Malware Analysis Report

2024-12-07 14:30

Sample ID 241016-tjv3wsybqf
Target https://github.com/pankoza2-pl/malwaredatabase-old/raw/refs/heads/main/HorrorTrojan5.zip
Tags
bootkit discovery evasion exploit persistence ransomware
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file https://github.com/pankoza2-pl/malwaredatabase-old/raw/refs/heads/main/HorrorTrojan5.zip was found to be: Likely malicious.

Malicious Activity Summary

bootkit discovery evasion exploit persistence ransomware

Disables Task Manager via registry modification

Possible privilege escalation attempt

Checks computer location settings

Executes dropped EXE

Modifies file permissions

Enumerates connected drives

Writes to the Master Boot Record (MBR)

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Sets desktop wallpaper using registry

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Browser Information Discovery

Modifies registry key

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Kills process with taskkill

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Scheduled Task/Job: Scheduled Task

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 16:05

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 16:05

Reported

2024-10-16 16:06

Platform

win10v2004-20241007-en

Max time kernel

60s

Max time network

50s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/malwaredatabase-old/raw/refs/heads/main/HorrorTrojan5.zip

Signatures

Disables Task Manager via registry modification

evasion

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CD72.tmp\\MBRKill.exe" C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MBRKill.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\M: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\B: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\WScript.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\WScript.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MBRKill.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\clwcp.bmp" C:\Users\Admin\AppData\Local\Temp\CD72.tmp\CLWCP.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\clwcp.bmp C:\Users\Admin\AppData\Local\Temp\CD72.tmp\CLWCP.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CD72.tmp\melter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MouseDraw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CD72.tmp\BitBlt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MBRKill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CD72.tmp\CLWCP.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CD72.tmp\jeff.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MrsMjrGui.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CD72.tmp\Glitcher.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Temp1_HorrorTrojan5.zip\HorrorTrojan 5.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133735683551165942" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WScript.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WScript.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WScript.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WScript.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_HorrorTrojan5.zip\HorrorTrojan 5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CD72.tmp\jeff.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 4160 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3008 wrote to memory of 3140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/malwaredatabase-old/raw/refs/heads/main/HorrorTrojan5.zip

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff99204cc40,0x7ff99204cc4c,0x7ff99204cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,3124849771529534099,108464943913903071,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1808 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1812,i,3124849771529534099,108464943913903071,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2128 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1836,i,3124849771529534099,108464943913903071,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2296 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,3124849771529534099,108464943913903071,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,3124849771529534099,108464943913903071,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4764,i,3124849771529534099,108464943913903071,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4776 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4552,i,3124849771529534099,108464943913903071,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\Temp1_HorrorTrojan5.zip\HorrorTrojan 5.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_HorrorTrojan5.zip\HorrorTrojan 5.exe"

C:\Windows\system32\wscript.exe

"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\CD72.tmp\CD73.tmp\CD74.vbs //Nologo

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CD72.tmp\s.cmd" "

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K killer.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K exespam.cmd

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\CLWCP.exe

clwcp.exe c:\bg.jpg

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MBRKill.exe

MBRKill.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MBRKill.exe"

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\taskmgr.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F

C:\Windows\system32\taskkill.exe

taskkill /f /im logonui.exe

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\logonui.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant "everyone":F

C:\Windows\system32\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CD72.tmp\sound.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CD72.tmp\msg1.vbs"

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x308 0x394

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\melter.exe

melter.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Windows\system32\taskkill.exe

taskkill /f /im melter.exe

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\jeff.exe

jeff.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K major.cmd

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\Glitcher.exe

Glitcher.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MrsMjrGui.exe

MrsMjrGui.exe

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MouseDraw.exe

MouseDraw.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\BitBlt.exe

BitBlt.exe

C:\Windows\system32\timeout.exe

timeout 10 /nobreak

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\melter.exe

melter.exe

C:\Windows\system32\timeout.exe

timeout 30 /nobreak

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 202.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp

Files

\??\pipe\crashpad_3008_RRCQFHKWFAANVRSF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 89cd60362dd22111088df27b97b5e420
SHA1 bb466704b16b06505d22b15397bafe6ac30e41cb
SHA256 af15673ffbad417eea50876846757badd2e18ed40f666c900481ed3ea45e3cfd
SHA512 47dee9aafcbb22d27607f3bba0aa0740c915f14375dcb7e4f26cd6923c855f211f8c00995aac7239da61d46c55040c4a148af4a260be682cb6530109d93a27eb

C:\Users\Admin\Downloads\HorrorTrojan5.zip.crdownload

MD5 2cf63070aa3fda50182bea7fa25680a0
SHA1 d6fc54786f08a8d32b8548d9c32193830d3a8996
SHA256 410973d76bd4c54167059ffeac29b7389a0e03339cbe647ad76736307ff78820
SHA512 2091d9495fb3f5fe36b90f529550808378478154596b429b07f937166a8c2c13c36b3d015f1d6c0e6d22bdd1c11418a7eb1fecd605c6a5617473e5e049285356

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 35c0b7947545499e53c40c86d25b5ba7
SHA1 490e3095a5ea1d43f6ad906b7c5b69bcd2312111
SHA256 95c6c085246a9451766f1cb4b036f350adc95c1782aaf61556efc6af88c571d8
SHA512 9d1b2088fecc4aa5e418cbf0ff4fb1e6b77a565e04f2018d93c335588480dbfece5b97402a45e675dde5c7eb5cfb07a32a0b1ca393fa8dae999487e271de6346

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fe32a896b868c63f6b048934b212777c
SHA1 96b4d1ce2ffbf601fdefdef35b75fc3648cc75d0
SHA256 5830979d1048b1932c5ab524d19a1212499779a265ed0dadca87b256995cb847
SHA512 6fcf8070a1c17af91fe817a55c85917767fa5b12900e10d72db8c13eaae761c0027e9ea4ae2aa650ae719a9c0c1d23e54f45f51e54018dc2fc3e37d2806cdb16

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 cff3e9b311159466236243db7e47fe86
SHA1 95483adc1f2fe11a6ffec48a76dbbc94875d06ff
SHA256 a6bf2265cfc23fe567314b7c8538c833c8be116714101d77adb85d62826462e9
SHA512 5a91ffe5b62f7f15a85200b7c7866a84883d0dfb48855ce1d47c13076c1c415a1ec7dd091f961d96336af46280350576b5d8acf0d9b497584e52b2400e658615

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\CD73.tmp\CD74.vbs

MD5 39392978a29c1fe421f83779607298c9
SHA1 55c875bb2e6e588dc3e95294f2fab3c6a5809a3a
SHA256 b4afa97d01b3c4f75ce3434b3d63690a4452d3921e33643841db1ffe705d1eb8
SHA512 14d0bc8cf48cf85901aa917ac79446cc7608e1d5cf5d97df94bd1636856095185709aac1b5594328010e7de685724df5e65e9802b1f00951a6a3de11c4eb74b6

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\s.cmd

MD5 5399c7b85f334c9562422e844a450328
SHA1 ff1934cd715e082dd3b100d91e92bbfd395ae973
SHA256 8cd26e8c1414d2cad62bf61bd477ed78d7b5b1ca05c1541c063a7f10571dcf42
SHA512 3709498cea31b14ae086ef33490aadd1b00b777ee48287cb4b1bf929b8d9f7219b7602ab0a4206476cb0ad2caf4a11046fd826017fd170e5aca7ece18bfd2fdc

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\bg.jpg

MD5 3b6b5b6ace64aaa00745f1a22e4e11a5
SHA1 967c54aac9d95656766c0004ff08c33ccca9faf8
SHA256 b808495c4fdf4c1abd50fc3436367d1ba3fb73e844eef639b0c3dc685dc2bc51
SHA512 ffe6c15da9b82805a373790a4c9b5f9b134fce75923b640e4cad811d70c66d0b98ef65a89287eb1d511e2c9537e28cb0c0f27456d243d449dadf1e670738f03d

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\CLWCP.exe

MD5 e62ee6f1efc85cb36d62ab779db6e4ec
SHA1 da07ec94cf2cb2b430e15bd0c5084996a47ee649
SHA256 13b4ec59785a1b367efb691a3d5c86eb5aaf1ca0062521c4782e1baac6633f8a
SHA512 8142086979ec1ca9675418e94326a40078400aff8587fc613e17164e034badd828e9615589e6cb8b9339da7cdc9bcb8c48e0890c5f288068f4b86ff659670a69

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\exespam.cmd

MD5 6ad1695b8c7f1597d7acfbb11cafdd78
SHA1 898f25cceea6b1021732330062a3dab2364450a4
SHA256 423c32e47f091f1b441b3b0e6502acc023c9c4b4546af77db41ed4daac83d3bd
SHA512 b01b9f2a3a426291e5c344c75c0c0cac38a533ea199c580ccaea35020add3d3006ceedfab7bc10d10e43e1d99d387f58d2783fe76a92803657016291ff6df3ac

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\killer.cmd

MD5 ef8f6b067e6858c819385ca3bf100bb7
SHA1 b2d6ee1bfe56899085ee6e3f8c8830dcc42ac1e3
SHA256 6e053971d80695b4989a545ce1aff49bcb8fee63d1aaf514219957bc49527b8f
SHA512 6ac27ce517c37188a3e246338d9c3bfe55ca22cdee7e73969df6ed84690c24cfadeff8eb6d3689674e8dfc3ab233f2f7334a4040d3c702b61fcf18fb23ca3f47

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MBRKill.exe

MD5 be6671bf93ab86cefb841fe6e08875cd
SHA1 97ccc3d1c14c99872582fdbc0873ec462597e813
SHA256 e29b977d29fc12512eb33eaaacaa1ee8009d6023baa3bbc55f2d5c1847a97568
SHA512 7e16e1d857c2400ffbd6c518f8ceb789728ef1d53ed894528f001669a4640d631e3940200df99961f06d2dd7c4b6cc8db5055c3c8a259bdd86f042c6b89b7845

memory/3532-103-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1048-104-0x0000000000400000-0x0000000000484000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\sound.vbs

MD5 8b703f9c48eb3724348af746e7610061
SHA1 599aa1820096e92546ea8d863d46cc49404e19e6
SHA256 e8cd555c43973e3b2e6fa0e80d602abc3d7c43a17bc51a6d0ba08e20ea3feadd
SHA512 d38e39e3f9ff71f68d3d851b635bcc27939656ec085369652a324d8b0c95042e722a07b0b06a0a25f0f2b51d5ad1addc3174c472bda3f86cbf28376ba4870208

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\msg1.vbs

MD5 4b62ee3413ba7e7785d4525867bcd59e
SHA1 2652c3a8a91cbfb12a493b1534f15d0079be3716
SHA256 b34c682b21c0dd9b822dc0fe7e1f475bda7dacb2fa3ecaee4ce05b6b03867d54
SHA512 0d6902921064b573c25d2d98d9afb2a621be4f2efbf54f2d7a5c2915e5631ccdf7a1257548539b6ff6af93067c7c3ceda11805e22ab0656db04dd32b928ce757

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\clingclang.wav

MD5 1c723b3b9420e04cb8845af8b62a37fa
SHA1 3331a0f04c851194405eb9a9ff49c76bfa3d4db0
SHA256 6831f471ee3363e981e6a1eb0d722f092b33c9b73c91f9f2a9aafa5cb4c56b29
SHA512 41f4005ec2a7e0ee8e0e5f52b9d97f25a64a25bb0f00c85c07c643e4e63ea361b4d86733a0cf719b30ea6af225c4fcaca494f22e8e2f73cda9db906c5a0f12ae

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\melter.exe

MD5 d9baac374cc96e41c9f86c669e53f61c
SHA1 b0ba67bfac3d23e718b3bfdfe120e5446d0229e8
SHA256 a1d883577bcb6c4f9de47b06fe97c370c09bddffb6569b6cf93576371bdbc412
SHA512 4ecdf8757e75b02da06a9d42a8ca62b9f2ef292dc04fa37d96603af78433f8aa9dd82fcf1e128a8f463b9691dcc1645b4a64e34f3c5d631f3a0e0670da0d0457

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 dec2c144b59408a3ae59eb82069295ec
SHA1 4f9dc5b4aa8d2ff41e11474e4f1b20ce52f63edd
SHA256 b820ecfae530f81ef1edae1fb264ed76fec8a7729940d64246d634429743cd38
SHA512 27438cb76da78290d0db7b56a66121099bb971dd0638e7a4e6a9310824fd2f07a947ab027b86bfa33564bb43b90c0e2b586f8a13ed41dd1e4195c2a4edc5d3db

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 980974bd57ab8f2b80e81b52a4b071c4
SHA1 0abbd500b355a720914b37a0a1adfb2843776bee
SHA256 04d71cf3facfcf7f37420bb6a912cb4c46628559b678ba09d97275bb0955202b
SHA512 bb27b1fa5d672aecacbed366d477f4cc1ef7ed521a8159a0c83ffccdf21d9165bbb8a463762cb1b7eeb45f5bceb60d2ef66c38e15997bde9ae12fd99beb2b2f6

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\Glitcher.exe

MD5 64334bec19af5d2aac4bcc91ec587977
SHA1 885cd87d85247313bc48582c99ea1621a4017f39
SHA256 7362e6cd9570758e6b2efdc13424ae26e75e2d5fcc753b6ebcb314ac55fa1047
SHA512 15ab4a13af64236d5253db83dec4505ba671b26e79267c52ed608d55884ffc02fad814f66560c148fdaf028192d037b6fc5063532e8060f44827211b77ebdebe

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\jeff.exe

MD5 d82a6e30efd822de01cbcb0ee8483f17
SHA1 9641c7825cb3876b734c4b05b2c0a7b5a91a5e81
SHA256 d3d8383e91ec695d1419f0d1641efdd3f06df1703a67677df7ad8e6515749fe3
SHA512 11ce1ac5e7a57dacbbaf4a26a0599bb4627a0859664420d7ffa5f9a20b42412979524ad7c794d4632971303b286709e15d74bcd45b0dbdcf367bd56a2b89a01d

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\major.cmd

MD5 74631a19383284b04446bbb631b8e748
SHA1 2957a0c628059cb77f983ab7fd4c3d7308b74c62
SHA256 8bc312d5644432b77b2dcc818fab9b62fe6d47a3764b8214e9d12acc914ca22d
SHA512 c7cc7e3cce628f05464b110de70e330abf59e4e6f543e935108edf23012b5cade39e3659723d28ff1ee72884f05d75337c3f14c2d8cd68898764c91110e9096c

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MrsMjrGui.exe

MD5 450f49426b4519ecaac8cd04814c03a4
SHA1 063ee81f46d56544a5c217ffab69ee949eaa6f45
SHA256 087fca40e079746b9c1dfaf777d3994c0321ea8f69d08238cdfc02fb109add1d
SHA512 0cae15d863120f4edc6b6dabfe2f0f3d2e028057025d7d5ffe615cde8144f29bdaf099850e91e101e95d13f8a83cb1410a06172dda25a5f92967abcbc8453cbc

memory/5380-164-0x0000000000630000-0x0000000000648000-memory.dmp

memory/5380-165-0x0000000004F70000-0x000000000500C000-memory.dmp

memory/5380-166-0x00000000055C0000-0x0000000005B64000-memory.dmp

memory/5380-167-0x0000000005010000-0x00000000050A2000-memory.dmp

memory/5380-168-0x0000000004F00000-0x0000000004F0A000-memory.dmp

memory/5380-169-0x0000000005240000-0x0000000005296000-memory.dmp

memory/3148-170-0x000001AC1E680000-0x000001AC1F184000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\MouseDraw.exe

MD5 be86c274800697354120d01c65f33258
SHA1 8154def1188ee33564f939f9d6d4c588ee30b004
SHA256 dfa46efcc267f7c4fa18c9a3f1f0204fe3266cceadff2a8fffb9d1a66312ea4d
SHA512 0e5470851b2793c48cc5c585e42eebafac094e9ad3bc52599aded633bac7e8ef9da48236ecabadc9ed367ba10fa4989ff4b7deb7b2a04723c3f615401a32619a

C:\Users\Admin\AppData\Local\Temp\CD72.tmp\BitBlt.exe

MD5 8428347af1645d2b41e91e8520a03ea3
SHA1 bfd7a39482ca2234e6f0a41484ae135ff41f71a0
SHA256 3b72231c02d755e7aa5a9d79fa73ab2d8b70e49bb24f60f3d2e58ec1be3558e5
SHA512 e76610e16cfa20172249706f0889f3373678237f45f06edbf8c5f9e9591217196b66e352d9a249464c7f1fd054eac188b5fec9d618e8118166703e85c4bcb838

memory/5256-178-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 e675d36d482c63716ffcfc6c579b9bf9
SHA1 99206edc67b0ec82c126e64757ac2928b877d830
SHA256 9f9a57d1ede614149c0215d188c769b322ecc588a092ae4c031d360d063a6c5a
SHA512 8e34b66862b18a3cb890d21e291822018a252aefe14694148b8858abc68e3ef2a2be9921975cb1cdc9707f911759323cff801e95f7f4858c735704242fd98c32

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ad5afbab4b93fb9349fd0a7e92a84250
SHA1 4917662e4bb2c6bf2f34c532659ce7e761b4f15f
SHA256 e2015762e4b4ad368a817bf21cc2d2ba8796cacfa0fd508437c6af6defd33692
SHA512 469d5ae4ab90b891ebeb18c1a510ce8897bb034a3891748207ca5c55842d562da0bba5f13a809b666eb6534ba60ad88250c84b7f9d5c2385c3d2bd290feaaa95

memory/5540-197-0x0000000000400000-0x000000000041D000-memory.dmp

memory/5752-201-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 99c294ab48a6838dea811874a755e8ba
SHA1 5d3e6668747e14b86a4b457e4706970da1272844
SHA256 54c0381fee45d49095ad7c2abd3e83a730365de45ad3a318234e61d7624ab66d
SHA512 4ffa7a3e4ad399c15100f420214cebb1d990fcec826711711805eb991a577b3606dc9cbe652bad1f80bd7f2a033e4aae9b9c1c8d636958b6ef9c1ff1b23eb2eb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 aa71e02906a3ff596f556eba6a4518be
SHA1 27b606fd6e24eddaf2a167ba6395cd3d831624ea
SHA256 cbdddfaf8d44875975a10add0d25091c9f81be6cd57414c3e8d4ff77b197bedf
SHA512 c573b76842afcc5f147eac739864751f629288445982786ae37757b557eb6d109306f64e195b3b65696e63be1bcf63c7eb4982252c01359daabfed80fc78d0c0

memory/5540-220-0x0000000000400000-0x000000000041D000-memory.dmp