exe

pid	process
5088	icacls.exe
3856	takeown.exe
2948	icacls.exe
4736	takeown.exe

pid	process
1036	eula32.exe
2488	eulascr.exe
2292	GetReady.exe
4024	notmuch.exe

pid	process
2488	eulascr.exe

pid	process
3856	takeown.exe
2948	icacls.exe
4736	takeown.exe
5088	icacls.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\E93E.tmp\eulascr.exe	agile_net
behavioral4/memory/2488-778-0x0000000000B20000-0x0000000000B4A000-memory.dmp	agile_net
behavioral4/memory/2488-787-0x0000000002F30000-0x0000000002F40000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\MajorX = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xRun.vbs\""	wscript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

81 drive.google.com
82 drive.google.com

flow	ioc
81	drive.google.com
82	drive.google.com

Drops file in System32 directory 2 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\taskmgr.exe	cmd.exe
File opened for modification	C:\Windows\System32\sethc.exe	cmd.exe

Drops file in Program Files directory 37 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\xRun.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\clingclang.wav	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\excursor.ani	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\DgzRun.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\rsod.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\GetReady.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\Major.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\WinScrew.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\eula32.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\thetruth.jpg	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\majordared.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\NotMuch.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\bsod.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\cmd.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\xRunReg.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\fexec.vbs	wscript.exe
File opened for modification	C:\program files\MicrosoftWindowsServicesEtc\AppKill.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\WinScrew.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\breakrule.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\bsod.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\checker.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\Major.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\majorlist.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\majorsod.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\CallFunc.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\healgen.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\example.txt	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\majorlist.bat	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\weird\runner32s.vbs	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\breakrule.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\fileico.ico	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\majorsod.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\RuntimeChecker.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\data\runner32s.exe	wscript.exe
File created	C:\program files\MicrosoftWindowsServicesEtc\GetReady.exe	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Winword.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Winword.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe

Modifies Control Panel 4 IoCs

evasion

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Control Panel\Cursors	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\excursor.ani"	wscript.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

chrome.exeLogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579419101635055"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "5"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 16 IoCs

Processes:

wscript.exeOpenWith.exechrome.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\MicrosoftWindowsServicesEtc\\data\\fileico.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe

NTFS ADS 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\windows-malware-master.zip:Zone.Identifier chrome.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

Winword.exe

pid process

852 Winword.exe
852 Winword.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

3024 chrome.exe
3024 chrome.exe
4688 chrome.exe
4688 chrome.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

1992 OpenWith.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid process

3024 chrome.exe
3024 chrome.exe
3024 chrome.exe
3024 chrome.exe
3024 chrome.exe
3024 chrome.exe
3024 chrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\windows-malware-master.zip:Zone.Identifier	chrome.exe

pid	process
852	Winword.exe
852	Winword.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

chrome.exe

pid	process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe

Suspicious use of SetWindowsHookEx 51 IoCs

Processes:

OpenWith.exeWinword.exeOpenWith.exeMrsMajor3.0.exePickerHost.exeLogonUI.exe

pid	process
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
852	Winword.exe
852	Winword.exe
852	Winword.exe
852	Winword.exe
852	Winword.exe
852	Winword.exe
852	Winword.exe
852	Winword.exe
852	Winword.exe
852	Winword.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
2784	OpenWith.exe
1752	MrsMajor3.0.exe
992	PickerHost.exe
4656	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3024 wrote to memory of 3224	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 3224	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2020	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 4092	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 4092	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe
PID 3024 wrote to memory of 2148	3024	chrome.exe	chrome.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Eater_VF\runner.vbs"
1⤵
PID:948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8c3d0ab58,0x7ff8c3d0ab68,0x7ff8c3d0ab78
2⤵
PID:3224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1488 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:2
2⤵
PID:2020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
PID:4092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
PID:2148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:1
2⤵
PID:4916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:1
2⤵
PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4172 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:1
2⤵
PID:2044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4296 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
PID:5084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4456 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
PID:4084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
PID:1812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
PID:1716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4748 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
PID:1120

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:3804

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff75edeae48,0x7ff75edeae58,0x7ff75edeae68
3⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4920 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:1
2⤵
PID:5008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3412 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:1
2⤵
PID:1240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4840 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:1
2⤵
PID:2576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4824 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:1
2⤵
PID:952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
PID:4256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
- NTFS ADS
PID:132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2752 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:8
2⤵
PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1836,i,7588693846432983786,10055061001056719793,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1992

C:\Program Files\Microsoft Office\root\Office16\Winword.exe
"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Desktop\windows-malware-master\ILOVEYOU\LOVE-LETTER-FOR-YOU.TXT.vbs"
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2784

C:\Users\Admin\Desktop\windows-malware-master\SpySheriff\Install.exe
"C:\Users\Admin\Desktop\windows-malware-master\SpySheriff\Install.exe"
1⤵
PID:2520

C:\Users\Admin\Desktop\windows-malware-master\MrsMajor 2.0\MrsMajor2.0.exe
"C:\Users\Admin\Desktop\windows-malware-master\MrsMajor 2.0\MrsMajor2.0.exe"
1⤵
PID:3056

C:\Windows\system32\wscript.exe
"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\C655.tmp\C656.vbs
2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- System policy modification
PID:2744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c cd\&cd "C:\Users\Admin\AppData\Local\Temp" & eula32.exe
3⤵
PID:4152

C:\Users\Admin\AppData\Local\Temp\eula32.exe
eula32.exe
4⤵
- Executes dropped EXE
PID:1036

C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe
"C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"
3⤵
- Executes dropped EXE
PID:2292

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\9964.bat "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe""
4⤵
- Drops file in System32 directory
PID:4436

C:\Windows\System32\takeown.exe
takeown /f taskmgr.exe
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4736

C:\Windows\System32\icacls.exe
icacls taskmgr.exe /granted "Admin":F
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5088

C:\Windows\System32\takeown.exe
takeown /f sethc.exe
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3856

C:\Windows\System32\icacls.exe
icacls sethc.exe /granted "Admin":F
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2948

C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe
"C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"
3⤵
- Executes dropped EXE
PID:4024

C:\Windows\System32\shutdown.exe
"C:\Windows\System32\shutdown.exe" -r -t 5
3⤵
PID:5104

C:\Users\Admin\Desktop\windows-malware-master\MrsMajor 3.0\MrsMajor3.0.exe
"C:\Users\Admin\Desktop\windows-malware-master\MrsMajor 3.0\MrsMajor3.0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1752

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\E93E.tmp\E93F.tmp\E940.vbs //Nologo
2⤵
- UAC bypass
- System policy modification
PID:1580

C:\Users\Admin\AppData\Local\Temp\E93E.tmp\eulascr.exe
"C:\Users\Admin\AppData\Local\Temp\E93E.tmp\eulascr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:992

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a32055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe
Filesize
52KB

MD5
57f3795953dafa8b5e2b24ba5bfad87f

SHA1
47719bd600e7527c355dbdb053e3936379d1b405

SHA256
5319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725

SHA512
172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
a5bb7f3595ba8501908f07c39a4f91b6

SHA1
d07f53dfb1293791c82afcf8ebd96084e6eee7c8

SHA256
aad890ce8242a48b1359e05e19138e632765ad7ff94e94c670800ec9c317ede6

SHA512
f229b9f7771c3154eb81c437900066198ca75e2a4aec40fd12a92b77000c81d8edbb8c59a63aa85ae91fb15b882e95236f3ad7bdf526480d50f497255ec30871

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
4KB

MD5
4b750196b7989fbc2f12c9e9da7f5ca0

SHA1
f1b82c28d862e498f51f2c8028849181d835e185

SHA256
dc6e887f09ef277e3698aa3385b62478a2e801ece69b8a9cd7086a07397f85be

SHA512
422d12a0a2fbf61007dd1ec8b95745dfdd555038f39de6b4cb53ab56b601d9bcf1ff58674cd006094c87d7be4563ef6a8632e40422b12ecef56fd699db7a5a32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
4KB

MD5
b0f39a864170c44e8126c8be36821d83

SHA1
553d9106b50cb8fc9b39ba494a8a397cb41224b7

SHA256
797fe2d97d45b34d72fc69753789f76b1742ff91c748a776d150cbacb193c2b7

SHA512
dd33fb0fc56c513ca78600bcf16b1679200b88ae8271fdaf9a81a13a8370d9c645415d2f94f05e3cac7b7dce217ae40739b0614418c6c2e8fac6b31be6395531

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
516B

MD5
186f6ec29b67c6c4747a0255938af2c1

SHA1
47206d9c1de7a6acc1d21d064e6257ab3f25fea5

SHA256
7e16a32ff0ac65202654843c3363f909dd02b767097d2c2a643d8f80bdbb4fc8

SHA512
51bf12cb2a9b5630f82e3bebbd5641b839c26b2acdf9b11dd7ebebdf5cf35eda0fb9c35fdd3d1a680d10404455bed1e0a5b9a8972b529a5a6e291d43d7894bd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
e73479bb23e143fa481a3f3fd99b0948

SHA1
94bc91b71eae748fd626f1066530eccc1f828228

SHA256
bfaaf8c7602b57e1f4b47f4b6b06665d851854842160d1bd04b76cf0cd93482a

SHA512
4e66019286fc13e450f0b3aace11983243106a3a9fa3273832c4af3b25929f17bb2c4b56801415da295683461aa2728f64590f88e066bd3f60176b1022dca4c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
dd9bbc3fd1ad91f8e0f34176b147693a

SHA1
0abaff33bad5ad1fe48e81826dd49793285114d5

SHA256
12bc17c931dac81a30ce5baa98cbfbe9fbfb525bd1671f96158a4bf34af5f457

SHA512
a9179a2d32b224a9b0ec93b86a54943fdb4d9e645e3aa4ba28d8cf4d69598bf898fa82e7e4d6f793616485dccfa32c4025140e0b16c8812da240d0bf638e8de8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
ec4151a82ce0f30a65ff8d084b94a56a

SHA1
50bf40926d8f23f57418122c4a1554c84ffe2cdc

SHA256
8257db6472a30e30cb110c82852fbb1d58739dcd502fb8ca97330b7ec60dd5c0

SHA512
d7ad22e320a4675e5c6ebc385a134964a8192fe5ca26747740eceab458fff574051f6e8f1991c4a65427dd8ce1492fe65046c2b91985e0f8f6dc7d18da90a004

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
5ba8682e617e6976bb28181d9be2284b

SHA1
fb133f145c6894b7c1c44d5ecc6651d7eff7c4a8

SHA256
54153da319401c6166df51cb39c7dcd94f8e472d611a453bd8f09d2147200f91

SHA512
62d9594753cdcca879258b7921d75052c904b92a12a5f248d8c2a9d7d2d03abec1919be1aa496a1309b7b2ec7c9c41be9bb7e8d5e58f2f7cf825279e98748d06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
b86b66d8bdc7dbb03460c68979717bf8

SHA1
841ee5c7e500c00d23f615ba7acd97fb86724143

SHA256
12def77f41b288e2fee3ebc44a0b5e604fe3968ef3a898a5ae11272d7a95c8db

SHA512
920a99660d51256e027aed6978eac768c20cf37b55d101aa0e8ac2046884aed0d33406791d08e30c0e16282dbc2166b24de4f003e4e1cd7b824a68d1f1c1b18f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
d05a258b7d6a042af52384fae422ed05

SHA1
b5e6c6c0d267933da9cbe5f60c4675226da4558a

SHA256
dfc70203852dd5602c710ff6a175edd423c3822e0340b71410657a1e25383f4d

SHA512
35f45dc998859b6981694b3e2623e43a475d72063f6972dab7c955ae3433548f3dfd70ccc874c8ce4043feef03be46eb1f4b796f4294446afdd92cba6dad763f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
64c736467cea14ad73e042d961e37e2a

SHA1
2452eadd47dbd61f571923d2e731609e32d53807

SHA256
a6a261fae51eaace133a5dc10ff7c3848ff93036cc212abbd32622d2ab5470e3

SHA512
c0436f9251f555289d7c904a841d81b112d6902662cfefa9548ab80cd2dbfba79fd7593a24797f2effb79ee3abca1e62831f3043ff0ef9c91c7a11b92e2b2157

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
6ad1cadc36ccff7a94a92f64e87f948c

SHA1
62900aa62feca5e41af649a3d3d0ce78ebf44a1f

SHA256
fc1ae4a9b8e39c6113bcdeda37c651feda69c9a070e5845b211de649a83bf6cb

SHA512
60f30a103804cd50dcdbcb65db13c8cb2a97e3b4de05eb9e5e3cc7eb75b82a1b4bd8a49c808dfbab15d1f8a1c4ea79c8642eede41b016c8da4ed2b345eddbb3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
f6b7ea7d1a80ead109ec75e4ce8f78f3

SHA1
3e47b9f82aac030b789bd32aaf2f90880f20d893

SHA256
2ab46bac49c77b8fa8fc7467d510242cd3970696443e1f82f894affd6c952c4a

SHA512
9c06de980098df22b5b3d4e2e4efd4caeb0a1d8ff8735a0f90d9723c3136a936c69c06aee67c86291df991d4bc76279f79d38e97e8fd9b50ae7a0f45d0c65b94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
120B

MD5
8bb79205050514605a6355d24fb3c768

SHA1
b5cd63b0d4bb7f4adb82de6bb59d5136236c07e6

SHA256
4bdcaa4dcb50696807723bc8f205fa1112ef0db5c31698a940af636ea4bb2d6b

SHA512
5a14a8449027aae2e0d3636744ccab2629f0201b369348b82b32e06a3b99289c94e26d7239534ac5851d2159c14c8ea7545123348f92bb680b6e05e968008f16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a6a25.TMP
Filesize
120B

MD5
956b8a0831023f00091dd711909e00dc

SHA1
c62e9171ce35dcb45ce14676d11d641f72ceab77

SHA256
f29633f89c137f48987a22b5047b11ef2d6b61b1370f43b5dd629d64c39e7907

SHA512
87a8e6f82d701c0d9f95586b8bd008e22f17c78f042ce923e7ac928dafa0e00cfa8bf49be3db9ea159027fbd905633f23a38ce1073677a148393809cf0dd164f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
252KB

MD5
f563f07b853fc79dabaa8c9495815d76

SHA1
611f8207a082463b753c23ee59c65891994d402d

SHA256
36764f9b60f8af589455af97165a3edb28907ba048c02c327b61d078a618e3da

SHA512
b10882db882ca81ec428381b5bb35f2a0d4db54ca9b853cc3cff3b6d24e08d26dbb50a1e7dc24bda787721f702c717cf6504ce2d724458267f4a346a80968120

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
252KB

MD5
f852396401fd77537ce0f9b8cb61e8f6

SHA1
e40ca1f786eacbfe2a1747b7efffb74028ae1b06

SHA256
f21392dd3dcfe8567642a1c736c9ec1a4a9de6ecad770ce2c479112bc1af8274

SHA512
5c0d7c17b0ce53127a74acddd0de45ad6ef3723e48891f7fd19bfea0a7797457fb385b24d75d1c0036c79b31d87a8611153a3ddb146e8cc6610b8f82f5d4895d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
88KB

MD5
5ca0c980f194c22b79acca71b0f1f825

SHA1
3b9ef22b15f5d3c6dda94287f16e894a0e25f508

SHA256
e0de27530dd99f1890c658e7516c555ec8ac7d615012c6f1a750c09d2516fd8e

SHA512
5f15fd1fc283f94a7f99aad460e79108fcf110fa2e95add1fe22a1b9e643423a91c4d6c32280c36eb55ca1c7088dda5087dc716576f36dbe35c74f529ad374fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
94KB

MD5
0d0513ce8c26d17bde1d80d1f3cdd83d

SHA1
4e69dfff5ec23bfe7f1fe94937ccd20d938d6c28

SHA256
39452919fe860d817bfcbbb71e4363d6b29817107fd66ea1f0194413536b1eb8

SHA512
94f6f49f35f54963c629c910b67679a22fe43ca87c551a6ab7a55108134d5eeb3154a4146330b486b19a1a06224cc9626e62d38778b91793d076009d52583cbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5abd46.TMP
Filesize
83KB

MD5
5edf8e85ca1c24e425458e6300b124b5

SHA1
fc2fc324b6df23375d8be28bc100f1cc5307f7b9

SHA256
c8ef4a5371266eb7b027b735bdc49f90450fb9460887fe76613697fc9fc89438

SHA512
83940d1e649bd00798fa4082bbbcb2a27b9e71a7a8352a5a4b5cae6813d72a14718ab05c239b305ff09ca7f9e59f4d9943f75e7e3fc5bc5c1f08a2bbbfc5d187

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\C656.vbs
Filesize
2KB

MD5
fd76266c8088a4dca45414c36c7e9523

SHA1
6b19bf2904a0e3b479032e101476b49ed3ae144a

SHA256
f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f

SHA512
3cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\AppKill.bat
Filesize
671B

MD5
d4e987817d2e5d6ed2c12633d6f11101

SHA1
3f38430a028f9e3cb66c152e302b3586512dd9c4

SHA256
5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c

SHA512
b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\CallFunc.vbs
Filesize
388B

MD5
5f9737f03289963a6d7a71efab0813c4

SHA1
ba22dfae8d365cbf8014a630f23f1d8574b5cf85

SHA256
a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275

SHA512
5f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\DgzRun.vbs
Filesize
341B

MD5
a91417f7c55510155771f1f644dd6c7e

SHA1
41bdb69c5baca73f49231d5b5f77975b79e55bdf

SHA256
729f7540887cf32a5d4e1968a284c46cf904752821c734bd970ecd30a848477a

SHA512
f786699c1ab9d7c74dd9eb9d76a76728980b29e84999a166a47b7ee102d8e545901ed0fcb30331712490a36de2d726115b661ad3900cdc2bfcfc601d00b76b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\Major.exe
Filesize
60KB

MD5
d604c29940864c64b4752d31e2deb465

SHA1
c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3

SHA256
da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d

SHA512
89a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\NotMuch.exe
Filesize
122KB

MD5
87a43b15969dc083a0d7e2ef73ee4dd1

SHA1
657c7ff7e3f325bcbc88db9499b12c636d564a5f

SHA256
cf830a2d66d3ffe51341de9e62c939b2bb68583afbc926ddc7818c3a71e80ebb

SHA512
8a02d24f5dab33cdaf768bca0d7a1e3ea75ad515747ccca8ee9f7ffc6f93e8f392ab377f7c2efa5d79cc0b599750fd591358a557f074f3ce9170283ab5b786a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\RuntimeChecker.exe
Filesize
58KB

MD5
cd58990b1b7f6c68f56244c41ab91665

SHA1
7ccca9958d6aebbe3883b55f115b041b827bd2e7

SHA256
51f59e877a1c2a1c2760c677def7395ef2868c2ee3e56ffdc3ace570afa50428

SHA512
011bdd417ec3bf72daa2b32d3816b696be8b87423740dc2a0182e23515651deeb870a94f3415a73480145f9f5e36c1a3a492410b77ca95d7fab8b9826e9198cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\WinScrew.exe
Filesize
52KB

MD5
1aaafedd9f259acca75708f4af10b5be

SHA1
f6b4ea28d304e1f9205c1c0b970d60ee989402f2

SHA256
429e01b0e06b02a55bafb1527629f8d4c5f64d9b21ac9f81484a3928fdce6dc9

SHA512
a995ebf4d142452aabb419f0cacfa5412d03532840cb08c37dd7c00001dee521bf9d0da66ac4346b07dffd91fe01fa3115fa05811acbd43d380320dca1be4aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\breakrule.exe
Filesize
58KB

MD5
bcb0ac4822de8aeb86ea8a83cd74d7ca

SHA1
8e2b702450f91dde3c085d902c09dd265368112e

SHA256
5eafebd52fbf6d0e8abd0cc9bf42d36e5b6e4d85b8ebe59f61c9f2d6dccc65e4

SHA512
b73647a59eeb92f95c4d7519432ce40ce9014b292b9eb1ed6a809cca30864527c2c827fe49c285bb69984f33469704424edca526f9dff05a6244b33424df01d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\bsod.exe
Filesize
1.2MB

MD5
8f6a3b2b1af3a4aacd8df1734d250cfe

SHA1
505b3bd8e936cb5d8999c1b319951ffebab335c9

SHA256
6581eeab9fd116662b4ca73f6ef00fb96e0505d01cfb446ee4b32bbdeefe1361

SHA512
c1b5f845c005a1a586080e9da9744e30c7f3eda1e3aaba9c351768f7dea802e9f39d0227772413756ab63914ae4a2514e6ce52c494a91e92c3a1f08badb40264

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\checker.bat
Filesize
151B

MD5
f59801d5c49713770bdb2f14eff34e2f

SHA1
91090652460c3a197cfad74d2d3c16947d023d63

SHA256
3382484b5a6a04d05500e7622da37c1ffaef3a1343395942bc7802bf2a19b53f

SHA512
c1c3a78f86e7938afbe391f0e03065b04375207704e419fe77bf0810d1e740c3ef8926c878884ad81b429ec41e126813a68844f600e124f5fa8d28ef17b4b7bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\clingclang.wav
Filesize
13.1MB

MD5
1c723b3b9420e04cb8845af8b62a37fa

SHA1
3331a0f04c851194405eb9a9ff49c76bfa3d4db0

SHA256
6831f471ee3363e981e6a1eb0d722f092b33c9b73c91f9f2a9aafa5cb4c56b29

SHA512
41f4005ec2a7e0ee8e0e5f52b9d97f25a64a25bb0f00c85c07c643e4e63ea361b4d86733a0cf719b30ea6af225c4fcaca494f22e8e2f73cda9db906c5a0f12ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\data\eula32.exe
Filesize
1.2MB

MD5
cbc127fb8db087485068044b966c76e8

SHA1
d02451bd20b77664ce27d39313e218ab9a9fdbf9

SHA256
c5704419b3eec34fb133cf2509d12492febdcb8831efa1ab014edeac83f538d9

SHA512
200ee39287f056b504cc23beb1b301a88b183a3806b023d936a2d44a31bbfd08854f6776082d4f7e2232c3d2f606cd5d8229591ecdc86a2bbcfd970a1ee33d41

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\data\excursor.ani
Filesize
17KB

MD5
289624a46bb7ec6d91d5b099343b7f24

SHA1
2b0aab828ddb252baf4ed99994f716d136cd7948

SHA256
b93b0cb2bb965f5758cb0c699fbc827a64712d6f248aaf810cde5fa5ef3227eb

SHA512
8c77696fe1c897f56ea3afdecf67ad1128274815942cd4c73d30bf0a44dd1a690d8c2f4b0be08e604853084e5515020c2e913d6e044f9801b6223c1912eec8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\data\fileico.ico
Filesize
38KB

MD5
a62eeca905717738a4355dc5009d0fc6

SHA1
dd4cc0d3f203d395dfdc26834fc890e181d33382

SHA256
d13f7fd44f38136dae1cdf147ba9b673e698f77c0a644ccd3c12e3a71818a0cd

SHA512
47ffac6dc37dac4276579cd668fd2524ab1591b594032adbeb609d442f3a28235a2d185c66d8b78b6827ac51d62d97bdc3dffc3ffbaa70cf13d4d5f1dc5f16c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\data\runner32s.exe
Filesize
58KB

MD5
87815289b110cf33af8af1decf9ff2e9

SHA1
09024f9ec9464f56b7e6c61bdd31d7044bdf4795

SHA256
a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4

SHA512
8d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\data\thetruth.jpg
Filesize
483KB

MD5
7907845316bdbd32200b82944d752d9c

SHA1
1e5c37db25964c5dd05f4dce392533a838a722a9

SHA256
4e3baea3d98c479951f9ea02e588a3b98b1975055c1dfdf67af4de6e7b41e476

SHA512
72a64fab025928d60174d067990c35caa3bb6dadacf9c66e5629ee466016bc8495e71bed218e502f6bde61623e0819485459f25f3f82836e632a52727335c0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\healgen.vbs
Filesize
302B

MD5
8837818893ce61b6730dd8a83d625890

SHA1
a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614

SHA256
cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb

SHA512
6f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\majordared.exe
Filesize
8.8MB

MD5
570d35aabee1887f7f6ab3f0a1e76984

SHA1
ae989563c3be21ee9043690dcaac3a426859d083

SHA256
fa24bc7bc366f2ad579d57a691fb0d10d868e501221df0c32a98e705d2d61e43

SHA512
9b68a8acacba451bbf028656c181fae29c5bcaed6a7ff4c1fc26ab708b62ca4be7bba9c777c598926d23331570617d20a0ce439f014461eccd8c3f595d21a54f

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\majorlist.exe
Filesize
51KB

MD5
230970ec5286b34a6b2cda9afdd28368

SHA1
e3198d3d3b51d245a62a0dc955f2b1449608a295

SHA256
3cdafc944b48d45a0d5dc068652486a970124ebe1379a7a04e5cf1dcf05c37c8

SHA512
52912b6b2ba55c540316fcfc6f45d68771d1c22ddf4eb09c2cc15fb8ddd214812c18fd75cd61b561c29f660e2bf20290a101b85da1e0bbf8dfbf90b791892b57

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\majorsod.exe
Filesize
58KB

MD5
b561c360c46744f55be79a25e1844e3c

SHA1
ed0f7eb00b4f1ae6cf92ad75e5701014f3d03d56

SHA256
d1094e91960ded15444c6f50756adc451a7c0b495b2ea28319b7184ba96236f7

SHA512
0a3a75d08f1d7afcd7a476fc71157983e04b0c26b00ace4d505aa644e5da3e242dd0f6afdb3c93f29ba0b08d2702d0e96b49acba4ed260330068b13f93973e9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\rsod.exe
Filesize
74KB

MD5
91a0740cfb043e1f4d8461f8cbe2ff19

SHA1
92e1ad31c34c4102e5cb2cc69f3793b2a1d5304e

SHA256
dcaabfd6955d3fec26a86217d1b1ab7e979c301d498473e4d885145ce031fc3b

SHA512
c60067655e5f191708af9b25382869e3ce65cd3ea2d6cac70f8cae4132942cfd6a8aa9dde1e2b7f3f12997d6d7411e21dc73ab4cd83ec555d74b82b86778a613

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\GetReady.bat
Filesize
345B

MD5
3dbccaadafb7f0227c1839be5ca07015

SHA1
bd636f73235d52d172ad8932a8e4a6a8b17389a0

SHA256
33a0c62f3f66bce3fc1beb37aca8ad731bfa5590177d933d9d4eae016019242a

SHA512
d981670f9d492d97931ab260a7d7d27d4f97621a1ef3e20246d4be2a9b4cfc01e01174a1d46432b4a3d937ad135c97eec9ef7bbc7da46034388843887df4637e

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\Major.vbs
Filesize
2KB

MD5
9192fd494155eab424110765c751559e

SHA1
b54fcc1e29617b3eee1c7bb215c048498881b641

SHA256
cbd3b0f294e8f11592a3ad80d1070d81746f806a48183b93c345251422ccbf0d

SHA512
b8c48916535f3721e7f47be6af671765c3befefcd407c6ea5fabcf9ada119747408d662f61fb436f98a7c33050b6674da54dddf25e683429204a96555ec6e801

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs
Filesize
440B

MD5
fe44b78a465853c0ac0744c6ab05ea40

SHA1
f32dacd91b9547fce9a8a2846a4e17c33295aab3

SHA256
989d947c51c878bcefecb53d867a3c182c2d67129a87a5f6773eb6ef2bbf9b2e

SHA512
6b945e16786833c2e2e9867315b8859c413687fc72d4c8576b9c0a1aed2dc65249468317dd49f2ecf777e27c9969b7a7abc72b4d9b7c182dc7999051377515db

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\WinScrew.bat
Filesize
336B

MD5
04067ca733ee8b2ab2f068edc8b75a0f

SHA1
973cb577f6ab2463040918c3661333553a3132c8

SHA256
3aef33c03777abe62feef0a840ac6a087caafc05adfe801464fd1c52eac656a0

SHA512
5423a1e668211f269a3d787548e11d18de7365d6c2525c2de61014854f1ab5a51b5de9eda70fb21d6ebe356cb52e93b3f406c71ed7fbcaedd2b023b6fa9c13f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\breakrule.vbs
Filesize
108B

MD5
2609fde7a9604c73be5083e4bcfa0e20

SHA1
068c89f703fb11663143b9927f2a0c9f9f59c0e3

SHA256
17d014cb4abbaced3acce9b6d7a1b595cd6e2dd814e41f06ceddcdc08e93eebe

SHA512
439fee7cc198cb3fef4ef14693141e52c305579a4ff2da0842323f57dcffade03f3b01ac288080fed423511937a4c1e2080f5a79f967a963fe34253f541824cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\bsod.bat
Filesize
133B

MD5
c94bb8d71863b05b95891389bed6365e

SHA1
07bb402d67f8b1fc601687f1df2622369413db3b

SHA256
3900e3b60b4691311e050c4cf8fac82ff178a06e3d04d5d6b2d7ea12cf5d53d1

SHA512
00e7ab3a91862faaf5ac5ca3de6dbf2cbb8aac4aba277e1e14b2ecf4650eea2e68134e0df549dca35ab715ed46e36fa9cfee1ba7bb3520511723bf567566682d

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\cmd.vbs
Filesize
11B

MD5
b181d5a4055b4a620dd7c44c5065bbe7

SHA1
36320f257026b923b923ad2c0e7fa93a257806e0

SHA256
4d2639e890d6d5988eb9cb6f8cb50647048bbfeeb83fc604c52567e7381c876c

SHA512
0bec0cf2e5b93065701c5458c1d7e047312971d7bbed3ce5444db710654fa0d84eabb7d7c243130e3cb2dae38eb05874929b5b08547174a6065f8accd4e0433d

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\majorlist.bat
Filesize
105B

MD5
4cc606c63f423fda5324c962db709562

SHA1
091250ffc64db9bea451885350abed2b7748014c

SHA256
839301ef07178c100e7f4d47874faf995ae5d11dfd527dda096a284c8114671b

SHA512
f29ef2bc694f497499545d1fa4e14ca93c06049fff582af3a6caf3885153491a1cd9e96ab5a6746051aa972421f876c008e5d5b671bd34c3922b61c84151097f

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\majorsod.vbs
Filesize
126B

MD5
fecb9e50c1f01d9d6101f273cb860260

SHA1
18c413f577c289004db6156bd133e5db70258044

SHA256
8863b595563e92d73b29090ff83191b2fa1297507be588aa7e1cf910e77c7feb

SHA512
2c30641b099d5b6c3af40cb41e70160c1f4294bb30dc3162b018e9552b48fc899d1a63d3e366bfb71fcf6803bcc518cf8d504ce60684ce221028a9bf2bc07f9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\weird\runner32s.vbs
Filesize
383B

MD5
5f427dc44f33906509423d24fa0590c0

SHA1
b896f7667381a594d3751e05f258925b81c231c0

SHA256
9aae0707b1d5d3b7ed3bf5cc8fbb530aebd195e3e2f18312f3f7f1aa43e031b4

SHA512
bd28c386772062ef945f24c8ad7a25f158856af36e31d2c9b14674cedfd34b4f48ed531cd40a7eb291384d83665ffe154f0786c1a7ee1616256cf30125120961

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\xRun.vbs
Filesize
93B

MD5
26ec8d73e3f6c1e196cc6e3713b9a89f

SHA1
cb2266f3ecfef4d59bd12d7f117c2327eb9c55fa

SHA256
ed588fa361979f7f9c6dbb4e6a1ae6e075f2db8d79ea6ca2007ba8e3423671b0

SHA512
2b3ad279f1cdc2a5b05073116c71d79e190bfa407da09d8268d56ac2a0c4cc0c31161a251686ac67468d0ba329c302a301c542c22744d9e3a3f5e7ffd2b51195

Download Submit
C:\Users\Admin\AppData\Local\Temp\C655.tmp\MicrosoftWindowsServicesEtc\xRunReg.vbs
Filesize
134B

MD5
8267192f547f8914ff36eff80ca3f402

SHA1
23bdeb19fb37059e1293dd80d8be69480c957c73

SHA256
cdd4f356ca256c707960bc42b97649111a830e6f951ca6a3cf80853e3c342947

SHA512
cd684cb73496ca925fd8604fbbf286b842e2b02ce18b19d63618e8355dcec02bce700fb09b25da932545845b01a7f8d9986fa486db504b92a42d7c0ace21e9e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\E93E.tmp\E93F.tmp\E940.vbs
Filesize
352B

MD5
3b8696ecbb737aad2a763c4eaf62c247

SHA1
4a2d7a2d61d3f4c414b4e5d2933cd404b8f126e5

SHA256
ce95f7eea8b303bc23cfd6e41748ad4e7b5e0f0f1d3bdf390eadb1e354915569

SHA512
713d9697b892b9dd892537e8a01eab8d0265ebf64867c8beecf7a744321257c2a5c11d4de18fcb486bb69f199422ce3cab8b6afdbe880481c47b06ba8f335beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\E93E.tmp\eulascr.exe
Filesize
143KB

MD5
8b1c352450e480d9320fce5e6f2c8713

SHA1
d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a

SHA256
2c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e

SHA512
2d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Filesize
272B

MD5
8e05353cca445d9f7f99de5e2e706d8d

SHA1
a23d8b285310332a43eedfac3827814db05ead27

SHA256
9036cbacb031693c0a270d6a29848e77b90cb050317556347ec5ef15cfa410a4

SHA512
7402b6c811707f76869fcf8b02762cffd31a2f8a5e7a74939100f74389817772ea8ec3872dafd090a9e3f5606122728b9abc1fc79cd9fcbb7278dc0c76800081

Download Submit
C:\Users\Admin\Downloads\windows-malware-master.zip
Filesize
138.1MB

MD5
efc7175879aa8c0afd105a92ac6d3588

SHA1
420aceb7ab487580f21a22af74283bb3dafcb5c1

SHA256
5b1bcbd8ac2497503833493c6566df7417202975968edd0825ca77aefc9b26fb

SHA512
77138a1cf3d33d35443ca4e44bd13ee39d276e91066a424ba3f751cce6a32f2a2441ffeb6020de722de0c4aeda4a9ae20d32726c5a5200b27a50daa286f22399

Download Submit
C:\Users\Admin\Downloads\windows-malware-master.zip:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\crashpad_3024_HFKVMFLXDGCVTBWO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/852-541-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-534-0x00007FF88FA10000-0x00007FF88FA20000-memory.dmp

Filesize
64KB

Download
memory/852-532-0x00007FF88FA10000-0x00007FF88FA20000-memory.dmp

Filesize
64KB

Download
memory/852-540-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-535-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-546-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-542-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-544-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-543-0x00007FF88D7F0000-0x00007FF88D800000-memory.dmp

Filesize
64KB

Download
memory/852-549-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-545-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-548-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-547-0x00007FF88D7F0000-0x00007FF88D800000-memory.dmp

Filesize
64KB

Download
memory/852-538-0x00007FF88FA10000-0x00007FF88FA20000-memory.dmp

Filesize
64KB

Download
memory/852-590-0x00007FF8CE510000-0x00007FF8CE5CD000-memory.dmp

Filesize
756KB

Download
memory/852-539-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-589-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-588-0x00007FF88FA10000-0x00007FF88FA20000-memory.dmp

Filesize
64KB

Download
memory/852-537-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-587-0x00007FF88FA10000-0x00007FF88FA20000-memory.dmp

Filesize
64KB

Download
memory/852-536-0x00007FF88FA10000-0x00007FF88FA20000-memory.dmp

Filesize
64KB

Download
memory/852-533-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-586-0x00007FF88FA10000-0x00007FF88FA20000-memory.dmp

Filesize
64KB

Download
memory/852-585-0x00007FF88FA10000-0x00007FF88FA20000-memory.dmp

Filesize
64KB

Download
memory/852-553-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/852-551-0x00007FF8CE510000-0x00007FF8CE5CD000-memory.dmp

Filesize
756KB

Download
memory/852-531-0x00007FF88FA10000-0x00007FF88FA20000-memory.dmp

Filesize
64KB

Download
memory/852-550-0x00007FF8CF980000-0x00007FF8CFB89000-memory.dmp

Filesize
2.0MB

Download
memory/1036-766-0x0000000005450000-0x00000000059F6000-memory.dmp

Filesize
5.6MB

Download
memory/1036-765-0x0000000073110000-0x00000000738C1000-memory.dmp

Filesize
7.7MB

Download
memory/1036-767-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Filesize
584KB

Download
memory/1036-768-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1036-769-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

Filesize
40KB

Download
memory/1036-764-0x0000000000220000-0x000000000035C000-memory.dmp

Filesize
1.2MB

Download
memory/1036-809-0x0000000073110000-0x00000000738C1000-memory.dmp

Filesize
7.7MB

Download
memory/1036-807-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1036-793-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1036-792-0x0000000073110000-0x00000000738C1000-memory.dmp

Filesize
7.7MB

Download
memory/2488-791-0x0000000002F30000-0x0000000002F40000-memory.dmp

Filesize
64KB

Download
memory/2488-778-0x0000000000B20000-0x0000000000B4A000-memory.dmp

Filesize
168KB

Download
memory/2488-788-0x0000000002F30000-0x0000000002F40000-memory.dmp

Filesize
64KB

Download
memory/2488-789-0x000000001D040000-0x000000001D202000-memory.dmp

Filesize
1.8MB

Download
memory/2488-790-0x000000001D740000-0x000000001DC68000-memory.dmp

Filesize
5.2MB

Download
memory/2488-785-0x00007FF8AD690000-0x00007FF8AD7DF000-memory.dmp

Filesize
1.3MB

Download
memory/2488-786-0x00007FF8AB480000-0x00007FF8ABF42000-memory.dmp

Filesize
10.8MB

Download
memory/2488-787-0x0000000002F30000-0x0000000002F40000-memory.dmp

Filesize
64KB

Download
memory/2488-794-0x00007FF8AB480000-0x00007FF8ABF42000-memory.dmp

Filesize
10.8MB

Download
memory/2488-795-0x0000000002F30000-0x0000000002F40000-memory.dmp

Filesize
64KB

Download
memory/2488-797-0x00007FF8AB480000-0x00007FF8ABF42000-memory.dmp

Filesize
10.8MB

Download
memory/2520-592-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2520-591-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2520-602-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4024-829-0x0000000073110000-0x00000000738C1000-memory.dmp

Filesize
7.7MB

Download
memory/4024-828-0x0000000000CA0000-0x0000000000CC4000-memory.dmp

Filesize
144KB

Download
memory/4024-830-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/4024-831-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/4024-832-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/4024-833-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/4024-853-0x0000000073110000-0x00000000738C1000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads