vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reverse-skills-max: initial public release (restored, redacted, hardened)

Browse Source
This commit is contained in:
baradok609hecl1pq6qi
2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
vendor-new/malware-analysis-claude-skills/tests/fixtures/evidence/procmon.csv vendored Normal file
View File

@@ -0,0 +1,17 @@
"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"10:00:01.1","explorer.exe","1400","Process Create","C:\Users\Public\invoice_2024.exe","SUCCESS","PID: 4820, Command line: ""C:\Users\Public\invoice_2024.exe"" /install"
"10:00:01.2","invoice_2024.exe","4820","Process Start","","SUCCESS","Parent PID: 1400, Command line: ""C:\Users\Public\invoice_2024.exe"" /install, Current directory: C:\Users\Public\"
"10:00:01.3","invoice_2024.exe","4820","CreateFile","C:\Users\Bob\AppData\Roaming\svc.exe","SUCCESS","Desired Access: Generic Write, Disposition: Create, OpenResult: Created"
"10:00:01.4","invoice_2024.exe","4820","WriteFile","C:\Users\Bob\AppData\Roaming\svc.exe","SUCCESS","Offset: 0, Length: 51200"
"10:00:01.5","invoice_2024.exe","4820","RegCreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Run","SUCCESS","Desired Access: All Access"
"10:00:01.6","invoice_2024.exe","4820","RegSetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate","SUCCESS","Type: REG_SZ, Length: 62, Data: C:\Users\Bob\AppData\Roaming\svc.exe"
"10:00:02.0","invoice_2024.exe","4820","Load Image","C:\Users\Bob\AppData\Roaming\hlp.dll","SUCCESS","Image Base: 0x10000000, Image Size: 0x14000"
"10:00:02.5","invoice_2024.exe","4820","TCP Connect","DESKTOP-TEST:49700 -> 203.0.113.5:443","SUCCESS","Length: 0, mss: 1460"
"10:00:03.0","invoice_2024.exe","4820","Process Create","C:\Windows\System32\cmd.exe","SUCCESS","PID: 5102, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del ""C:\Users\Public\invoice_2024.exe"""
"10:00:03.1","cmd.exe","5102","Process Start","","SUCCESS","Parent PID: 4820, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del ""C:\Users\Public\invoice_2024.exe"""
"10:00:03.2","cmd.exe","5102","Process Create","C:\Windows\System32\PING.EXE","SUCCESS","PID: 5140, Command line: ping -n 3 127.0.0.1"
"10:00:06.0","cmd.exe","5102","SetDispositionInformationFile","C:\Users\Public\invoice_2024.exe","SUCCESS","Delete: True"
"10:00:06.2","svc.exe","5300","Process Start","","SUCCESS","Parent PID: 1, Command line: C:\Users\Bob\AppData\Roaming\svc.exe"
"10:00:06.5","svc.exe","5300","TCP Connect","DESKTOP-TEST:49712 -> 203.0.113.5:443","SUCCESS","Length: 0, mss: 1460"
"10:00:10.0","chrome.exe","2100","WriteFile","C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1","SUCCESS","Offset: 0, Length: 4096"
"10:00:11.0","svchost.exe","900","RegQueryValue","HKLM\System\CurrentControlSet\Services\Tcpip\Parameters","SUCCESS","Type: REG_DWORD"
1 Time of Day Process Name PID Operation Path Result Detail
2 10:00:01.1 explorer.exe 1400 Process Create C:\Users\Public\invoice_2024.exe SUCCESS PID: 4820, Command line: "C:\Users\Public\invoice_2024.exe" /install
3 10:00:01.2 invoice_2024.exe 4820 Process Start SUCCESS Parent PID: 1400, Command line: "C:\Users\Public\invoice_2024.exe" /install, Current directory: C:\Users\Public\
4 10:00:01.3 invoice_2024.exe 4820 CreateFile C:\Users\Bob\AppData\Roaming\svc.exe SUCCESS Desired Access: Generic Write, Disposition: Create, OpenResult: Created
5 10:00:01.4 invoice_2024.exe 4820 WriteFile C:\Users\Bob\AppData\Roaming\svc.exe SUCCESS Offset: 0, Length: 51200
6 10:00:01.5 invoice_2024.exe 4820 RegCreateKey HKCU\Software\Microsoft\Windows\CurrentVersion\Run SUCCESS Desired Access: All Access
7 10:00:01.6 invoice_2024.exe 4820 RegSetValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate SUCCESS Type: REG_SZ, Length: 62, Data: C:\Users\Bob\AppData\Roaming\svc.exe
8 10:00:02.0 invoice_2024.exe 4820 Load Image C:\Users\Bob\AppData\Roaming\hlp.dll SUCCESS Image Base: 0x10000000, Image Size: 0x14000
9 10:00:02.5 invoice_2024.exe 4820 TCP Connect DESKTOP-TEST:49700 -> 203.0.113.5:443 SUCCESS Length: 0, mss: 1460
10 10:00:03.0 invoice_2024.exe 4820 Process Create C:\Windows\System32\cmd.exe SUCCESS PID: 5102, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del "C:\Users\Public\invoice_2024.exe"
11 10:00:03.1 cmd.exe 5102 Process Start SUCCESS Parent PID: 4820, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del "C:\Users\Public\invoice_2024.exe"
12 10:00:03.2 cmd.exe 5102 Process Create C:\Windows\System32\PING.EXE SUCCESS PID: 5140, Command line: ping -n 3 127.0.0.1
13 10:00:06.0 cmd.exe 5102 SetDispositionInformationFile C:\Users\Public\invoice_2024.exe SUCCESS Delete: True
14 10:00:06.2 svc.exe 5300 Process Start SUCCESS Parent PID: 1, Command line: C:\Users\Bob\AppData\Roaming\svc.exe
15 10:00:06.5 svc.exe 5300 TCP Connect DESKTOP-TEST:49712 -> 203.0.113.5:443 SUCCESS Length: 0, mss: 1460
16 10:00:10.0 chrome.exe 2100 WriteFile C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 SUCCESS Offset: 0, Length: 4096
17 10:00:11.0 svchost.exe 900 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters SUCCESS Type: REG_DWORD