hxxps://github[.]com/pankoza2-pl/malwaredatabase-old

Resubmissions

03/03/2025, 18:11

250303-wsrsyavlz9 3

03/03/2025, 18:09

03/03/2025, 18:07

03/03/2025, 18:04

03/03/2025, 18:02

Analysis

max time kernel
122s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/malwaredatabase-old

Score

10^/10

bootkit defense_evasion discovery evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\windows\\winbase_base_procid_none\\secureloc0x65\\WinRapistI386.vbs\""	gdifuncs.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	gdifuncs.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	gdifuncs.exe

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 1 IoCs

flow	pid	Process
98	2864	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation	HorrorTrojan Ultimate Edition.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 5 IoCs

pid	Process
3744	HorrorTrojan Ultimate Edition.exe
1116	mbr.exe
8	jeffpopup.exe
1276	bobcreep.exe
3672	gdifuncs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
97	raw.githubusercontent.com
98	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Desktop\Wallpaper = "c:\\bg.bmp"	reg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	\??\c:\windows\winbase_base_procid_none\secureloc0x65\gdifuncs.exe	cmd.exe
File opened for modification	\??\c:\windows\winbase_base_procid_none\secureloc0x65\gdifuncs.exe	cmd.exe
File created	\??\c:\windows\winbase_base_procid_none\secureloc0x65\mainbgtheme.wav	cmd.exe
File opened for modification	\??\c:\windows\winbase_base_procid_none\secureloc0x65\mainbgtheme.wav	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HorrorTrojan Ultimate Edition.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeffpopup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bobcreep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdifuncs.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Cursors\Arrow = "C:\\Windows\\winbase_base_procid_none\\secureloc0x65\\rcur.cur"	gdifuncs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\winbase_base_procid_none\\secureloc0x65\\rcur.cur"	gdifuncs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Cursors\Hand = "C:\\Windows\\winbase_base_procid_none\\secureloc0x65\\rcur.cur"	gdifuncs.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133854987122493467"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe
3672	gdifuncs.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe
Token: SeShutdownPrivilege	3292	chrome.exe
Token: SeCreatePagefilePrivilege	3292	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe
8	jeffpopup.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3744	HorrorTrojan Ultimate Edition.exe
8	jeffpopup.exe
1276	bobcreep.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 4440	3292	chrome.exe	85
PID 3292 wrote to memory of 4440	3292	chrome.exe	85
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2904	3292	chrome.exe	86
PID 3292 wrote to memory of 2864	3292	chrome.exe	87
PID 3292 wrote to memory of 2864	3292	chrome.exe	87
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88
PID 3292 wrote to memory of 4524	3292	chrome.exe	88

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	gdifuncs.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/malwaredatabase-old
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa2e21cc40,0x7ffa2e21cc4c,0x7ffa2e21cc58
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4816,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5048,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5084,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5112,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5136,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5144,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5028,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4268
- C:\Users\Admin\Downloads\HorrorTrojan Ultimate Edition.exe
  "C:\Users\Admin\Downloads\HorrorTrojan Ultimate Edition.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3744
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\A8FE.tmp\A8FF.vbs //Nologo
    3⤵
    - Checks computer location settings
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\mbr.exe
      "C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\mbr.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      PID:1116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\tools.cmd" "
      4⤵
      Drops file in Windows directory
      PID:1484
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
        5⤵
        Sets desktop wallpaper using registry
        
        PID:4720
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4392
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:840
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5036
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1644
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1256
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2016
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3840
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3736
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4268
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4152
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5040
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3620
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1984
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3040
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4004
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2732
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4056
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2580
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2812
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3672
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1544
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1116
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2424
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5104
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4092
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4676
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5004
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:324
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2016
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:212
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3904
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:536
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4132
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2704
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\jeffpopup.exe
      "C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\jeffpopup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:8
  - - C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\bobcreep.exe
      "C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\bobcreep.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\gdifuncs.exe
      "C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\gdifuncs.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies Windows Defender DisableAntiSpyware settings
      UAC bypass
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      System policy modification
      PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4860,i,3686871210090180039,16762422217055566736,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:4960

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x324
1⤵
PID:1588

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YOUDIED 29.txt
1⤵
PID:4212

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YOUDIED 32.txt
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
4bcb7762fa1423eb44b78adeb83a08a4

SHA1
fa0e1af62da68e8e2ee5b5ae42c32519197a487a

SHA256
94862ca8a7461a8ad1392946d3c8b0ff2204f91f2a0bd95c101aaace0dd957b9

SHA512
2abc4651d53a2ab962bdd7e65e675a36639ba4cd772b0759852a6c454a6f9e1cfd0e987b3bca12273819656880c265abf3aa05fd5c795020bab4e814e1a20a4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c13c085e53fa671dbc1f47600df55fd8

SHA1
9a910bef926b2469cf34145837ac82710e6da101

SHA256
a9de32196272252de699fb75f41a0a7389f3f41fbce3d1809b2c089280d3eada

SHA512
2276eb631eb712550c39c5334ffd0d059e060656568b29e5ebab2d9482e9605f6f3b1b54509a317cf93c23ae0ffa782427a311f56383027a179df723e3578cd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c7af5e0c78fa96315aaea1a6a23310d2

SHA1
c27fc324011e52f330df29fddd5ceb5c384fa72c

SHA256
3fc6b3906034a513ff093e313b09c42b68726a2963004d0fc3e03aaead510bb4

SHA512
93b82fc7d3c27c483015a1fbc2c9f995c0f70de06d996177214055fefdb960d6a62d32521054347beb596e924793786767c5d6c78e4e0a5b8e549b6cce92659d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
803f46aa6347eca9b7c9275b29036f95

SHA1
8ee2ff51ff76e3af834082f0466cf55d835e7a6d

SHA256
8a77835eba5d7be04e2682f7694fa394d5a1bed15b089e6951c5f71e32eeb0d0

SHA512
fdd5d58a6dbc3c3da5dc9e31101f169174bdf69ab7cc1a699a2f7c4cd2d90ba2735881c38f8d270660dc169fff237e8b97fb9b9da77d67ed60373b91d6e89133

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
92f115a5ffb2c482205d2e16d34491d4

SHA1
d32af0c2509902df0e1b5d46cd3f6c7566d0022c

SHA256
a60b36bbe13978eafa2d3bde0fa2da542fbb6d099edce235f6b26d9e53a593b8

SHA512
2877bfdf8d7b1adfa1ee0a1fcd989c850d7cad192aadd45bc5d6125d687b32e9decb40a0bf5abd54d01514f2e23d5947b2526ef56d037a713e4382357217a67b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
fe05f1599f423f50c5347d92847c603e

SHA1
4f5606094706ce91246201c8e145ca47936154f0

SHA256
76846e9bd8c9be705c81a054c498e7846af5d6a4f78159e061c21a0591831f67

SHA512
77ac211d08977a554a33a233e8cf2979dd15ec704a3a4b7ac237f60935e301cd5c554f5bc4fb22a34287830af018e8661f25c5fef6b05b8f3afdac5914e33051

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
93525099cd04544c7ed7f42b45aa7a33

SHA1
eed0b124416abf8276e310a16e4bd76d24157081

SHA256
0c742dfe2e1fc1c9b2f22b73a87a5ccfb344fe86a1ea4924495a4248e67e84de

SHA512
229051e6c51223fce9d0c2c969421716ecdfd7a6ce9a2bd1e3c1172ce0df994954dcbfcf03b2ba2268669ca642d2d0b4ad1a8075b7f387b45fd2e391af3d3b54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
50772f6794e7934b93fa71208e9d50e6

SHA1
e6cb3084e45bbba4e78ff2e6dba2c87daa3fe527

SHA256
7238ee2dd3546bb69c184ec2cadb09d33bccec0cc01aa9a7e7d31d2507fd592b

SHA512
e09fc85c6a3242d7440c7af85990cd82b28f60a2c034af01a5b5d00f6f103eb64399fa67ca38c2a77df35b78e4210e12b070f94237c8d54f477f9eca318adddb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3399bafa3b5ddd6be66e20b53ea7222e

SHA1
5903decfa81ae3383df09afe42522a9f8a4fb6cc

SHA256
628112ba957912a59623d08e5467de3743f35fc1204d75029b0ffb230e80d564

SHA512
534a4c4dc6ce5df68db47b6588fb1ac37b115be4c10994791e57624c00158a7125eadc0baf3fb03ac4be82319ea8373a0249ca2946a341e89e59c419eee43aff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
949ce7792fcdac8ca28e28ae16ba7319

SHA1
fdcf146f9b1f40ecfe8c6582f863a6bec17fa644

SHA256
3ff9f571199c74ae73cde68dfcbd9cd5d07b01e8a4937baf5458c877df235f55

SHA512
8fe86cce83af21596b9c1c1073e743abe3003d118acddb5129313778f35d1481d71b0362d7a1de65ec2f2c5319eb6a5927b7dfa038b2e3e935e6bfdadd895bac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9e06b5c84dd20332ca7119930f4f046f

SHA1
b0880f47fd24fd8fbc42809d5c0c0138514f1222

SHA256
30f9e726e6e6b1e12dab3c23095fef50a066ede3db4e9778253a1587e49d3c01

SHA512
4b32644e182c5eaf8d17bfa55a3582d84448420761d07eb018d83059d821b5c5c6b9147656c0d6d8c1e989a460b64b5307bc8a7a1b42c06d4d6276c517f4a321

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7f476110fb1ff16972c89232d310ae96

SHA1
82422c5528e3945a97a6df85aae9d86502fe291f

SHA256
28a91844b095b794342ed6970d76b7ce25f42933ef5c5a8d30ff0f423cbf4de2

SHA512
b5a173e07830049f7a9639faea291f64416dda7b9edfab5de4c00b2c302307d67967fbf745e9c0bef373401f21eeea5fc6e57c99496641f4ff5a2cd50736e5f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d84e273557d9e02d493094eee1690e2c

SHA1
6f5a3f200d850e992c39d076def679187890cbcf

SHA256
ecee9507bb0f421b6e6e74d49031274557e3f07d153a5139da9d9fff59d4bbd5

SHA512
b18a9ef8686a728e001f10a58b44bee3c358c7de73928141392c5071918111dbf20956303308b29dddb6c02d3c5333a269c35909f9bb4583e523bf0bd28b093a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
09a9927c778a337bab2c3e593b9bf819

SHA1
8f9d2cbc5bba03c073dfdac5f9d8fd5108a7921d

SHA256
cf11da0325c818bf6bdc8097448653de827e51481a87b74975739f9117c22476

SHA512
e3b69897fdfb63c883eb7c943ed1ab4af556afda936109943d9103e14f7ce66b3647398fa307c93b67585130183b21ab96ada1359fd17a9caaa962fa9bd9ccbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
48313047f13dd4d3408675913899a72e

SHA1
878380799c4cf4d4ed29e25c89fa3673c938dc35

SHA256
e6be87f7cee66d45e883f21140b409b6789c077ec1849a27527404b7bcf274ed

SHA512
dca42d0189561443d226cba27b96d49dce6f165797a478e5c0a3776355461703d55cbbcdac0071b2729bcee244a653475d545b940a1e7cd096135d51435c5644

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9cd3922694e12832a81b7c1f09a14d23

SHA1
338cbc47db6bc28f7ff92eb64a54532a7e076b25

SHA256
09c7d0451aadda49c7ecb61c68546ffa78048437655bdb799b537b9980254c68

SHA512
1f4feba9b6d6a253b632c8db604f4c3b94e54833d024f00573f4ca62f21917d8f763c255e0a5cdcb755f3af0364992db23850c3c923b7f88e0eb030ac8637849

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cc7cd2ec4b500dd7b54875aba339b1ce

SHA1
f5cd48a41eda112fd410ba38e49569f747de30fc

SHA256
53efe53d49a58c4d75aea37f7672f10fbb3d79704f753784a1019cf07d83a695

SHA512
dafd10e536cc7e2157f4f8eba0ecd4e9c7260c9080e5045bb573ca3181dbb861e3d9b9a79d7aa09bfe634dfcb4aac9fe17e2f6125146d170e11a96a72fe507e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
f88a54361d5caa157ee9adae1b7a8214

SHA1
26917f23e472cf686a6a75ff30bfad8e8db1b5f1

SHA256
e6b2e6d0c2a5c211cab5c24cd4799e426051c0c3dad2b409af4d463b56810bce

SHA512
d9eda0de0405170969273e817499c7fabe1aad07437317afb08fbdc3d908b2271a397760c318bf5cb01e98b396312ce73ba515d60cb039ab305ce3a4a47112b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
f5ee66df894d1b02988546af7be6c24a

SHA1
b29c7319a07e1a36f1a0142fda5bec04751971f7

SHA256
756f96c715c8e0e37358377680a17c27ec0feb2b33ae4543495fce56774fb063

SHA512
a3fa33d392327309748e863014d86c7ff75b4f31bdb6ae4b31ae8038d5f16fb9a96b1a9c1b5365659d985535a3ff3032a0d52b6351ace132eea6a880bfa7a10d

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\A8FE.tmp\A8FF.vbs

Filesize
2KB

MD5
a0679dce64fcf875f4208b823d4b85c0

SHA1
85abe3673db82bfe5b2c207dc98648e32afffea0

SHA256
85a07013575a6a890c7b1d26adaa52f17616c4cca673617aa1fc0992aa29dda1

SHA512
1e2740a09acc5b0d679acfd740feb3556638f1b6029078668bbb7e067b356fcecf23c5b317b02888822cc180c0eb5cb7e2caf63d92a74515ebc5a1031d80f3a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\bg.bmp

Filesize
6.6MB

MD5
a605dbeda4f89c1569dd46221c5e85b5

SHA1
5f28ce1e1788a083552b9ac760e57d278467a1f9

SHA256
77897f44096311ddb6d569c2a595eca3967c645f24c274318a51e5346816eb8e

SHA512
e4afa652f0133d51480f1d249c828600d02f024aa2cccfb58a0830a9d0c6ee56906736e6d87554ed25c4e69252536cb7379b60b2867b647966269c965b538610

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\bobcreep.exe

Filesize
92KB

MD5
219cd85d93a4ed65a481f353a3de5376

SHA1
a38ab77caf5417765d5595b2fcd859c6354bf079

SHA256
00c9fdc8b877c7fb8365709155ab28cb3dac282ae7ec9fc9d47a78b408e0d13f

SHA512
367644e3bc3310207b5863b09688269c38a55540b8c87e71d66771c954d37d561ed09f3ee11b36c4c8f4a48b618b2e8debae3d93ff684d15305f93a3ade6b3d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\gdifuncs.exe

Filesize
5.0MB

MD5
c47c6a5111193af2c9337634b773d2d3

SHA1
036604921b67bbad60c7823482e5e6cb268ded14

SHA256
7c4f20624dd062a6c71d845d05c6328d5a903ca96398e2902506591b231ed585

SHA512
56698b7b2edc0f94d0f7172c853cbe67ac682d132df768659ebca0c169091acb36ffd0a6874c26e2fb35117061c91c9eca4312532ba778312e3d63cc77ce1262

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\jeffpopup.exe

Filesize
780KB

MD5
4151b988c9d5c550ccb6c3b49bf551d4

SHA1
10ff979be4a5bbacaf208bdbb8236b940208eed1

SHA256
5ec45cc1a109f556d0cd44ba48d3bf11af556ee66dd8b78c94d3ef0e93735e8e

SHA512
c73947b534741c29340550066cd1a6b7cbb4387f3be8303f2d1d0cb21c6f430e0415c27daabc82d32570f421934db78dc840403de18aef09d5a4f0cbe4350e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\mainbgtheme.wav

Filesize
19.0MB

MD5
1b185a156cfc1ddeff939bf62672516b

SHA1
fd8b803400036f42c8d20ae491e2f1f040a1aed5

SHA256
e147a3c7a333cbc90e1bf9c08955d191ce83f33542297121635c1d79ecfdfa36

SHA512
41b33930e3efe628dae39083ef616baaf6ceb46056a94ab21b4b67eec490b0442a4211eaab79fce1f75f40ecdc853d269c82b5c5389081102f11e0f2f6503ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\mbr.exe

Filesize
1.3MB

MD5
74be3afd732dc010c8266326cc32127b

SHA1
a91802c200f10c09ff9a0679c274bbe55ecb7b41

SHA256
03fe34795ad0f91fc8eb8c9ebe8094541e4fb4d7095095f8b48f345c2a6d0f0c

SHA512
68fa03d640680e37614feccb56f4d41180724cb7c08ba25f9bea3830a44c03d635664d8e0255ab2d05d3613498f4a4dd4398b7971a2cb1c9ae3be93f944946e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp\tools.cmd

Filesize
2KB

MD5
288bebe9f904e6fabe4de67bd7897445

SHA1
0587ce2d936600a9eb142c6197fe12a0c3e8472f

SHA256
cf965fcc5a7ca4d9245c706c88b4d5013fb84be27b0ec262facccfadf14bdca2

SHA512
7db8e7c1318bcab7cef2c02484a82f347a630443a644b546a5cc339a5a848d1a3e915255f9c357de6ee26817a55d1091d80e2a8e97f66afa5686b3d11ee56c3c

Download Submit
C:\Users\Admin\Desktop\YOUDIED 5.txt

Filesize
74B

MD5
05d30a59150a996af1258cdc6f388684

SHA1
c773b24888976c889284365dd0b584f003141f38

SHA256
c5e98b515636d1d7b2cd13326b70968b322469dbbe8c76fc7a84e236c1b579c9

SHA512
2144cd74536bc663d6031d7c718db64fd246346750304a8ceef5b58cd135d6ea061c43c9150334ee292c7367ff4991b118080152b8ebc9c5630b6c5186872a3a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 165549.crdownload

Filesize
15.0MB

MD5
8f5a2b3154aba26acf5440fd3034326c

SHA1
b4d508ee783dc1f1a2cf9147cc1e5729470e773b

SHA256
fc7e799742a1c64361a8a9c3fecdf44f9db85f0bf57f4fb5712519d12ba4c5ac

SHA512
01c052c71a2f97daf76c91765e3ee6ec46ca7cb67b162c2fc668ef5ee35399622496c95568dedffbaf72524f70f6afcfe90f567fbb653a93d800664b046cd5f2

Download Submit
memory/1116-514-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3672-552-0x0000000000C20000-0x0000000001122000-memory.dmp

Filesize
5.0MB

Download
memory/3672-553-0x0000000005FA0000-0x0000000006544000-memory.dmp

Filesize
5.6MB

Download
memory/3672-554-0x0000000005AF0000-0x0000000005B82000-memory.dmp

Filesize
584KB

Download
memory/3672-555-0x0000000006570000-0x000000000657A000-memory.dmp

Filesize
40KB

Download