mydoom | fd08c82277d56982a16196dfa852ebbbfdd67752619274a6ddb4ad4b123f5ba3

Resubmissions

12-01-2025 20:27

250112-y8qlxsxqgv 10

12-01-2025 20:17

250112-y2sgyaznep 8

12-01-2025 20:07

250112-ywfwysxlft 10

12-01-2025 19:55

250112-yngtaawrdt 10

Analysis

max time kernel
270s
max time network
459s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
12-01-2025 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99compress.py
Size

2KB
MD5

87ce3a21c9af0b3c2271e5ebe8f70658
SHA1

f299f35fc0693a9d196f53d0e7b60e94f6cc22ac
SHA256

fd08c82277d56982a16196dfa852ebbbfdd67752619274a6ddb4ad4b123f5ba3
SHA512

be03c98744791881f23db47d4cf9397a2c9cb0712344f1357f7cf1f67b95574b7c270a54c66074d78ffd092d984ec7ad57661e02c16578116339cf1edf08f7f7

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 1 IoCs

resource	yara_rule
behavioral1/memory/2748-505-0x00000000004A0000-0x00000000004AD000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000024fbf-492.dat	acprotect
behavioral1/memory/2748-502-0x000000007E1A0000-0x000000007E1A7000-memory.dmp	acprotect

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Configuration Utility.exe	Lacon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Configuration Utility.exe	Lacon.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe	Axam.a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe	Axam.a.exe

Executes dropped EXE 2 IoCs

pid	Process
1200	Winkwsg.exe
5860	WIN7ACA.pif

Loads dropped DLL 1 IoCs

pid	Process
2748	MyDoom.A.exe

Modifies system executable filetype association 2 TTPs 7 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Kiray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "c:\\windows\\temp\\Kiray.exe"	Kiray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microzoft_Ofiz = "C:\\Windows\\KdzEregli.exe"	Amus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Winevar.exe"	Winevar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN7ACA = "C:\\Windows\\system32\\WIN7ACA.pif"	WIN7ACA.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bndt32 = "C:\\Windows\\System32\\Bndt32.exe"	Lacon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MediaPath = "C:\\Rundll32.exe"	Gruel.a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Winevar.exe"	Winevar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Q4 = "f:\\quake4demo.exe"	Quamo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\NmUgBlrPZuChahpHFaVEsuoSXqCKEpkpFndeaRlLMuiqIAjpKCfUgwbnbJuXepOAHqOpxKHqFtOwyeJgPLcCYnwu = "\"C:\\Windows\\pgRaREiZazGFLHWUzSsumDwsUGTVCorfqkpacXvJt.exe\""	Yarner.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysaxam32 = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe"	Axam.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnceEX\DevicePath = "C:\\Rundll32.exe"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Rundll32 = "C:\\Rundll32.exe"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WIN7ACA = "C:\\Windows\\system32\\WIN7ACA.pif"	WIN7ACA.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XRF = "C:\\Windows\\system32\\PrTecTor.exe"	Duksten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Q4 = "c:\\eiram\\quake4demo.exe"	Quamo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\quake = "c:\\eiram\\quake4demo.exe"	Quamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\quake = "f:\\quake4demo.exe"	Quamo.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WIN7B95.tmp	WIN7ACA.pif
File created	C:\Windows\SysWOW64\Winkwsg.exe:Zone.Identifier:$DATA	Klez.e.exe
File created	C:\Windows\SysWOW64\Ska.exe	Happy99.exe
File created	C:\Windows\SysWOW64\wsock32.ska	Happy99.exe
File created	C:\Windows\SysWOW64\PrTecTor.exe:Zone.Identifier:$DATA	Duksten.exe
File created	C:\Windows\SysWOW64\No Call List.exe	Lacon.exe
File opened for modification	C:\Windows\SysWOW64\Winkwsg.exe	Winkwsg.exe
File opened for modification	C:\Windows\SysWOW64\DALLAH.exe	Maldal.a.exe
File opened for modification	C:\Windows\SysWOW64\WIN7ACA.pif	Winevar.exe
File created	C:\Windows\SysWOW64\WIN7ACA.pif:Zone.Identifier:$DATA	Winevar.exe
File created	C:\Windows\SysWOW64\Ska.exe:Zone.Identifier:$DATA	Happy99.exe
File opened for modification	C:\Windows\SysWOW64\PrTecTor.exe	Duksten.exe
File opened for modification	C:\Windows\SysWOW64\Bndt32.exe	Lacon.exe
File created	C:\Windows\SysWOW64\DALLAH.exe	Maldal.a.exe
File created	C:\Windows\SysWOW64\Bndt32.txt	Lacon.exe
File created	C:\Windows\SysWOW64\WIN7ACA.pif	Winevar.exe
File created	C:\Windows\SysWOW64\Winkwsg.exe	Klez.e.exe
File created	C:\Windows\SysWOW64\Ska.dll	Happy99.exe
File created	C:\Windows\SysWOW64\PrTecTor.exe	Duksten.exe
File created	C:\Windows\SysWOW64\Winkwsg.exe	Winkwsg.exe
File created	C:\Windows\SysWOW64\shimgapi.dll	MyDoom.A.exe
File created	C:\Windows\SysWOW64\ZippedFiles.a.exe	ZippedFiles.a.exe
File opened for modification	C:\Windows\SysWOW64\No Call List.exe	Lacon.exe
File opened for modification	C:\Windows\SysWOW64\Ska.exe	Happy99.exe
File opened for modification	C:\Windows\SysWOW64\wsock32.dll	Happy99.exe
File created	C:\Windows\SysWOW64\Bndt32.exe	Lacon.exe
File created	\??\c:\Windows\SysWOW64\regme.reg	Merkur.exe
File opened for modification	C:\Windows\SysWOW64\Winkwsg.exe	Klez.e.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2748-469-0x00000000004A0000-0x00000000004AD000-memory.dmp	upx
behavioral1/files/0x0008000000024fbf-492.dat	upx
behavioral1/memory/2748-505-0x00000000004A0000-0x00000000004AD000-memory.dmp	upx
behavioral1/memory/2748-502-0x000000007E1A0000-0x000000007E1A7000-memory.dmp	upx
behavioral1/memory/2936-470-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/4664-468-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/files/0x0002000000025cd0-559.dat	upx
behavioral1/memory/4664-6347-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	\??\c:\program files\kazaa\my shared folder\Virtual Sex Simulator.exe	Merkur.exe
File created	\??\c:\program files\eDonkey2000\incoming\Virtual Sex Simulator.exe	Merkur.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\CLASSFILE_CONSTANTS.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JAWT.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JNI.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JVMTI.H	ZippedFiles.a.exe
File created	\??\c:\program files\kazaa\my shared folder\IPspoofer.exe	Merkur.exe
File created	\??\c:\program files\bearshare\shared\IPspoofer.exe	Merkur.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\JAWT_MD.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLN.XLS	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLN.PPT	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JDWPTRANSPORT.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLN.DOC	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLV.DOC	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLV.XLS	ZippedFiles.a.exe
File created	\??\c:\program files\bearshare\shared\Virtual Sex Simulator.exe	Merkur.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\JNI_MD.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JVMTICMLR.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\BRIDGE\ACCESSBRIDGECALLBACKS.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\BRIDGE\ACCESSBRIDGECALLS.C	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\BRIDGE\ACCESSBRIDGECALLS.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\BRIDGE\ACCESSBRIDGEPACKAGES.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLV.PPT	ZippedFiles.a.exe
File created	\??\c:\program files\eDonkey2000\incoming\IPspoofer.exe	Merkur.exe
File created	\??\c:\Program Files\mIRC\script.ini	Merkur.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SAMPLES\SOLVSAMP.XLS	ZippedFiles.a.exe

Drops file in Windows directory 46 IoCs

description	ioc	Process
File created	C:\Windows\bfsvc.exe	Xanax.exe
File created	\??\c:\WINDOWS\taskman.exe	Merkur.exe
File opened for modification	C:\Windows\Messenger.exe	Amus.exe
File created	C:\Windows\Pide.exe	Amus.exe
File opened for modification	C:\Windows\Adapazari.exe	Amus.exe
File opened for modification	C:\Windows\system\xanstart.exe	Xanax.exe
File opened for modification	C:\Windows\bfsvc.exe	Xanax.exe
File opened for modification	\??\c:\WINDOWS\taskman.exe	Merkur.exe
File opened for modification	C:\Windows\Pire.exe	Amus.exe
File created	C:\Windows\system\host.tmp	Xanax.exe
File created	\??\c:\Windows\Notepad.exe	Merkur.exe
File created	C:\Windows\notepad.exe	Yarner.a.exe
File created	\??\c:\windows\jk.bat	Bugsoft.exe
File opened for modification	C:\windows\System\AVupdate.exe	Gruel.a.exe
File opened for modification	C:\Windows\Pide.exe	Amus.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\LucKey.exe	Maldal.a.exe
File created	\??\c:\windows\screensaver.exe	Merkur.exe
File opened for modification	C:\Windows\KdzEregli.exe	Amus.exe
File created	C:\Windows\Meydanbasi.exe	Amus.exe
File created	C:\Windows\Anti_Virus.exe	Amus.exe
File created	C:\Windows\Cekirge.exe	Amus.exe
File created	C:\Windows\system\xanstart.exe	Xanax.exe
File opened for modification	\??\c:\Windows\System\AVupdate.exe	Merkur.exe
File created	C:\Windows\pgRaREiZazGFLHWUzSsumDwsUGTVCorfqkpacXvJt.exe	Yarner.a.exe
File created	C:\Windows\pgRaREiZazGFLHWUzSsumDwsUGTVCorfqkpacXvJt.exe\:Zone.Identifier:$DATA	Yarner.a.exe
File created	C:\windows\Program Files\Kazaa\My Shared Folder\Norton 2003 Pro.exe	Gruel.a.exe
File created	C:\Windows\KdzEregli.exe	Amus.exe
File opened for modification	C:\Windows\Meydanbasi.exe	Amus.exe
File created	C:\Windows\Ankara.exe	Amus.exe
File opened for modification	C:\Windows\Ankara.exe	Amus.exe
File opened for modification	\??\c:\windows\screensaver.exe	Merkur.exe
File opened for modification	C:\Windows\Cekirge.exe	Amus.exe
File created	C:\Windows\system\xanax.exe	Xanax.exe
File created	C:\Windows\LucKey.exe	Maldal.a.exe
File created	C:\WINDOWS\Start Menu\Programs\StartUp\creative.exe	Prolin.exe
File created	C:\Windows\notedpad.exe	Yarner.a.exe
File created	\??\c:\windows\mail.vbs	Bugsoft.exe
File created	C:\Windows\My_Pictures.exe	Amus.exe
File created	C:\Windows\Pire.exe	Amus.exe
File created	C:\Windows\Adapazari.exe	Amus.exe
File created	\??\c:\Windows\System\AVupdate.exe	Merkur.exe
File opened for modification	C:\Windows\pgRaREiZazGFLHWUzSsumDwsUGTVCorfqkpacXvJt.exe	Yarner.a.exe
File created	C:\Windows\Messenger.exe	Amus.exe
File opened for modification	C:\Windows\My_Pictures.exe	Amus.exe
File opened for modification	C:\Windows\Anti_Virus.exe	Amus.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2708	1980	WerFault.exe	150
2316	2936	WerFault.exe	143

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Duksten.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maldal.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Merkur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Happy99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Quamo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeltingScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prolin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winevar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anap.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Magistr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gruel.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mari.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsWorld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xanax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pikachu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yarner.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NakedWife.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nyxem.E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	White.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WIN7ACA.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Funsoul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Axam.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bugsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZippedFiles.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyDoom.A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyPics.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klez.e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trood.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "kIlLeRgUaTe 1.03, I mAke ThIs vIrUs BeCaUsE I dOn'T hAvE NoThInG tO dO!!"	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Internet Explorer\GPU	SearchHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe,0"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32\ThreadingModel = "Apartment"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Microsoft	WIN7ACA.pif
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx\PropertySheetHandlers	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32\ = "Shell32.dll"	Gruel.a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c0031000000000057592c78110050524f4752417e310000740009000400efbec552596157592c782e0000003f0000000000010000000000000000004a0000000000a27a3200500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell	Axam.a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\Registry\User\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\NotificationData	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Kiray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx\PropertySheetHandlers\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "Spitmaxa"	Axam.a.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "c:\\windows\\temp\\Kiray.exe"	Kiray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	Axam.a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InfoTip = "kIlLeRgUaTe 1.03"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon\ = "%1"	Axam.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe \"%1\" %*"	Axam.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellFolder	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Email-Worm\\Gruel.a.exe\" %1"	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon	Axam.a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ = "kIlLeRgUaTe 1.03"	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command	Axam.a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellFolder\Attributes = 00000000	Gruel.a.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe
File created	C:\creative.exe\:Zone.Identifier:$DATA	Prolin.exe
File created	C:\Windows\pgRaREiZazGFLHWUzSsumDwsUGTVCorfqkpacXvJt.exe\:Zone.Identifier:$DATA	Yarner.a.exe
File created	C:\Users\Admin\AppData\Local\Temp\NakedWife.exe\:Zone.Identifier:$DATA	NakedWife.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2496	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1652	chrome.exe
1652	chrome.exe
5048	msedge.exe
5048	msedge.exe
4204	msedge.exe
4204	msedge.exe
2624	msedge.exe
2624	msedge.exe
3148	identity_helper.exe
3148	identity_helper.exe
2172	msedge.exe
2172	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4992	Magistr.exe
4992	Magistr.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe
3844	Axam.a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeTcbPrivilege	1124	Klez.e.exe
Token: SeTcbPrivilege	1200	Winkwsg.exe
Token: 33	3852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3852	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
3844	Axam.a.exe
4072	NakedWife.exe
580	Amus.exe
4532	White.a.exe
1468	Pikachu.exe
2784	Quamo.exe
2000	Gruel.a.exe
4256	Mari.exe
228	Prolin.exe
1472	Merkur.exe
2804	Bugsoft.exe
5056	Maldal.a.exe
4664	Lacon.exe
3700	MsWorld.exe
4656	Kiray.exe
5868	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2880	1652	chrome.exe	83
PID 1652 wrote to memory of 2880	1652	chrome.exe	83
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 912	1652	chrome.exe	84
PID 1652 wrote to memory of 5044	1652	chrome.exe	85
PID 1652 wrote to memory of 5044	1652	chrome.exe	85
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86
PID 1652 wrote to memory of 4048	1652	chrome.exe	86

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\99compress.py
1⤵
- Modifies registry class
PID:1832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0d57cc40,0x7ffa0d57cc4c,0x7ffa0d57cc58
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,7411335819567366640,11607563174746509079,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1876,i,7411335819567366640,11607563174746509079,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1960 /prefetch:3
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,7411335819567366640,11607563174746509079,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2236 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,7411335819567366640,11607563174746509079,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,7411335819567366640,11607563174746509079,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4432,i,7411335819567366640,11607563174746509079,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:2592

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa1e1f3cb8,0x7ffa1e1f3cc8,0x7ffa1e1f3cd8
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,774851662558228222,5571154670741922340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:6280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3136

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\run.bat
1⤵
PID:4776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\run.bat" "
1⤵
PID:3136
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Amus.exe
  "Amus.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:580
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Anap.a.exe
  "Anap.a.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2512
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Axam.a.exe
  "Axam.a.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3844
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Brontok.exe
  "Brontok.exe"
  2⤵
  PID:4568
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Bugsoft.exe
  "Bugsoft.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\jk.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3100
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Duksten.exe
  "Duksten.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Funsoul.exe
  "Funsoul.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1132
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe
  "Gruel.a.exe"
  2⤵
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2000
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Happy99.exe
  "Happy99.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:724
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Kiray.exe
  "Kiray.exe"
  2⤵
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4656
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Klez.e.exe
  "Klez.e.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Lacon.exe
  "Lacon.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4664
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Magistr.exe
  "Magistr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Maldal.a.exe
  "Maldal.a.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5056
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\Flopy.vbs"
    3⤵
    PID:5764
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\Flopy.vbs"
    3⤵
    PID:6804
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\Flopy.vbs"
    3⤵
    PID:2200
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Mari.exe
  "Mari.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4256
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\MeltingScreen.exe
  "MeltingScreen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1400
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Merkur.exe
  "Merkur.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1472
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s c:\Windows\system32\regme.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\pr0n.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\MsWorld.exe
  "MsWorld.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3700
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\MyDoom.A.exe
  "MyDoom.A.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2748
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\MyPics.a.exe
  "MyPics.a.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:976
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\NakedWife.exe
  "NakedWife.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:4072
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Nyxem.E.exe
  "Nyxem.E.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 244
    3⤵
    - Program crash
    PID:2316
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Pikachu.exe
  "Pikachu.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1468
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Prolin.exe
  "Prolin.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:228
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Quamo.exe
  "Quamo.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2784
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Trood.a.exe
  "Trood.a.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1188
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\White.a.exe
  "White.a.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4532
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Winevar.exe
  "Winevar.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2996
- - C:\Windows\SysWOW64\WIN7ACA.pif
    "C:\Windows\system32\WIN7ACA.pif" ~~240876250
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5860
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Xanax.exe
  "Xanax.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 408
    3⤵
    - Program crash
    PID:2708
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Yarner.a.exe
  "Yarner.a.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2488
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\ZippedFiles.a.exe
  "ZippedFiles.a.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2984

C:\Windows\SysWOW64\Winkwsg.exe
C:\Windows\SysWOW64\Winkwsg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2936 -ip 2936
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1980 -ip 1980
1⤵
PID:808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:5396

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:5712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:5508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:8048

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:7208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:7560

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:4736

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:6340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:3788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:5184

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:6508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:5064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:7524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:5920

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Net-Worm\run.bat
1⤵
PID:5840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:5956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:7492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:7260

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:7320

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
PID:7764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7764 CREDAT:17410 /prefetch:2
  2⤵
  PID:6460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:8184

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Net-Worm\run.bat
1⤵
PID:6520

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Gruel.a.exe" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\run.bat
1⤵
PID:3520

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:8104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:7336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:7504

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
PID:7692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7692 CREDAT:17410 /prefetch:2
  2⤵
  PID:7484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7692 CREDAT:17414 /prefetch:2
  2⤵
  PID:4760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:7584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Autoexec.bat

Filesize
219B

MD5
b07df864ac7d9554450820704c688548

SHA1
074d19eaabc1d5c2b0a8ba45738c05037d2a3018

SHA256
184453618aa3e3e2f1d39e9e06ea41b8c33a7402c086010346bdfb4336142a30

SHA512
eebb7ee137d96d5031754616ba02ab8bfc5bf29b4a1154e059f65eec4c0fc97773a6c7c9e897aa1fe7dbb9bf77c9507b3d5f98f37c8fc0e5199b65ca65b9b87c

Download Submit
C:\ProgramData\Microsoft\Windows\AppRepository\StateRepository-Machine.srd

Filesize
3.0MB

MD5
97836e1ef8ea61b2259351c8bfde6504

SHA1
daff5d6971a783303eeaefd9afdc51f6ada3a5fd

SHA256
4ec8f801625ed3552f16a41e87175cfca2cc2d39cdc1f5be0bcf08d611026f2d

SHA512
7c0c2727663bf6c911ec7e585587deb424302cc260640ac3f32199a68e03d9255224642e7b123772145050489090288f7a408d77bbb67c5e7b33399724ae84fc

Download Submit
C:\Rundll32.exe

Filesize
100KB

MD5
b0feccddd78039aed7f1d68dae4d73d3

SHA1
8fcffb3ae7af33b9b83af4c5acbb044f888eeabf

SHA256
5714efd4746f7796bbc52a272f8e354f67edfb50129d5fdaa1396e920956d0d6

SHA512
b02b9476eeb9c43fcfef56949f867c1c88f152d65f3961a2838b8bff02df2383945aefb9a8c517ac78d79b5a9163c7677f5b6238f4624b1966994c9c09eb428d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
734B

MD5
e192462f281446b5d1500d474fbacc4b

SHA1
5ed0044ac937193b78f9878ad7bac5c9ff7534ff

SHA256
f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

SHA512
cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\46AB436101C868855D09AE1E7A71452E

Filesize
344B

MD5
b1716a663728565966c8f0ebdd4ed949

SHA1
67962ca6c1f7ccb84fc9482c97be48e721ce59ad

SHA256
e7cc9a9ef07ce3fda12c3fa02b6f24d1eaf50033b4167d543a2cc5c58ce5be6e

SHA512
2a5eec33d13562f4f859deb8dce9590d5f171192d91a0912bae6ecc681fafd98738969e39929e3aa6a67127a493b74b1ae96833282597d7983d89e17611ed684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
f0f09c8585382757a295f5f6c0f27cbe

SHA1
6e610974e6e9e53badbbdac58ed0da4d789e6327

SHA256
cbefb609fd3957a39372837d6c0d86d973a92499da3714f09a43f0edb5f677bb

SHA512
4e131a061530d6b5b2c624a96de1312ea0d9440c167ad3f031e17b5cfdae9dd667ae302905e1ce4618ba97de7e8e00db18f6e09567c102eff25bc4aef88ad4bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\46AB436101C868855D09AE1E7A71452E

Filesize
540B

MD5
5dd3a8e5c616510e7c576b12416569f4

SHA1
728831084e4eb2e34d70647590a163990cd1a5f1

SHA256
f250eb63389e717aaa105439138b2038f04060cf41571f6cb1a633df3d1095cc

SHA512
1e0f88a4a9ff0ca2713a4e4ad95d1be5fdabf0055444c8a55efda3bab1c3c0a60ab498268a3ee2edb9fe5d05764423b938d5f390eaf6742aed0b3875a4ff4b21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
991b7504a424fe8f3af4b4583d97c9f1

SHA1
33e1926f7427a505e863cc069e716bfa6c3d9e17

SHA256
3bfe649838068da7fdcf838e0f33a517bb89cfac002823dcf06d4c2e5700e1a3

SHA512
aa6585bb769172aca0f6e40ce9fea4be92edd1f03ffc64ae6b2607c0db84b66d7dc1afc18d3070b88ec8fb8314f98e4145f9bb407ea5b7eab431927e6f9d0c25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
ef2dc8ff29886d4ba495204a5a135a10

SHA1
b3677f53ce80f696fe4763d2278ab2c7c21792b0

SHA256
72b1278ff1956e5a505388cb27f386596c287c6bb0da75d101fc063ccf21982a

SHA512
e83656b2338097c06fe870537972f3603f5e8750c9e884c87f45a95b7a8cf5f419c5d8a607eaef975f4febd15f54aa237415a66c54cb505f664dc48bd3c64470

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
ef219c97c148225b6586ba7fe50bb12d

SHA1
e7ae6ed30fb5a9e01756dbb3623d7df2e0db4a37

SHA256
1f44edfe17ac6e78cca2069606bb710abae3209279c1d8aea922981a9b5d6461

SHA512
7fec6b66525eca91f2c2deefb1a6a1534c17affbdc8a8ca58eadd483caf0f03a745992b76fb88d4427aa4cc32db2f9710fc49fa153aa7901d16d235d6fdd6ba5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
32f1d9dedf44230802ae45210eca9817

SHA1
1161328f52a301c025615106b310e026a086d57f

SHA256
03c07a410eea3587883b642b1faa1cc1fa1be27db17e329f0b7deeb98938cc8b

SHA512
52f381cf48ea51284190d97b9abf70993dbf4fe30da7de777091918d34d8d6ae47b3e45fa726146bf758cfe3a92dd39a764c23261c27d695c52e7cf4c3bdfe8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c9f5e86dbea836671f35ec4cd2b0f1a8

SHA1
9549a21b602a2eddd14488fe6c7e3809373855f2

SHA256
fa484e5c86c8ae30a558f1bd98abb11a4ffd816c41b2b0769c7ef30b12b9575f

SHA512
bdd459448e721eca00dbe38a4dd20c90b28111f896e0013d2d36bcdb835041a5499e40dde80527644141ba86552f680cb0bf5419ccf7af7ee72db2cc54ff245c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
865B

MD5
cc21da71c5267ce4831954c0593d925d

SHA1
0f07228c21e53ecc4115a302ae1e46e6ede1ac08

SHA256
5bc2c704fb39d7e7a3d9ff9af49e647d6089b61822f858d330b87d65a2cdb68d

SHA512
443be022d6e2e7831bbcfac3435cfbd9e9f1e1f3fc6735a51987e81794ab7929352746ff645106911955620f5eafc5411bab3f5d0a4730e6fded3d0155db2b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9350b64c8d0477bf77a7821572937ccd

SHA1
42b71c8dc37ab085c425a16f55c4915a72e56f46

SHA256
78f3e16feac57e1857cb5fe19b20390eee5768e0fc4f25891ecbf1f7390df8b0

SHA512
95be80e400a222c4b104f35ff088e2a1e7d7951b9609fd8424a14fbe2aba6ebe26d70eb99a7875b6103e14191a2897a077689b69760fb93aa3bfbe252b33e42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e07bd61ea6026ac9af8148af68ff339a

SHA1
8aba7b3f4ccbdf69d1ac16b87e32e5424a12a4fd

SHA256
c9a7496d5049e36f6eeb8c0d334061a9145cd8af902bfb5f39a7afed7a9e655e

SHA512
59f4841f41119cf64d215a7bf7975d1a77d5691289e68736afde2f385d65073a3cc7fdbdb0b83f356f889bd7d5b09bf1a209fcd8c686b65f7d98ca16f490c69e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3708663d6494c6c787dbb5f8a428da2

SHA1
d2acc60547ea25d4db8542934f99552a79582a17

SHA256
b2aaa96c6d2944d0fe8898cd479e1dc06cf706ff80e728fe8bca158d5a41b9f7

SHA512
8ffdedae7553fe9ec9899ff1ff6913a6715ab2a49316468d997a58ab8fde93f2179dd638de7036a73eeb2811bc719b356e703e6cebfd77f95b2ddc2092b504ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17c7b5ff215b7f5282dcd3e360ead5eb

SHA1
1e3f7ad1665bc4a1af3ceee2921112739bb81567

SHA256
6225f9abf0137aa18d480983fabb9495af471c42d417e887832d0dcff9939f09

SHA512
ba2cebee9373c66046f358cdf03d537f87c09524e065a11ec6ea4fb0f9a7e7ecc5892407f42fc6e69c0c6bb357db9ed5065186a6f861dcff1d1b3d929238a102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4eefd98a0905b8207cc8c04caaa0b6c

SHA1
c0ffdae4de51354a9d22af959b988980a28b5376

SHA256
4cbcb27f325f7d481d8099fb9fd27be19562f151843c16146ec6d364f4df1a4b

SHA512
8295dd4f522954bdae7286a03c3e5c7d4b4aaf220e0338700054270191d45af5eed87439ea9f2a2876e4a6d638006206197b443eaae5a4ed641b78e98410f49c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
21c09941b32d07cdc8b16ed6571a52ed

SHA1
24a3921de4cfd344e889c285d3f20bbb62ddb258

SHA256
5f76127253088d3f2dc8378ea9c92fc01d1537527ee6acb3547a6196ee4d9077

SHA512
fdf6bc4a86d0e6104cfa1b4ff32a3f995504b6dcf6366e69555f3e671c1212f279c19e10fe7f5ddfc06c1016a7a528786c80f8af6c3e011d00e65ba3d2a03761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
acfdfcaa0b3b153f4ef3661eb8db4bad

SHA1
be9b9cfb428f10d4fcc6dc9fc2f778c09dcba62f

SHA256
d238bee0f36916ab3677eea930afe21c775d5df79c5239bdae7512fe571026a2

SHA512
dafe31e94696286e3c7fbd108166b303c87cbe2f428d04c2453761913a00604f720396a0224c2829fad33f98f3f2bb161ee5fd9f8a8df5b26b8740bd8a978b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0294fea1c609fcc0a5fa03d658cfb510

SHA1
f23b3289b50115805c8dc31b91cef87670639886

SHA256
39cb2d9294808f9a6358eb24072a45ce1ed06b4b159b8f9dc63d6a2efa02fb24

SHA512
cec69b86ee84a5c9b51027944fc654a8aedd1a6f5500e18935075c137df2f7aa2c376ba307c7e8d99556e56858b3b9566c3185142b0aa75752cf89a0891918bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5824d9.TMP

Filesize
1KB

MD5
501615a87651ba9e85c9c493b5d805df

SHA1
06d5e1a4efba9c989841dc1019f2a85a0b72ba31

SHA256
f0a7dc3ac34998a5291e13dfc3050ba05e7678de32674f4b883f5b21a1693402

SHA512
e3841125bce0b6e97f89487911a0a6bf72de081a1abdfcb8db4f15666052ce4ca029326919a7b830312833624167e4fa7ccff30fd353a18d546a71d11fc51327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03d26cc89399ab611fb4091e371ea8d9

SHA1
424d4258a960439ba29ff20d1c70067a31534356

SHA256
46356b9fb7cf51c790d9bc66dfe7763a88a142fc6f2f8e171b6fba15efca03a3

SHA512
ce7526ae0f2708a51bbebb7206a806c95b50b268f6fa6450fb48f02023aaacb4cde826fbe3ad1cd00bf69f8bfbd89cc430914ba7e9c87d99a83fa1f4cbd552bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7163f7aa5db3e77ff4f5a4ce66c2279e

SHA1
dae73a56608af1a21bcef65a4b15495297e882c9

SHA256
6247d2e5739e774f4b158c8854cd02e5b6c65eb0289f06c2dcc9bd9762263b47

SHA512
f793ff8cdb98a91d7d6a712297e5fec8363258b94b754b3efd87e2d2f1990e1904f8c74fdef7c2545ab0471bbc19d79a02008a8c8f1a63673774e24eeafd829a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FEB372E9-D121-11EF-AC6B-CAF734041EBF}.dat

Filesize
5KB

MD5
15c3885c6d01de0b98a507e38ee28b11

SHA1
a513782dd256efedb33b59a48f857cee35797ece

SHA256
95999c6c983a0b7a7d3566670e9486175455a16b645df2a8ff6f54d7f67b21d1

SHA512
be214d92e3cfea4f292d36f6a571d7f4cceb4ed345ab3e0e34129543a34687108b53e50f846698a7b03548c2c6e6029f2b90ee11e131f353badb13d73487203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TXFXF28K\IG5R933T.htm

Filesize
22KB

MD5
414f44245560b0cbf493b92ccc693824

SHA1
a9351567f43ac1716539af0dbba9f685902b9740

SHA256
8daae2979e9304925686e362c3248df68aad0a2eaeff12a85ee4f0bfebce5565

SHA512
62dba9b190343e04482e78e7e8a76796d060d56e58d3436460a85873d6e873439443a8fd6130a3de24134038509c6974b5a153989fb47d5898c7473475cd7be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TXFXF28K\mastodon-light-4b26baf5.chunk[1].css

Filesize
282KB

MD5
cad853db44e9d42100c0796f54f86901

SHA1
6003f5d5af7348736f7ff43e8718464f7f3ad21c

SHA256
713ca74e39054488229c693de4d00911174f643482ccfc0fd42b47b8d5a3e0e7

SHA512
28adee97be1c6c0e2e0f8e6879277e7999775503f9dd28d58c3e30a832bde035bd6e270b46869197c05124c0594dda7a114befadca0fde7b1a17f37cd0b6414f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YJFDRUAP\default-552e3396.chunk[1].css

Filesize
272KB

MD5
fbf89f86d7254540d0831cf826495341

SHA1
d36b2c64d0cb211a44e5ef14d3cc11a4f173ec96

SHA256
0e183853d188d0705d87bb42df98524b29ce5153080ee770a0f0ecdbbb38361e

SHA512
84ab342e7cf2c9077077f010949caa8f889098b93f404cd9c580f5c22631dbdfb05dee3960dbacd64397780ec3330ac9c0c026ae6ab67eaec78d3ff04accb7ce

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D

Filesize
313B

MD5
69505090b784df89579202b0f2861b96

SHA1
b4f97f33926a55ccd1689e4bfb2416408d657472

SHA256
80a6cba2a9614a4abaab282c4432622239ae2217c4f33ae7999f72c6dae3d096

SHA512
bf368918c2afc0ae71bb0e288869d1e36374af70c60c1e4eb52ae7cb09472fb02a56b52560abc7eb0858e428e49a11f9f695b25691e304e8c1e07423f48db3df

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D

Filesize
400B

MD5
fff9117aa83c2bc761ead1118ba5aa00

SHA1
45d1122cd3c4d8d1731c25c2a8c6caafc84aba39

SHA256
76c23071539c1a6f095da29d79b6c8a70fe33d127df3459269d4950e8fcd14d7

SHA512
0224eb73e7fcef4bcedd10173d857b3c92dea0385319b9b3b3dfbc21a0ea0ccbe135238e9fbf64ef60b5169fe75ba286ef81a56f3f6b340320c39103725eed1e

Download Submit
C:\Users\Admin\AppData\Roaming\Axam.exe

Filesize
11KB

MD5
0fbf8022619ba56c545b20d172bf3b87

SHA1
752e5ce51f0cf9192b8fa1d28a7663b46e3577ff

SHA256
4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74

SHA512
e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Klez.e.exe

Filesize
119B

MD5
d6174dce867e791a3a08df6b8b772598

SHA1
b777cc1c3538f92212c36d8bdf5665b5e0976b0f

SHA256
47b92d9da91c884b7cb01ba401b5591c7b5cec7d24abc2b08a2d72a86eca8576

SHA512
cb1c36e8297cea3f173263d3a01d00c5cb2669a2d13a3fb1849132bb345400ed9be5affdade63fcd5eddafdfa6990e868befe02d37777f9995ed4272371bb937

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\San.html

Filesize
245B

MD5
18d802682e56932335bf9232a279dee1

SHA1
816232feba6560b19cba6ca7f6ef161150ad33d5

SHA256
c6339aec72a19b3dc5cae2fc9f7887a44d27d0173f6c29d19235c24e5cfb5bff

SHA512
851481ebfae368ac254276c4f1f4929c35208605ed5e99f30c73cf9086fe4109412e8f0779b80fbb3dc0b43c4dadebe0539b1aa406b3d9c1d1249de5570533d1

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\Sharoon 1.exe

Filesize
80KB

MD5
cbcd34a252a7cf61250b0f7f1cba3382

SHA1
152f224d66555dd49711754bf4e29a17f4706332

SHA256
abac285f290f0cfcd308071c9dfa9b7b4b48d10b4a3b4d75048804e59a447787

SHA512
09fdcb04707a3314e584f81db5210b2390f4c3f5efa173539f9d248db48ae26b3a8b240cf254561b0ecb764f6b04bb4c129832c6502d952d1960e443371ce2a9

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Email-Worm\run.bat

Filesize
47B

MD5
8d35d0d7e1ca3075d84850f9617cd7db

SHA1
1fd7e994754451736b44e0deb7e1c9574fde6697

SHA256
e79bfc6343f99089a97273021e1dabdad93900b87e83794ee1821dd5f19838bf

SHA512
e8f5935eaf90bcdb466888a3d7438d9b8cb6ebf03ea7c5aa64c9e4b9c3d91a8f66bd46906a259a007badfccc7dbebc4e80707f3d632b825b110ae952fbee4edf

Download Submit
C:\Windows\Flopy.vbs

Filesize
560B

MD5
24b79b368001cbe34074a2a5e67a2e06

SHA1
867a0ee94b5b2c8f54068e72de73eb819e3fa298

SHA256
19f27ae792655c4af7610272b5a05667d2d81e05a4d346abd5c35715d29e9900

SHA512
8debb8148a432cd4c906e42f5535513bd7828eb8461b0e54b7602e38c041a0421bd11c619ca7d9af8e1905cde3af27f11ba7ca220ef3b567caf48b62ebcbde3c

Download Submit
C:\Windows\Messenger.exe

Filesize
50KB

MD5
47abd68080eee0ea1b95ae31968a3069

SHA1
ffbdf4b2224b92bd78779a7c5ac366ccb007c14d

SHA256
b5fc4fd50e4ba69f0c8c8e5c402813c107c605cab659960ac31b3c8356c4e0ec

SHA512
c9dfabffe582b29e810db8866f8997af1bd3339fa30e79575377bde970fcad3e3b6e9036b3a88d0c5f4fa3545eea8904d9faabf00142d5775ea5508adcd4dc0a

Download Submit
C:\Windows\SysWOW64\No Call List.exe

Filesize
12KB

MD5
cb0f7b3fd927cf0d0ba36302e6f9af86

SHA1
32bdc349a35916e8991e69e9be1bd2596b6321cc

SHA256
9b3f73a12a793d1648f3209e1e3f10bbb548b1ec21d53b8ac060b7b95ae4ef1f

SHA512
e6152f3645d73c63f3f3aa9881fe8b404f9794b14a8ecaea659621828462baf042c13c88bb7f2c32277fa854ceda3056d09aa5603e92b107c6c8194464154252

Download Submit
C:\Windows\SysWOW64\WIN7ACA.pif

Filesize
89KB

MD5
e79d0b1a342712ea9b96104086149d65

SHA1
a10177aafebb035e104eb22d30bdacb3894e0e1e

SHA256
e68ebecd17bb8e91079bd4fe9bd24059a2bc007b4baac477127eda7c5d5c6706

SHA512
f8cf1b773024784fe28f29af2200ad1d8f333b0dc251a1d39bef5a988c0c08c24328a6d9bbeea0370454c46c76835887f4792a55ec4f21608fa60b26977f27bf

Download Submit
C:\Windows\SysWOW64\Winkwsg.exe

Filesize
83KB

MD5
9f145cf0ccd0874ddf9545fd5eeb4b39

SHA1
e0d66a055a671f895b5e8f0ffb8e927695958776

SHA256
fa227468297376315a57444c39976ab8adeac12f579b9c68ae6944a9785f5ce3

SHA512
1474b931710d3c1ca53f59993ab197a41c8be6cae2a8c800fc52bac121f5ef7af99dc4e890b92381df9776345f5f80ff29f065a4947c5b41448bc6f60098cf62

Download Submit
C:\Windows\SysWOW64\shimgapi.dll

Filesize
4KB

MD5
8750df7c3d110ebc870f7afe319426e6

SHA1
a770fff05a829f666517a5f42e44785d6f0b4ae7

SHA256
fa3f934083746a702de18b927284f0145d4b82a92f2111693e93a4f762b50c00

SHA512
dfcbc2ba358ec40143e842d5242781a59943e646f50c41010a8cc4e2c5a15d5b19dcd2ee9556a0317ca73283e84d1f9d1b0b8b7470b493fe38e4e027336b8a2a

Download Submit
C:\Windows\System\AVupdate.exe

Filesize
44KB

MD5
e6f8f701d646b193139cf0a92229455f

SHA1
b7747d41fcf52c3611af1153e46183dacbb3c709

SHA256
7e89fabfdbe214bf6a6f9730f3e451e69f752b62bbd54c0a81d2aae2320abd2c

SHA512
135d69ed4b3acdeaf45639090cefd48fa02f9ff1fb168d249717d0e2d3295530b697d8ff3fea84fa20a66aeb99437e5b0f2a2c3936f2a109c1068816263003ae

Download Submit
C:\Windows\System\xanax.exe

Filesize
33KB

MD5
df24e1ccceb3c75dada950a1c1abca4d

SHA1
dc8120829a5593a3246d7bad126420282feaabca

SHA256
910c03d210381f0443bfcefe682717f28378dcfe5415071dd127a9837a97b0a6

SHA512
0df46654815eaeb13eca7e2bcd0fff6c62f34ddebe237dda41fc8dabfbf3512ceb12ef06a7c2bf9fcc52e0a4f87a886743b541d5b5b616eb9954e83892c429c7

Download Submit
C:\Windows\pgRaREiZazGFLHWUzSsumDwsUGTVCorfqkpacXvJt.exe:Zone.Identifier

Filesize
92B

MD5
c6c7806bab4e3c932bb5acb3280b793e

SHA1
a2a90b8008e5b27bdc53a15dc345be1d8bd5386b

SHA256
5ba37b532dbb714d29f33e79dacb5740096fd1e89da0a07b9b8e6b803931c61a

SHA512
c648be984413fdbaeb34808c8164c48b5441a8f3f35533b189f420230e5e90605c15fde2ce0d9fe42e9755c594dd1ef32de71a24016277ad2cef2f9afcf0ad93

Download Submit
\??\c:\Windows\SysWOW64\regme.reg

Filesize
126B

MD5
1065f6f41c70e40297555b6d1878e823

SHA1
18b6b3b6da306b12c7b1f197d6242d2f66703023

SHA256
ab59535ddcea09a82c549ab4f72e0459cc57e41f5b887c42afde0a1dc1ae9947

SHA512
25aac67f601ad21878bd0c92bec8e68433dbdb05621f74d5d23c0b0db1960313e695ce6082abaa82e7ab922323e1fbdd0f9a484ae2cf01abecf431cb4bee5ea8

Download Submit
\??\c:\windows\jk.bat

Filesize
3KB

MD5
a725af7c07b52549023be73328e55809

SHA1
c9d8072aaac80f6cf1edfaeaba6c934196631c81

SHA256
e009a52eeb2138531c799905010f7677b0fdd4190abe4ac0a25e0e15eb30d865

SHA512
d4cd904da5c6a5c6112d212b218abc76429da0e4d6382f4fbd9ca51a976eedef26e202607ff6041c4de7e9db783f62e5a24ee560fed068945aef69fa5491a3ce

Download Submit
\??\c:\windows\system\host.tmp

Filesize
100KB

MD5
8b8a7acdf42961b76b05ee980c4e6d48

SHA1
2f6b65ebc27beb0ea5818ca6bb8f997794ab158f

SHA256
48030ae86a728453f427952dd7827a34fd2dbd087e52b62b3a09030b3c3ebafd

SHA512
4d90bc7cba3520c3c46a997c6301dd4d1ce0173d80e48b5e71f248650d2b3a7d6ee8ac3901fd648d8cd751b9dd1bf3599ed96ebd8473ce64a0fcb20f8ebb68e7

Download Submit
memory/580-80777-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/580-463-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1980-471-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1980-672-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2488-42373-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2504-80778-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2504-466-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2748-505-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/2748-502-0x000000007E1A0000-0x000000007E1A7000-memory.dmp

Filesize
28KB

Download
memory/2748-469-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/2936-470-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2984-44770-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2984-62911-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2984-160808-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2984-122526-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2984-104456-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2984-43707-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2984-82832-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2984-144645-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2984-80771-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3844-464-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3844-2804-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4568-465-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4656-467-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4656-4323-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4664-468-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4664-6347-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download