hxxps://github[.]com/pankoza2-pl/HorrorTrojan

Resubmissions

11/05/2026, 17:41

260511-v9q3asfz2v

11/05/2026, 17:37

260511-v7dn7abs5l10

Analysis

user interaction
yes
max time kernel
146s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/pankoza2-pl/HorrorTrojan
Sample260511-v7dn7abs5l

Score

10^/10

bootkit defense_evasion discovery evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\windows\\winbase_base_procid_none\\secureloc0x65\\WinRapistI386.vbs\""	gdifuncs.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	gdifuncs.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	gdifuncs.exe

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	4940	chrome.exe

Executes dropped EXE 6 IoCs

pid	Process
5372	HorrorTrojan Ultimate Edition.exe
2476	HorrorTrojan Ultimate Edition.exe
4344	mbr.exe
4896	jeffpopup.exe
1180	bobcreep.exe
6104	gdifuncs.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
26	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Control Panel\Desktop\Wallpaper = "c:\\bg.bmp"	reg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	\??\c:\windows\winbase_base_procid_none\secureloc0x65\gdifuncs.exe	cmd.exe
File opened for modification	\??\c:\windows\winbase_base_procid_none\secureloc0x65\gdifuncs.exe	cmd.exe
File created	\??\c:\windows\winbase_base_procid_none\secureloc0x65\mainbgtheme.wav	cmd.exe
File opened for modification	\??\c:\windows\winbase_base_procid_none\secureloc0x65\mainbgtheme.wav	cmd.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\HorrorTrojan Ultimate Edition.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeffpopup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bobcreep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdifuncs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HorrorTrojan Ultimate Edition.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HorrorTrojan Ultimate Edition.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Control Panel\Cursors\Arrow = "C:\\Windows\\winbase_base_procid_none\\secureloc0x65\\rcur.cur"	gdifuncs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\winbase_base_procid_none\\secureloc0x65\\rcur.cur"	gdifuncs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Control Panel\Cursors\Hand = "C:\\Windows\\winbase_base_procid_none\\secureloc0x65\\rcur.cur"	gdifuncs.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229946782853913"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\HorrorTrojan Ultimate Edition.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe
6104	gdifuncs.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe
Token: SeShutdownPrivilege	1168	chrome.exe
Token: SeCreatePagefilePrivilege	1168	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe
1168	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4896	jeffpopup.exe
1180	bobcreep.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 5064	1168	chrome.exe	79
PID 1168 wrote to memory of 3576	1168	chrome.exe	80
PID 1168 wrote to memory of 3576	1168	chrome.exe	80
PID 1168 wrote to memory of 4940	1168	chrome.exe	81
PID 1168 wrote to memory of 1324	1168	chrome.exe	82
PID 1168 wrote to memory of 1324	1168	chrome.exe	82
PID 1168 wrote to memory of 5772	1168	chrome.exe	83
PID 1168 wrote to memory of 1636	1168	chrome.exe	84
PID 1168 wrote to memory of 5772	1168	chrome.exe	83
PID 1168 wrote to memory of 1636	1168	chrome.exe	84
PID 1168 wrote to memory of 4332	1168	chrome.exe	85
PID 1168 wrote to memory of 4332	1168	chrome.exe	85
PID 1168 wrote to memory of 1616	1168	chrome.exe	88
PID 1168 wrote to memory of 5296	1168	chrome.exe	90
PID 1168 wrote to memory of 5372	1168	chrome.exe	91
PID 5372 wrote to memory of 5468	5372	HorrorTrojan Ultimate Edition.exe	92
PID 1168 wrote to memory of 6112	1168	chrome.exe	93
PID 1168 wrote to memory of 3400	1168	chrome.exe	94
PID 1168 wrote to memory of 4360	1168	chrome.exe	95
PID 1168 wrote to memory of 2476	1168	chrome.exe	96
PID 2476 wrote to memory of 2528	2476	HorrorTrojan Ultimate Edition.exe	97
PID 2528 wrote to memory of 4344	2528	wscript.exe	98
PID 2528 wrote to memory of 5500	2528	wscript.exe	99
PID 5500 wrote to memory of 3068	5500	cmd.exe	101
PID 5500 wrote to memory of 1684	5500	cmd.exe	102
PID 5500 wrote to memory of 3088	5500	cmd.exe	103
PID 5500 wrote to memory of 4764	5500	cmd.exe	104
PID 5500 wrote to memory of 5124	5500	cmd.exe	105
PID 5500 wrote to memory of 5716	5500	cmd.exe	106
PID 5500 wrote to memory of 2024	5500	cmd.exe	107
PID 5500 wrote to memory of 3908	5500	cmd.exe	108
PID 5500 wrote to memory of 3460	5500	cmd.exe	109
PID 5500 wrote to memory of 5672	5500	cmd.exe	110
PID 5500 wrote to memory of 2200	5500	cmd.exe	111
PID 5500 wrote to memory of 5552	5500	cmd.exe	112
PID 5500 wrote to memory of 5348	5500	cmd.exe	113
PID 5500 wrote to memory of 5188	5500	cmd.exe	114
PID 5500 wrote to memory of 5572	5500	cmd.exe	115
PID 5500 wrote to memory of 5548	5500	cmd.exe	116
PID 5500 wrote to memory of 1692	5500	cmd.exe	117
PID 5500 wrote to memory of 5472	5500	cmd.exe	118
PID 5500 wrote to memory of 5220	5500	cmd.exe	119
PID 5500 wrote to memory of 5324	5500	cmd.exe	120
PID 5500 wrote to memory of 5488	5500	cmd.exe	121
PID 5500 wrote to memory of 5644	5500	cmd.exe	122
PID 5500 wrote to memory of 5768	5500	cmd.exe	123
PID 5500 wrote to memory of 1532	5500	cmd.exe	124
PID 5500 wrote to memory of 5732	5500	cmd.exe	125
PID 5500 wrote to memory of 744	5500	cmd.exe	126
PID 5500 wrote to memory of 2452	5500	cmd.exe	127
PID 5500 wrote to memory of 3896	5500	cmd.exe	128
PID 5500 wrote to memory of 4064	5500	cmd.exe	129
PID 5500 wrote to memory of 2492	5500	cmd.exe	130
PID 5500 wrote to memory of 1552	5500	cmd.exe	131
PID 5500 wrote to memory of 1768	5500	cmd.exe	132
PID 5500 wrote to memory of 2140	5500	cmd.exe	133
PID 5500 wrote to memory of 1172	5500	cmd.exe	134
PID 5500 wrote to memory of 5776	5500	cmd.exe	135
PID 5500 wrote to memory of 1100	5500	cmd.exe	136
PID 2528 wrote to memory of 4896	2528	wscript.exe	138
PID 2528 wrote to memory of 1180	2528	wscript.exe	139
PID 2528 wrote to memory of 6104	2528	wscript.exe	140
PID 1168 wrote to memory of 560	1168	chrome.exe	143

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	gdifuncs.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/HorrorTrojan
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5253c728,0x7fff5253c734,0x7fff5253c740
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,5419624366464414127,12690847615344255743,262144 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,6360801769582815311,1491385002118553577,524288 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,18404691950154165290,14089782769109449718,524288 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2644 /prefetch:13
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,17685861942284560410,15351056319912215700,2097152 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,715889341934368538,10398301101880254531,2097152 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4164,i,2329708638977838122,8634159558817760147,2097152 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4216 /prefetch:9
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,17486690043873319609,13410540840897806627,524288 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,17388960871803647483,6771502139726068040,524288 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5296
- C:\Users\Admin\Downloads\HorrorTrojan Ultimate Edition.exe
  "C:\Users\Admin\Downloads\HorrorTrojan Ultimate Edition.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\3071.tmp\3072.tmp\3073.vbs //Nologo
    3⤵
    PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,2716259579920258134,7523201726551547174,524288 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,10979709029597887583,4541389645114721424,524288 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,4426997796736669486,16001228558247032896,524288 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:4360
- C:\Users\Admin\Downloads\HorrorTrojan Ultimate Edition.exe
  "C:\Users\Admin\Downloads\HorrorTrojan Ultimate Edition.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\7078.tmp\7079.tmp\707A.vbs //Nologo
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\7078.tmp\mbr.exe
      "C:\Users\Admin\AppData\Local\Temp\7078.tmp\mbr.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      PID:4344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7078.tmp\tools.cmd" "
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\Windows\system32\reg.exe
        
        reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
        5⤵
        Sets desktop wallpaper using registry
        
        PID:3068
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1684
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3088
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4764
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5124
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5716
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2024
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3908
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3460
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5672
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2200
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5552
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5348
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5188
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5572
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5548
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1692
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5472
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5220
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5324
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5488
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5644
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5768
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1532
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5732
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:744
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2452
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:3896
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:4064
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2492
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1552
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1768
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:2140
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1172
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:5776
    - - C:\Windows\system32\rundll32.exe
        
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        5⤵
        
        PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\7078.tmp\jeffpopup.exe
      "C:\Users\Admin\AppData\Local\Temp\7078.tmp\jeffpopup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\7078.tmp\bobcreep.exe
      "C:\Users\Admin\AppData\Local\Temp\7078.tmp\bobcreep.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\7078.tmp\gdifuncs.exe
      "C:\Users\Admin\AppData\Local\Temp\7078.tmp\gdifuncs.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies Windows Defender DisableAntiSpyware settings
      UAC bypass
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      System policy modification
      PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4468,i,10682429427282525806,15276945515035038725,262144 --field-trial-handle=1932,i,9571377968215614176,8129543848315502712,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4340 /prefetch:10
  2⤵
  PID:560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:772

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004C0
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a5b1ad10f4213ca37119b005f4c6b135a47d27943a3d8b8c72f242b039a06e5c
MD5 107841d672b29260a0934f703edb62b5
SHA1 f78e7f2451dcd5f28d6386d75e94ffdcbe5d3b1c
SHA512 4a2750dd98a51bc2feff9edaa174d7aa7637c11d3f0e95908347f6dc1fe471063e1a8ec1f24c8b221766db269c9ecca5156bcd4ba8375d332010abdcf1446a0d
TLSH
T13DE0E5AACE26EC3719F90B2820404301E75913562A51850F7B3D8B0A4FB1A3A4A4585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 77ba0db345e58cd847274ad1b2d7cbac315c04e332ba525e2bf561cf14879d32
MD5 b157344d7e03f0e75b1642d431c25d4c
SHA1 02f2d6cb730aa41ea722be2fab5856ad8fa73c55
SHA512 19fedf5cbdac2ead41a6f31555302e64f77dd4ff0aa2e58eac069bd2c323f4772bed2a46755ebeb4fe4ef9f7f4db5469b5b98948226ba31f195d653cec7c8c6b
TLSH
T15051E83D80F06718DF0462B5A4D0BD953572226D10D73FEFB5B9D2B66A33F97A481420
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 25b7fbb4fd079a2d0cd8c8e60d78490361040c720633ab0c2173649323ceb5f4
MD5 0ead42e48fb11595df521b99763b2a66
SHA1 8c39d85b1b950ba5b9dd6fbd9e5938b8a1811c08
SHA512 aeb6c7782bb64b80b6194371cfe18bd25a65e35518aba69ed66e2fae27698a6ec156b98ce551caba6e0434289e836cea3a8b6e57cb23ca1b62262439081bcc53
SSDEEP 96:MZAwCtWJQEKXhEjc8bfUO43LmNVpc9o75gNl6:MZAoihEjvbUvLmJ75gNl6
TLSH
T1B2B1933C03E10714FB4893B2E6E0FA9DF635511952D73FEEA179D9B6191270BA1820EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5663e75c0965a3dee8b70b0414f4a7bfd67586f186186edec73f70a6a1700094
MD5 b55579bc8c3d04c29cc4265107870fe2
SHA1 1cb57baaabcb4dd7614b471e1dbb7e4d7fde950f
SHA512 8b491e0fc294fe439cbaee43f36fcc88ce6129840d70e1979befd24b4c20a8bf793dbf9ec28808ec194c20af58d75c3e75e1b81d8a8706ea4b5e608f701954c6
TLSH
T1F481ABF783F4856D8B1195F0EA14AE1FCE280624431C7CB688E4AE4B97E3972D24079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dc2edcf8b185274867b0673a5bd0a5db8f3e80a4d234f34c97bb5da15926f1cd
MD5 1e5cf12653a4560092032177378e7e3d
SHA1 bb561fc2d7088071c9d0d2ee9db220fb8f220be5
SHA512 126ef814e7badf81585e221d686b522fe5723362ee41a1211a42da931c2c463921cde6552b8ba9b713be1f270fe564fb4941a9b6fc7e0c0d98fd80300eaea70f
SSDEEP 192:aRnanQuQPKv7gpAPRp2W5/99Hsb+WNnfp28Q2+y2CYkw0abRlxVyIsnAUge:aRna8GsUXT/wBu2t2jUa9lXe
TLSH
T10E42D66EBD18393B9CCBD21AF961B757E7F4102161942E88E7FC8A2C18D79CD6223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 17ec604a7bfbd64a6d70c4ed905820e2a503a6e7c5d8c3ddbfcfa582906475fd
MD5 e8b0b3c9a0200a263de15b261de8c629
SHA1 f8f389ef53f579d2a89a922bf9ecf9674198b4dd
SHA512 61693ccd210d5b316e00892215789e7dba9e9c9eb7c32d507acb8be8f669825e92fcb633eef55f490d96b48d97c9f526ac1b371eb34e59e21c132c1b87c6a195
SSDEEP 192:aRnqhmeuQP1v7gpAPRp2W5/99Hsb+WNnfp28Q2Yy2CYkw0abzlxVyIsnAUgE:aRnqnFsUXT/wBu2D2jUaHlXE
TLSH
T17E52E66EBC14393BACCBD21AF951B713E7F5102161942E88E7FC8A2C19DB9CD6223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9c044df41eb2cdf8aefb9c9fbd3809952ef76b12f880beade94dea1e4cd2eaae
MD5 ff42dd30a4c5222f1b947375e6498185
SHA1 08479578cabda7a9506b9fc0a9a3d97d5998a4cb
SHA512 34c679b3c416f0d607353a60307c6adffe2d207a51a256ba9bc93e6ee9d29ffc61a384ba5b57cffc8b5ba3952adda6e4bfe42b49bcfffded440b7b72d043abf8
SSDEEP 192:aRnqnQuQP1v7gpAPRp2W5/99Hsb+WNnfp28Q2+y2CYkw0abRlxVyIsnAUge:aRnq8FsUXT/wBu2t2jUa9lXe
TLSH
T14442D56EBD18393B9CCBD21AF961B757E7F4102161942E88E7FC8A2C18D79CD6223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3524c18e80e1db693cd098eb4ede054e2ba1bd8482140e88171b96904091af5f
MD5 5c14258b33e82791458b02a7296ce251
SHA1 2e1c7661d246108bd9b85f6ad629712c1959a6b7
SHA512 4e47fde5285226c2959def9dcd676d26e61553d9252c1180ae1059d6d33d2fce02a6fe7ce606b4df6df7563e976b4c8bc62d34e179217db9d4defbad2a74c612
SSDEEP 192:aRnq9meuQP1v7gpAPRp2W5/99Hsb+WNnfp28Q2Yy2CYkw0abzlxVyIsnAUgE:aRnqbFsUXT/wBu2D2jUaHlXE
TLSH
T1E852E76EBC14393BACCBD21AF911B713E7F5102161942E88E7FC8A2C18D79CD6223427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82085f58435b7b7a260780dca3ee69a48427de11b3ece82d53af0d56f36fd555
MD5 92547e8f34c99d1b69c0e1d957604d80
SHA1 4ca5a2d93853b96b7fc565a0e16045bbcee47e58
SHA512 aee9857bb3f81b98b9310e49ebca2773ad80f91201f0efac2260b404123571baef569acba1d144b7aa20664020dd07820f3547f4604d3bc6c7d155025f48eb07
SSDEEP 384:V3jBM7KxkXqKf/pUZNCgVLH2HfgslQwl7pLuLcifTuXODBU+ErU3bwxHGak5Je0o:VTBM7KxkXqKf/pUZNCgVLH2Hfgsi87pL
TLSH
T1DE72FA67AC4CAA370F94D6CCD827BE4FADB5020B65DD886883FA581903D5ADF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ab8e8897220a790048c11ea4d3932805e36772ffa571431e9b38df74662bcd7c
MD5 6d00c61449c9312f1eabf04c831647e3
SHA1 b6e71612cd5be5f26d1a2046b0cc5098fb2256d6
SHA512 2e90adebe8f1ef6e11cb5c620774e817b377aaf2ce78825673c98cfda82902423dfd8dd328f7184d7b48f6beb336f108bd2cf7f12fb13d76f4bba1f0a60f17f8
TLSH
T1BBB0123090017502C04702B0129298C832545F1DC705270653E469F5D8276A24015251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5837f3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5837f3.TMP
Size 96B
SHA256 427c1697f83c1b656b1ef4435e355b290f44166b026f7e48afb40bfdc7ad5792
MD5 637420f492b49651b4c65d87c32f630e
SHA1 21d79be7ed7c11a807cc6460490cfa9f44bda90b
SHA512 c1f4b2c4a56b3c053b8235dc37022fb0fdfe68a081501fd94b764d8ddd00268c1276aff54028d269cbf0fe2f5f2ec0b2d78a5d28f93817429fdae9c6ae2190b5
TLSH
T1D8B02220C0023302C08303B02AC0A2C830A0CF30CA032222A3E22A22CC20230C2280E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 681d14606bc8518d364904696d1cf3dd89a646910085d8e5f5a00362cd52cca4
MD5 34d4ada6c07aa474075f18b7c5ffdf62
SHA1 8f7cde43e7255dba544cf07981d18aaa47041fb4
SHA512 e03b1c25521b0782db0701e0a61c9dc45f6cba3d7025afda0a85ca31204b23af0b18ae3b3e325ff1184e2ce0c9e22e8d85716da842e0645a1e70d8265e44504a
SSDEEP 1536:5bXP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:h++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T1B19302F9AD1E7C7563ABD3D6A0079CAC4CD398CE1214567C31C76F0E14BA392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 2225a3a9f2eaa8a10857a5ed246fe48e8870e7256259c57868e951b9458e51d3
MD5 fc6b46573859350e8864341b756cb3a3
SHA1 2ba3c81a29e3c9e87f18cc7880b133d5f5174d48
SHA512 de3ba6b7dbcdb2e43ec94d70cb5f147623d0ca6c25ac2ee0d6e99bdbf6c9ee9a25d0503ef1d25ddac6f79c92747ce94f1944ba713ab2e8ea9495634d029af3bc
SSDEEP 1536:ebXP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:w++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T1379302F9AD1E7C7563ABD3D6A0079CAC4CD398CE1214557C31C76F0E14BA392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 d51f32b8e8d0084d7b67546be2ba6e219b9d97ad3b0492ead5acad8e6cba7757
MD5 d50ddb31518c47ebe27f1ba766303666
SHA1 dd9dc8016c272b1c4bc30b0a8db1c85180f2bc35
SHA512 c01b9340ebb289274866676529b38bbd885f98b7de82000fc76a831b34b980b04971a6a75fab7c5f65b4fca111be239f46bd2228b36bf7dd6be84f7ed52fe9b8
SSDEEP 1536:uboP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:n++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T16A9302B9991E7D79636BC296A0179CAC8CD3CCCE111455BC30C76F0E18BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 958f990aad3b4d94dd55886f84b6f5ea10dabda7ffcbbc42f041ca547bac2af0
MD5 6a37e55f3c57208a11df54e7255dd5a7
SHA1 6a7637339ff0a16396eb500678b85eda47e5891b
SHA512 e922b5fd11256cd14323f1373897b0696eb45548091637302e7b7cf8f06f4d08006a29b0e2fb6bdf0a0a7b59a4cc46dd978b0d76a80bd5d12def4482fc794031
SSDEEP 1536:eb+tP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:hl++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T1689312F9981E7C7963ABD6D6A0079CAC4CD388CE1614657C30C76F0E14BA392D35B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3073.vbs

Path C:\Users\Admin\AppData\Local\Temp\3071.tmp\3072.tmp\3073.vbs
Size 2KB
SHA256 85a07013575a6a890c7b1d26adaa52f17616c4cca673617aa1fc0992aa29dda1
MD5 a0679dce64fcf875f4208b823d4b85c0
SHA1 85abe3673db82bfe5b2c207dc98648e32afffea0
SHA512 1e2740a09acc5b0d679acfd740feb3556638f1b6029078668bbb7e067b356fcecf23c5b317b02888822cc180c0eb5cb7e2caf63d92a74515ebc5a1031d80f3a6
TLSH
T12941A6126BF70604B1F12F196D764A744E3BBF64A97AD20C198C2D4E0FF3A088864F67
MD5 SHA1 SHA512 TLSH

Submit Download

bg.bmp

Path C:\Users\Admin\AppData\Local\Temp\7078.tmp\bg.bmp
Size 6.6MB
SHA256 77897f44096311ddb6d569c2a595eca3967c645f24c274318a51e5346816eb8e
MD5 a605dbeda4f89c1569dd46221c5e85b5
SHA1 5f28ce1e1788a083552b9ac760e57d278467a1f9
SHA512 e4afa652f0133d51480f1d249c828600d02f024aa2cccfb58a0830a9d0c6ee56906736e6d87554ed25c4e69252536cb7379b60b2867b647966269c965b538610
SSDEEP 24576:SZujh649BMJ0vzqylHry3e/J4u5s/GYN5OdFPqxviioZkIDqKHLmWoM7pIytWMK6:r649b9Jy3eB4KelqZOkaM7afC
TLSH
T1F2661927FFD86884F039053694FA0708F311E98D371B8B9B556936B4F8E53C96E231A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bobcreep.exe

Path C:\Users\Admin\AppData\Local\Temp\7078.tmp\bobcreep.exe
Size 92KB
SHA256 00c9fdc8b877c7fb8365709155ab28cb3dac282ae7ec9fc9d47a78b408e0d13f
MD5 219cd85d93a4ed65a481f353a3de5376
SHA1 a38ab77caf5417765d5595b2fcd859c6354bf079
SHA512 367644e3bc3310207b5863b09688269c38a55540b8c87e71d66771c954d37d561ed09f3ee11b36c4c8f4a48b618b2e8debae3d93ff684d15305f93a3ade6b3d9
SSDEEP 1536:/O5I1MSx56Hj2UItX85ljPQIe9RoSbGF4q2L6OBIyHwPSYt:eeMSMHj/rj1SbGFl2L6CIIw5t
TLSH
T11393011ABB4C6D3AE4DCE7704CB7CB20C958FD063659636E3410377A2CBE28B26B0564
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeffpopup.exe

Path C:\Users\Admin\AppData\Local\Temp\7078.tmp\jeffpopup.exe
Size 780KB
SHA256 5ec45cc1a109f556d0cd44ba48d3bf11af556ee66dd8b78c94d3ef0e93735e8e
MD5 4151b988c9d5c550ccb6c3b49bf551d4
SHA1 10ff979be4a5bbacaf208bdbb8236b940208eed1
SHA512 c73947b534741c29340550066cd1a6b7cbb4387f3be8303f2d1d0cb21c6f430e0415c27daabc82d32570f421934db78dc840403de18aef09d5a4f0cbe4350e4d
SSDEEP 12288:+PAF3wUd2oMb8lGY0m40JwK5Q0WsRNX5afZH8slY3wNXaQj7ddeAIpGLL7dl8Qjm:+Tro1cH8aEL
TLSH
T12A0590D41741E5CCCB18B5F465B61AF632007AE2A8DAD61FBE2D201C22BB1CE950E5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbr.exe

Path C:\Users\Admin\AppData\Local\Temp\7078.tmp\mbr.exe
Size 1.3MB
SHA256 03fe34795ad0f91fc8eb8c9ebe8094541e4fb4d7095095f8b48f345c2a6d0f0c
MD5 74be3afd732dc010c8266326cc32127b
SHA1 a91802c200f10c09ff9a0679c274bbe55ecb7b41
SHA512 68fa03d640680e37614feccb56f4d41180724cb7c08ba25f9bea3830a44c03d635664d8e0255ab2d05d3613498f4a4dd4398b7971a2cb1c9ae3be93f944946e5
SSDEEP 24576:h2WrWkhiQNoRsXIWTVk0p7ZmdRvZHZBuQ5O3h3JMtbX:BbNoEIhrh0MtbX
TLSH
T163550993AACB0EB6CDD327F055C753766338DE208A26CF6BE608C5369E936C56C49701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tools.cmd

Path C:\Users\Admin\AppData\Local\Temp\7078.tmp\tools.cmd
Size 2KB
SHA256 cf965fcc5a7ca4d9245c706c88b4d5013fb84be27b0ec262facccfadf14bdca2
MD5 288bebe9f904e6fabe4de67bd7897445
SHA1 0587ce2d936600a9eb142c6197fe12a0c3e8472f
SHA512 7db8e7c1318bcab7cef2c02484a82f347a630443a644b546a5cc339a5a848d1a3e915255f9c357de6ee26817a55d1091d80e2a8e97f66afa5686b3d11ee56c3c
TLSH
T155513894CB35C7AA8C645C4456D676A8D1FD70CAF9BF440216B04CC68C2BD3CBB573A4
MD5 SHA1 SHA512 TLSH

Submit Download

YOUDIED 5.txt

Path C:\Users\Admin\Desktop\YOUDIED 5.txt
Size 74B
SHA256 c5e98b515636d1d7b2cd13326b70968b322469dbbe8c76fc7a84e236c1b579c9
MD5 05d30a59150a996af1258cdc6f388684
SHA1 c773b24888976c889284365dd0b584f003141f38
SHA512 2144cd74536bc663d6031d7c718db64fd246346750304a8ceef5b58cd135d6ea061c43c9150334ee292c7367ff4991b118080152b8ebc9c5630b6c5186872a3a
TLSH
T180A002CFCE424A512C0E6176E46EEC8CED98D218091DBCA16854D43F197535056B7B34
MD5 SHA1 SHA512 TLSH

Submit Download

HorrorTrojan Ultimate Edition.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\HorrorTrojan Ultimate Edition.exe:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
TLSH
T1CA900297040444480F5535C459DC9418B11E7554CD454688EC5140D6D98409D42E9416
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 224082.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 224082.crdownload
Size 15.0MB
SHA256 fc7e799742a1c64361a8a9c3fecdf44f9db85f0bf57f4fb5712519d12ba4c5ac
MD5 8f5a2b3154aba26acf5440fd3034326c
SHA1 b4d508ee783dc1f1a2cf9147cc1e5729470e773b
SHA512 01c052c71a2f97daf76c91765e3ee6ec46ca7cb67b162c2fc668ef5ee35399622496c95568dedffbaf72524f70f6afcfe90f567fbb653a93d800664b046cd5f2
SSDEEP 393216:l2iLiU7VXd6AKprP7iJx4J20cQ3qpalJZfhxGWqIcckC:l2iNObp4x820AS7nj
TLSH
T1ECF633017B155466CA0916B048EBC78712749C5B2B96FECBB33EB54A1F723A420F9ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdifuncs.exe

Path C:\Windows\winbase_base_procid_none\secureloc0x65\gdifuncs.exe
Size 5.0MB
SHA256 7c4f20624dd062a6c71d845d05c6328d5a903ca96398e2902506591b231ed585
MD5 c47c6a5111193af2c9337634b773d2d3
SHA1 036604921b67bbad60c7823482e5e6cb268ded14
SHA512 56698b7b2edc0f94d0f7172c853cbe67ac682d132df768659ebca0c169091acb36ffd0a6874c26e2fb35117061c91c9eca4312532ba778312e3d63cc77ce1262
SSDEEP 98304:+Qz+04D+i4DBz2NHlruSSDllNmd+5z/Le7q2:+QS04D+i4DZmLclKez/Lkq
TLSH
T1C936334A53B64C10F76E7DB4A8E823884E31BC657CF0967F7A913D931B2736C91908A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mainbgtheme.wav

Path C:\Windows\winbase_base_procid_none\secureloc0x65\mainbgtheme.wav
Size 19.0MB
SHA256 e147a3c7a333cbc90e1bf9c08955d191ce83f33542297121635c1d79ecfdfa36
MD5 1b185a156cfc1ddeff939bf62672516b
SHA1 fd8b803400036f42c8d20ae491e2f1f040a1aed5
SHA512 41b33930e3efe628dae39083ef616baaf6ceb46056a94ab21b4b67eec490b0442a4211eaab79fce1f75f40ecdc853d269c82b5c5389081102f11e0f2f6503ae7
SSDEEP 196608:t8fP1FdA29xTxVIVXAUPL7VsPBMHvUDJNkyhtTT0oj6+nHqoq:S/llE/0NDkyhf5q
TLSH
T13617FCD6A2F27850AE56CA33CF3D91FDF718E484AA45075A2135EF9450720F8C9CBB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-688-0x00000000008D0000-0x0000000000B5B000-memory.dmp

Download

memory/2016-695-0x0000026B7A310000-0x0000026B7A3BF000-memory.dmp

Download

memory/2476-1092-0x0000000001730000-0x00000000019BB000-memory.dmp

Download

memory/2476-642-0x0000000001730000-0x00000000019BB000-memory.dmp

Download

memory/2476-689-0x0000000001730000-0x00000000019BB000-memory.dmp

Download

memory/2528-643-0x0000019991210000-0x00000199912BF000-memory.dmp

Download

memory/2528-644-0x00000199912D0000-0x00000199912DC000-memory.dmp

Download

memory/2816-13-0x000001FD6E660000-0x000001FD6E70F000-memory.dmp

Download

memory/4344-624-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4896-665-0x00000000009B0000-0x0000000000C3B000-memory.dmp

Download

memory/5372-380-0x0000000001880000-0x0000000001B0B000-memory.dmp

Download

memory/5468-378-0x000001B0B15A0000-0x000001B0B164F000-memory.dmp

Download

memory/5468-379-0x000001B0B1660000-0x000001B0B166C000-memory.dmp

Download

memory/6104-693-0x0000000004F00000-0x000000000518B000-memory.dmp

Download

memory/6104-694-0x0000000008FC0000-0x00000000090A1000-memory.dmp

Download

memory/6104-669-0x0000000005D10000-0x0000000005D1A000-memory.dmp

Download

memory/6104-668-0x00000000052A0000-0x0000000005332000-memory.dmp

Download

memory/6104-722-0x0000000004F00000-0x000000000518B000-memory.dmp

Download

memory/6104-1038-0x0000000004F00000-0x000000000518B000-memory.dmp

Download

memory/6104-1068-0x0000000004F00000-0x000000000518B000-memory.dmp

Download

memory/6104-667-0x0000000005750000-0x0000000005CF6000-memory.dmp

Download

memory/6104-1096-0x0000000004F00000-0x000000000518B000-memory.dmp

Download

memory/6104-1143-0x0000000004F00000-0x000000000518B000-memory.dmp

Download

memory/6104-1154-0x0000000004F00000-0x000000000518B000-memory.dmp

Download

memory/6104-666-0x0000000000070000-0x0000000000572000-memory.dmp

Download

memory/6104-1178-0x0000000004F00000-0x000000000518B000-memory.dmp

Download