xworm | 15eb341d2ff1866160269470ef52df4889a17d2ca58476a77d0c2787845888b1

max time kernel
132s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 09:03

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Eagles Image Logger.exe
Size

6.5MB
MD5

822f47134b780406c02c48e1cdab2e38
SHA1

aa1c4a7b46223f663c8a8751fd3b295ab6443263
SHA256

15eb341d2ff1866160269470ef52df4889a17d2ca58476a77d0c2787845888b1
SHA512

652d6160ce92af854c865351f4b754d528c4493917bb1c4d54d629cf145ab006447cdc493953636acc18a1be078b06307cdac335ae0aa598a21c7d3832e0a818
SSDEEP

196608:vwSbstG7ykI+gHJnHgZcrOSrGymujAoWeVO:vKG7vI+gpnKnQGyXAod

Score

10^/10

xworm bootkit execution persistence pyinstaller rat trojan

Malware Config

Extracted

Family

xworm

bulletingmarrano-45523.portmap.host:45523

Attributes

Install_directory
%AppData%
install_file
RuntimeBroker.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Roaming\installer.exe family_xworm
behavioral1/memory/4304-13-0x00000000008A0000-0x00000000008BC000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1792 powershell.exe
3980 powershell.exe
4940 powershell.exe
4460 powershell.exe
Downloads MZ/PE file

resource	yara_rule
C:\Users\Admin\AppData\Roaming\installer.exe	family_xworm
behavioral1/memory/4304-13-0x00000000008A0000-0x00000000008BC000-memory.dmp	family_xworm

pid	process
1792	powershell.exe
3980	powershell.exe
4940	powershell.exe
4460	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MEMZ.exeMEMZ.exeEagles Image Logger.exeinstaller.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	Eagles Image Logger.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	installer.exe

Drops startup file 2 IoCs

Processes:

installer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	installer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	installer.exe

Executes dropped EXE 12 IoCs

Processes:

installer.exeEagles Image Logger.exeEagles Image Logger.exeMEMZ.exeRuntimeBroker.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeRuntimeBroker.exe

pid	process
4304	installer.exe
1304	Eagles Image Logger.exe
3892	Eagles Image Logger.exe
1648	MEMZ.exe
4516	RuntimeBroker.exe
4888	MEMZ.exe
4312	MEMZ.exe
1020	MEMZ.exe
1916	MEMZ.exe
2880	MEMZ.exe
888	MEMZ.exe
4576	RuntimeBroker.exe

Loads dropped DLL 7 IoCs

Processes:

Eagles Image Logger.exe

pid	process
3892	Eagles Image Logger.exe
3892	Eagles Image Logger.exe
3892	Eagles Image Logger.exe
3892	Eagles Image Logger.exe
3892	Eagles Image Logger.exe
3892	Eagles Image Logger.exe
3892	Eagles Image Logger.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

installer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe"	installer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

116 raw.githubusercontent.com
117 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
Detects Pyinstaller 1 IoCs
pyinstaller

Processes:

resource yara_rule

C:\Users\Admin\AppData\Roaming\Eagles Image Logger.exe pyinstaller
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
116	raw.githubusercontent.com
117	raw.githubusercontent.com

flow	ioc
17	ip-api.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Eagles Image Logger.exe	pyinstaller

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642982783178286"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2144 schtasks.exe

pid	process
2144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeinstaller.exe

pid	process
4940	powershell.exe
4940	powershell.exe
4940	powershell.exe
4460	powershell.exe
4460	powershell.exe
4460	powershell.exe
1792	powershell.exe
1792	powershell.exe
1792	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe
4304	installer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

installer.exe

pid process

4304 installer.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

3056 chrome.exe
3056 chrome.exe
3056 chrome.exe
3056 chrome.exe
3056 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

installer.exepowershell.exepowershell.exepowershell.exepowershell.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	4304	installer.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	4304	installer.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe

Suspicious use of SendNotifyMessage 60 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

installer.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
4304	installer.exe
1020	MEMZ.exe
1916	MEMZ.exe
4888	MEMZ.exe
4312	MEMZ.exe
4312	MEMZ.exe
4888	MEMZ.exe
1916	MEMZ.exe
1020	MEMZ.exe
1020	MEMZ.exe
1916	MEMZ.exe
4888	MEMZ.exe
4312	MEMZ.exe
4888	MEMZ.exe
4312	MEMZ.exe
1916	MEMZ.exe
1020	MEMZ.exe
1916	MEMZ.exe
1020	MEMZ.exe
4888	MEMZ.exe
4312	MEMZ.exe
1020	MEMZ.exe
4888	MEMZ.exe
4312	MEMZ.exe
1916	MEMZ.exe
4312	MEMZ.exe
1916	MEMZ.exe
1020	MEMZ.exe
4888	MEMZ.exe
1020	MEMZ.exe
4888	MEMZ.exe
1916	MEMZ.exe
4312	MEMZ.exe
1916	MEMZ.exe
4312	MEMZ.exe
1020	MEMZ.exe
4888	MEMZ.exe
4888	MEMZ.exe
1916	MEMZ.exe
1020	MEMZ.exe
4312	MEMZ.exe
4312	MEMZ.exe
1916	MEMZ.exe
1020	MEMZ.exe
4888	MEMZ.exe
4888	MEMZ.exe
1020	MEMZ.exe
4312	MEMZ.exe
1916	MEMZ.exe
1916	MEMZ.exe
4312	MEMZ.exe
4888	MEMZ.exe
1020	MEMZ.exe
4888	MEMZ.exe
1020	MEMZ.exe
4312	MEMZ.exe
1916	MEMZ.exe
4312	MEMZ.exe
1916	MEMZ.exe
4888	MEMZ.exe
1020	MEMZ.exe
1020	MEMZ.exe
4312	MEMZ.exe
4888	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Eagles Image Logger.exeEagles Image Logger.exeEagles Image Logger.exe

description	pid	process	target process
PID 2700 wrote to memory of 4304	2700	Eagles Image Logger.exe	installer.exe
PID 2700 wrote to memory of 4304	2700	Eagles Image Logger.exe	installer.exe
PID 2700 wrote to memory of 1304	2700	Eagles Image Logger.exe	Eagles Image Logger.exe
PID 2700 wrote to memory of 1304	2700	Eagles Image Logger.exe	Eagles Image Logger.exe
PID 1304 wrote to memory of 3892	1304	Eagles Image Logger.exe	Eagles Image Logger.exe
PID 1304 wrote to memory of 3892	1304	Eagles Image Logger.exe	Eagles Image Logger.exe
PID 3892 wrote to memory of 1792	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1792	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 5008	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 5008	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 4484	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 4484	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1396	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1396	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3376	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3376	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1536	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1536	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1040	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1040	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3184	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3184	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1344	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1344	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1068	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1068	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2616	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2616	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 528	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 528	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1188	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 1188	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 4528	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 4528	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3604	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3604	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3004	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3004	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 712	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 712	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 4912	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 4912	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3860	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3860	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2720	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2720	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2140	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2140	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2828	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2828	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3712	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3712	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 4364	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 4364	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2604	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 2604	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3216	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3216	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3496	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3496	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3312	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 3312	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 964	3892	Eagles Image Logger.exe	cmd.exe
PID 3892 wrote to memory of 964	3892	Eagles Image Logger.exe	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Eagles Image Logger.exe
"C:\Users\Admin\AppData\Local\Temp\Eagles Image Logger.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Roaming\installer.exe
"C:\Users\Admin\AppData\Roaming\installer.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\installer.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'installer.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Users\Admin\AppData\Roaming\Eagles Image Logger.exe
"C:\Users\Admin\AppData\Roaming\Eagles Image Logger.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Roaming\Eagles Image Logger.exe
"C:\Users\Admin\AppData\Roaming\Eagles Image Logger.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c
4⤵
PID:1792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:5008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:3400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:4760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb62efab58,0x7ffb62efab68,0x7ffb62efab78
2⤵
PID:5008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:2
2⤵
PID:2892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2260 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:1
2⤵
PID:512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:1
2⤵
PID:1008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3560 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:1
2⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4552 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:1916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:1760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3968 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:1
2⤵
PID:4396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:2916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4836 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:4560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3184 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:2316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3352 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:1
2⤵
PID:3016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5028 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5084 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:2568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5124 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5240 --field-trial-handle=1964,i,10115490418531986329,10808914876814016550,131072 /prefetch:8
2⤵
PID:2316

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1648

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4312

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1020

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1916

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
PID:2880

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe" /main
3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:888

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
4⤵
PID:2652

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1908

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3040

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
1⤵
- Executes dropped EXE
PID:4576

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
07f2ca42358fa97a0d8660fa30709a2e

SHA1
92b29f1bd8e16841d096c12063bf6b8fcaf7ec39

SHA256
f42df29b9ef7ac6e1cd1178817fe0f7f8c1af83a646bd66746ac7a3aa062d45b

SHA512
ba6d073a1773c8363535e465eca29e31c8fd213ba53c392a8cca9c89a10706c5c85a55383b5c429363c4fa5889e658f797734035efe75312a0d1e588d1225f76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\10ed0c19-76f8-49ce-bce1-617741c8c61a.tmp
Filesize
1KB

MD5
8fee28197f4df01b4e36191518d74e28

SHA1
557dafd6679189d97f4864c8d09bfdcd48de7035

SHA256
82a7b62943884e778ef16a1e3dde1c2af09bd194f30754eff93a323424244927

SHA512
effd2d38623341530e2be72184fc1e37f9da6897aa6f8ca9fba204b1b01d0e10ccc1d9224f67c0200fe8f5f731e5ad55c21df60680f33a4345835389e5bd44ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
1a9c8a015eb0b0fc5b0dc8af525c407f

SHA1
8efcb83863162a2c7d9b716cb933dc72c945d77e

SHA256
15bafbe108f790b980a61ee428ba5e7bf5a889c1b9ef565c070579e1ca4a178b

SHA512
91b22ef09a83f7912aa26769b6fc6b3223abb56349e69144355d1c31fcef8b47317fbe922311145eaf01143502d39c3c5e77a09bd836578126fcf32a08ff0364

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
523B

MD5
1c5cf6b6b84555c549f4095bdf268281

SHA1
ba94b69f9c951958a7178aaf5bac2c7ea7014c6f

SHA256
60315563e9c8181e8b669665c4a99b410a26025262b8967f1372f9dd719c3c5c

SHA512
e02773aa6eaba1ce53ce3047c93def2d9708c32ce43071927fae81566e9d1b080e01b5535791f15c495d4bfa5a7ad214cda48cc53da5ecfd1695dc1cd80cf377

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
b6f89478ceed1108e5b8b4ead8fe83e2

SHA1
2a6c6f03cb24d211f78f0d454b4325df20df042d

SHA256
b8ea964193debcfd208a613e608d4e018e4e0a271b7f81b98024c678bd8617b7

SHA512
c100336f8e56683d455c370e8dc333cf7ae1c8f33d21412f99fdd38aaa9b260ec1c177b80695da99fcc582ccb4f954b4e1ee43e371986375bac6d6c72edefbeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
59eaaf6a54af9c21317c18ee9aaeebeb

SHA1
f01333de04a201a2ba55dcbac70b5fe382ef5a10

SHA256
21d8608f86f107fd0ce36ee462368598acb2881cedd86b012fbf740559a94129

SHA512
1ec215a3805b6c4046e8837618069e7a98c173b4126248d5530f248caa57812b7992390095a6eeee7256558a21d7d4548a56a51b3351bef9e3f6e2268a6d5b2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
940d57cfa9e34af85e4e8b528fd6dd2f

SHA1
087d51633add490e3dac60e9f64279c86a7e8401

SHA256
05368e66f19fae18f18a7448b107e70a8ab555adc613873341b8694c064b0b46

SHA512
07ec3984df58347c1aed50e18a9b84eb21400082b6e829cde0ac351b187bbee4d6be5f4d092ee5493798515c6c5bfff480fcf813efe914ab04c345046250cd8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
e21899c3d9b6e50a24285174358cb12c

SHA1
2a28d47592b7ab7a984704abf6f6e303a48ed342

SHA256
dee4b3632a1e0e5396fb7db160cb815eeef9e92add9ce021a8470e98618d27c6

SHA512
f9ea43d1b61a4496d1388ace91ca9238bc020e69a712778c31343a4dbf77d3d13cc6c88cf286a1490d233c62a26c7fffcc778dfc6c0b287cde67dc0e6bd79317

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
f064b48eaaf6bd62e80b67e703086bc4

SHA1
3a9e303fb1ee7aaabb66cb62cf935ec677b2a2a8

SHA256
03ab9cab13c159104d1bb6aa8388ac513bd510fb9a89b0ca3f46cb67f26663ad

SHA512
222dcf9306bfb5e5041ff4fd2af7a686a0d2cf3bf2eb025078e17e28cb865f0583d7d9273171f0567329baf51881281fc02dfd3388f9a6e04e55ee4bdad09e23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
278KB

MD5
e95f24be9acc9cd9d97c22a539ac8bae

SHA1
10b2a80e6c4403ba62912a2a5d8ac716d9a0a756

SHA256
f9301f68295e44462ca739617c4aa7cc342337c1e6a0a2b514d4cf1a8b162146

SHA512
0bbef8a2cf86f2b3513390a56bae77234a98186cdcac6f397add7293d8737637e87100db5c1492060db32f9da71c4f7bf3710573c281d3ab408b28a8e1fbba60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe583d81.TMP
Filesize
89KB

MD5
60d80b9f65e41801da76a5b749705b7c

SHA1
450847a5e73465cb5e28ec4a03f423ee5ad1209f

SHA256
b48916c8846111f73d5e62cb941b5fc810724eb5ceacc11a18e3d841b6c15b2b

SHA512
e08c399f5b795c56cbb707214dcf3f7f7a76baa73c1232056a69bffa44e1c59e9e44974d1a18bab96cdb3628e035aee2a1360002d109e50e373393a0c1c0bc7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d9107347-e23d-4bc9-a99c-4371ec9e4af9.tmp
Filesize
101KB

MD5
cd3888a6537687068a82ca507d6888c5

SHA1
daff89c20551429747a488ae130a2c2b7d2bc332

SHA256
1ab10a5fbe428427a4a533944e83c7d2631dba1d7e7232c8526f801f61cd2154

SHA512
f78e99f87af13f5368e728819e67b94e40fb8c7323dc331c601ef42453d726bcdc096518e3668ddbf8ed500d06fb34eae2d507620139815687991f818c1cfb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cae60f0ddddac635da71bba775a2c5b4

SHA1
386f1a036af61345a7d303d45f5230e2df817477

SHA256
b2dd636b7b0d3bfe44cef5e1175828b1fa7bd84d5563f54342944156ba996c16

SHA512
28ed8a8bc132ef56971cfd7b517b17cdb74a7f8c247ef6bff232996210075e06aa58a415825a1e038cfb547ad3dc6882bf1ca1b68c5b360ef0512a1440850253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\VCRUNTIME140.dll
Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\_bz2.pyd
Filesize
81KB

MD5
4101128e19134a4733028cfaafc2f3bb

SHA1
66c18b0406201c3cfbba6e239ab9ee3dbb3be07d

SHA256
5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80

SHA512
4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\_ctypes.pyd
Filesize
120KB

MD5
6a9ca97c039d9bbb7abf40b53c851198

SHA1
01bcbd134a76ccd4f3badb5f4056abedcff60734

SHA256
e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535

SHA512
dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\_decimal.pyd
Filesize
245KB

MD5
d47e6acf09ead5774d5b471ab3ab96ff

SHA1
64ce9b5d5f07395935df95d4a0f06760319224a2

SHA256
d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e

SHA512
52e132ce94f21fa253fed4cf1f67e8d4423d8c30224f961296ee9f64e2c9f4f7064d4c8405cd3bb67d3cf880fe4c21ab202fa8cf677e3b4dad1be6929dbda4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\_hashlib.pyd
Filesize
62KB

MD5
de4d104ea13b70c093b07219d2eff6cb

SHA1
83daf591c049f977879e5114c5fea9bbbfa0ad7b

SHA256
39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e

SHA512
567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\_lzma.pyd
Filesize
154KB

MD5
337b0e65a856568778e25660f77bc80a

SHA1
4d9e921feaee5fa70181eba99054ffa7b6c9bb3f

SHA256
613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a

SHA512
19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\_socket.pyd
Filesize
76KB

MD5
8140bdc5803a4893509f0e39b67158ce

SHA1
653cc1c82ba6240b0186623724aec3287e9bc232

SHA256
39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769

SHA512
d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\_uuid.pyd
Filesize
23KB

MD5
9a4957bdc2a783ed4ba681cba2c99c5c

SHA1
f73d33677f5c61deb8a736e8dde14e1924e0b0dc

SHA256
f7f57807c15c21c5aa9818edf3993d0b94aef8af5808e1ad86a98637fc499d44

SHA512
027bdcb5b3e0ca911ee3c94c42da7309ea381b4c8ec27cf9a04090fff871db3cf9b7b659fdbcfff8887a058cb9b092b92d7d11f4f934a53be81c29ef8895ac2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\base_library.zip
Filesize
1.4MB

MD5
83d235e1f5b0ee5b0282b5ab7244f6c4

SHA1
629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

SHA256
db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

SHA512
77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\libcrypto-1_1.dll
Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\libffi-8.dll
Filesize
34KB

MD5
32d36d2b0719db2b739af803c5e1c2f5

SHA1
023c4f1159a2a05420f68daf939b9ac2b04ab082

SHA256
128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c

SHA512
a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\python311.dll
Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\select.pyd
Filesize
28KB

MD5
97ee623f1217a7b4b7de5769b7b665d6

SHA1
95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0

SHA256
0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790

SHA512
20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13042\unicodedata.pyd
Filesize
1.1MB

MD5
bc58eb17a9c2e48e97a12174818d969d

SHA1
11949ebc05d24ab39d86193b6b6fcff3e4733cfd

SHA256
ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa

SHA512
4aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gqjicdix.bfb.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Eagles Image Logger.exe
Filesize
6.4MB

MD5
965fb2fc5db15b030f765e34e2f7cbf9

SHA1
84f5d23cf66081cdcba281e93ddc0938741afd93

SHA256
c71c4fca850ad63b95858df49395fe31b9cb51efdd95660ab7187ad5432523e8

SHA512
75b1879a581d55d5d802eca53f7dbdeb06dbd8078e38264ff4687901fad6675423013c6f7a7359abc168aaa1942202cfc089f7a92ea41fa2d94c69ddb490c601

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk
Filesize
803B

MD5
84696cf312ef7b575335be8aafba461b

SHA1
4cf388184d594f3e85ad9cdb51faaef6926216c4

SHA256
254f5d10121a0e823a254412187bb5b73416d274c996e4fbaee59ee2e4b85619

SHA512
bffc88bd4d8cae8e89cd3db5049d0a7329c4d7d66c8594783fffba1f0175ea85c8959b7f072661d89bb690980539b19260183fbae3d9701658894032e78ff7cb

Download Submit
C:\Users\Admin\AppData\Roaming\installer.exe
Filesize
85KB

MD5
1b18c754c9cccfb1be40b725a7cf9b3e

SHA1
2b4bd57ef4d23021ee452b408dcc032aa7f78f07

SHA256
dc56aba24508d371ada577ba9af39be2919fd45e94ae04edc43c5c142c2524a9

SHA512
73bb18727104a5acfc33e0589c0dcacb046715adbdccbf4e77e79949405cf000cd238fa42c3abe938ee15403c75fb0c71cca8af1e9015db4ca92e9cfcd89ff59

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe
Filesize
16KB

MD5
1d5ad9c8d3fee874d0feb8bfac220a11

SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595

SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\crashpad_3056_ZMZRIEQKBLYMFMXF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2700-1-0x0000000000E50000-0x00000000014E2000-memory.dmp

Filesize
6.6MB

Download
memory/2700-0-0x00007FFB65F33000-0x00007FFB65F35000-memory.dmp

Filesize
8KB

Download
memory/3040-557-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/3040-555-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/3040-556-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/3040-558-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/3040-549-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/3040-551-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/3040-550-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/3040-559-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/3040-561-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/3040-560-0x000001B84B0D0000-0x000001B84B0D1000-memory.dmp

Filesize
4KB

Download
memory/4304-60-0x00007FFB65F30000-0x00007FFB669F1000-memory.dmp

Filesize
10.8MB

Download
memory/4304-13-0x00000000008A0000-0x00000000008BC000-memory.dmp

Filesize
112KB

Download
memory/4304-15-0x00007FFB65F30000-0x00007FFB669F1000-memory.dmp

Filesize
10.8MB

Download
memory/4304-140-0x00007FFB65F30000-0x00007FFB669F1000-memory.dmp

Filesize
10.8MB

Download
memory/4304-141-0x00007FFB65F30000-0x00007FFB669F1000-memory.dmp

Filesize
10.8MB

Download
memory/4940-61-0x0000023D2CC50000-0x0000023D2CC72000-memory.dmp

Filesize
136KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads