download:

/Zusyaku/Malware-Collection-Part-2/blob/main/Ransomware/BadRabbit.exe

Full analysis: https://app.any.run/tasks/64b18f9f-98a2-4614-a4cd-a059b191f60b
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 25, 2023, 08:44:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
covid19
ransomware
Indicators:
MIME: application/json
File info: JSON data
MD5:

6D9D21090513F77D5DCC78209D97F658

SHA1:

90D6F47A911C5D3C5811C42732ADBDAF809BBA2D

SHA256:

F91049DFC6FFCAE84E3663BD097BFF6F28F0FE81BDD92708B3D480FEBA19F7AA

SSDEEP:

1536:Otz9DZxjDFBd9R9fBpNPAKptDx1r5VBtbfNbFfhNNl9FlddTNx99pB9NVV5Vlxvo:dF6s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Deletes shadow copies

      • cmd.exe (PID: 3052)
      • cmd.exe (PID: 560)
      • cmd.exe (PID: 2328)

    • Create files in the Startup directory

      • CoronaVirus.exe (PID: 3412)
      • CoronaVirus.exe (PID: 2348)

    • Creates a writable file in the system directory

      • CoronaVirus.exe (PID: 3412)

    • Renames files like ransomware

      • CoronaVirus.exe (PID: 3412)
      • CoronaVirus.exe (PID: 2348)

    • Actions looks like stealing of personal data

      • CoronaVirus.exe (PID: 3412)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • CoronaVirus.exe (PID: 2348)
      • CoronaVirus.exe (PID: 3412)

    • Reads the Internet Settings

      • CoronaVirus.exe (PID: 2348)

    • The process creates files with name similar to system file names

      • CoronaVirus.exe (PID: 3412)

  • INFO

    • Manual execution by a user

      • chrome.exe (PID: 2084)
      • explorer.exe (PID: 2984)

    • The process uses the downloaded file

      • chrome.exe (PID: 4032)
      • chrome.exe (PID: 2100)
      • chrome.exe (PID: 2436)
      • WinRAR.exe (PID: 1748)
      • chrome.exe (PID: 3228)
      • chrome.exe (PID: 2084)
      • CoronaVirus.exe (PID: 2348)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 2084)
      • chrome.exe (PID: 1596)
      • CoronaVirus.exe (PID: 3412)
      • CoronaVirus.exe (PID: 2348)

    • Drops a (possible) Coronavirus decoy

      • chrome.exe (PID: 2084)
      • CoronaVirus.exe (PID: 3412)
      • CoronaVirus.exe (PID: 2348)

    • Checks supported languages

      • CoronaVirus.exe (PID: 2348)
      • mode.com (PID: 3084)
      • CoronaVirus.exe (PID: 3412)
      • mode.com (PID: 2756)
      • mode.com (PID: 1376)

    • Application launched itself

      • chrome.exe (PID: 2084)
      • CoronaVirus.exe (PID: 2348)

    • Reads the computer name

      • CoronaVirus.exe (PID: 3412)
      • CoronaVirus.exe (PID: 2348)

    • Creates files in the program directory

      • CoronaVirus.exe (PID: 3412)

    • Process drops legitimate windows executable

      • CoronaVirus.exe (PID: 3412)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2540)

    • Creates files or folders in the user directory

      • CoronaVirus.exe (PID: 2348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

EXIF

JSON

PayloadAllShortcutsEnabled: -
PayloadBlobCsv: null
PayloadBlobCsvError: null
PayloadBlobDependabotInfoConfigFilePath: null
PayloadBlobDependabotInfoConfigurationNoticeDismissed: null
PayloadBlobDependabotInfoCurrentUserCanAdminRepo: -
PayloadBlobDependabotInfoDismissConfigurationNoticePath: /settings/dismiss-notice/dependabot_configuration_notice
PayloadBlobDependabotInfoNetworkDependabotPath: /Zusyaku/Malware-Collection-Part-2/network/updates
PayloadBlobDependabotInfoRepoAlertsPath: /Zusyaku/Malware-Collection-Part-2/security/dependabot
PayloadBlobDependabotInfoRepoOwnerIsOrg: -
PayloadBlobDependabotInfoRepoSecurityAndAnalysisPath: /Zusyaku/Malware-Collection-Part-2/settings/security_analysis
PayloadBlobDependabotInfoShowConfigurationBanner: -
PayloadBlobDiscussionTemplate: null
PayloadBlobDisplayName: BadRabbit.exe
PayloadBlobDisplayUrl: https://github.com/Zusyaku/Malware-Collection-Part-2/blob/main/Ransomware/BadRabbit.exe?raw=true
PayloadBlobHeaderInfoBlobSize: 432 KB
PayloadBlobHeaderInfoDeleteInfoDeleteTooltip: You must be signed in to make or propose changes
PayloadBlobHeaderInfoEditInfoEditTooltip: You must be signed in to make or propose changes
PayloadBlobHeaderInfoGhDesktopPath: https://desktop.github.com
PayloadBlobHeaderInfoGitLfsPath: null
PayloadBlobHeaderInfoIsCSV: -
PayloadBlobHeaderInfoIsRichtext: -
PayloadBlobHeaderInfoLineInfoTruncatedLoc: null
PayloadBlobHeaderInfoLineInfoTruncatedSloc: null
PayloadBlobHeaderInfoMode: file
PayloadBlobHeaderInfoOnBranch:
PayloadBlobHeaderInfoShortPath: 99b9e66
PayloadBlobHeaderInfoSiteNavLoginPath: /login?return_to=https%3A%2F%2Fgithub.com%2FZusyaku%2FMalware-Collection-Part-2%2Fblob%2Fmain%2FRansomware%2FBadRabbit.exe
PayloadBlobHeaderInfoToc: null
PayloadBlobImage: -
PayloadBlobIsCodeownersFile: null
PayloadBlobIsPlain: -
PayloadBlobIsValidLegacyIssueTemplate: -
PayloadBlobIssueTemplate: null
PayloadBlobIssueTemplateHelpUrl: https://docs.github.com/articles/about-issue-and-pull-request-templates
PayloadBlobLanguage: null
PayloadBlobLanguageID: null
PayloadBlobLarge: -
PayloadBlobLoggedIn: -
PayloadBlobNewDiscussionPath: /Zusyaku/Malware-Collection-Part-2/discussions/new
PayloadBlobNewIssuePath: /Zusyaku/Malware-Collection-Part-2/issues/new
PayloadBlobPlanSupportInfoRepoIsFork: null
PayloadBlobPlanSupportInfoRepoOwnedByCurrentUser: null
PayloadBlobPlanSupportInfoRequestFullPath: /Zusyaku/Malware-Collection-Part-2/blob/main/Ransomware/BadRabbit.exe
PayloadBlobPlanSupportInfoShowFreeOrgGatedFeatureMessage: null
PayloadBlobPlanSupportInfoShowPlanSupportBanner: null
PayloadBlobPlanSupportInfoUpgradeDataAttributes: null
PayloadBlobPlanSupportInfoUpgradePath: null
PayloadBlobPublishBannersInfoDismissActionNoticePath: /settings/dismiss-notice/publish_action_from_dockerfile
PayloadBlobPublishBannersInfoDismissStackNoticePath: /settings/dismiss-notice/publish_stack_from_file
PayloadBlobPublishBannersInfoReleasePath: /Zusyaku/Malware-Collection-Part-2/releases/new?marketplace=true
PayloadBlobPublishBannersInfoShowPublishActionBanner: -
PayloadBlobPublishBannersInfoShowPublishStackBanner: -
PayloadBlobRawBlobUrl: https://github.com/Zusyaku/Malware-Collection-Part-2/raw/main/Ransomware/BadRabbit.exe
PayloadBlobRawLines: null
PayloadBlobRenderImageOrRaw:
PayloadBlobRenderedFileInfo: null
PayloadBlobRichText: null
PayloadBlobShortPath: null
PayloadBlobStylingDirectives: null
PayloadBlobSymbols: null
PayloadBlobTabSize: 8
PayloadBlobTopBannersInfoActionsOnboardingTip: null
PayloadBlobTopBannersInfoCitationHelpUrl: https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/creating-a-repository-on-github/about-citation-files
PayloadBlobTopBannersInfoGlobalPreferredFundingPath: null
PayloadBlobTopBannersInfoOverridingGlobalFundingFile: -
PayloadBlobTopBannersInfoRepoName: Malware-Collection-Part-2
PayloadBlobTopBannersInfoRepoOwner: Zusyaku
PayloadBlobTopBannersInfoShowDependabotConfigurationBanner: -
PayloadBlobTopBannersInfoShowInvalidCitationWarning: -
PayloadBlobTruncated: -
PayloadBlobViewable: -
PayloadBlobWorkflowRedirectUrl: null
PayloadCopilotAccessAllowed: -
PayloadCopilotInfo: null
PayloadCsrf_tokensZusyakuMalware-Collection-Part-2branchesPost: lMq9dYZMhR1yRXlFtfhm8Fz-1T3Sgi4royu9fyqhIW8__MffgaTKOxyZ1brPJBnntoRQ-dbBnhWtaOkVj9iShA
PayloadCsrf_tokensrepospreferencesPost: 9nEHK3ij7PhOpL7Skpb82HxqDWLnBYC_ouwcYIVwyr0daq4qy-ZDlVRU8BESswJrjZeZqsmRB43K0LH2M0wjhg
PayloadCurrentUser: null
PayloadFileTreeItemsContentType:
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • directory
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
PayloadFileTreeItemsName:
  • 000 virus
  • 666
  • ADs_TFA1206
  • Banking-Malware
  • Batchs
  • Botnets
  • Browser Hijackers
  • CIH (Win32)
  • Chimichi
  • Clay
  • Coffin32
  • CoreR Trojan
  • DittoDestructive
  • Email-Worm.Win32.Magistr
  • Email-Worm.Win32.Maldal
  • Email-Worm.Win32.MeltingScreen
  • Email-Worm
  • EternalBlue
  • EvilQuest
  • Exploits
  • Fake GoldenEye
  • Fake PetrWrap
  • HURR-DURR
  • Hachi
  • Hello
  • Holzer
  • Holzery
  • HtkLkr
  • Hungadian
  • Hyptonize
  • Interim
  • Itachi14
  • ItachiNoSleep
  • JanusPetya Ransomware
  • Joke Programs
  • Joke.Win32.Badgame
  • Joke.Win32.FakePetya
  • Joke
  • LAndy@Clean
  • LivingDeath
  • LoselconIw
  • Lumitium
  • MEMZ 4.0 Clean
  • Mist (Win32)
  • Monster Ransomware (second new version)
  • Monster Ransomware
  • MrsMajor
  • Net-Worm.Win32.Opaserv
  • Net-Worm
  • NotMyFault
  • Notepad Spam
  • OIETIF
  • OneHalf
  • OneLastSong-main
  • PCToaster
  • PUP
  • Petya
  • PetyaMFTDestroyer
  • Pony
  • Quarknova
  • RAT
  • Ransomware
  • SOCIAL CREDIT TEST (virus)
  • Satana
  • SnakeRansom
  • Spyware
  • Stealer
  • Trojan.ROTANOTEDKSID
  • Trojan.Ransom.GoldenEye
  • Trojan.Ransom.NotPetya
  • Trojan.Ransom.PetrWrap
  • Trojan.VBS.Bolbi
  • Trojan.Win32.Alerta
  • Trojan.Win32.IconDance
  • Trojan.Win32.Sevgi
  • Trojan.Win32.Whiter
  • Trojan.Win9x.FlashKiller
  • Trojan
  • Ultra Defender
  • Viper Ransomware
  • Viral Ransomware 3.0
  • Virus.Boot-DOS.Implant
  • Virus.Boot-DOS.LivingDeath
  • Virus.Boot-DOS.Prowler
  • Virus.DOS.Abraxas
  • Virus.DOS.Barrotes
  • Virus.DOS.Billiard
  • Virus.DOS.Christmas
  • Virus.DOS.Claudia
  • Virus.DOS.Devil
  • Virus.DOS.Diamond
  • Virus.DOS.Executioner
  • Virus.DOS.Holiday
  • Virus.DOS.Immortal
  • Virus.DOS.Italian
  • Virus.DOS.Karina
  • Virus.DOS.Kwok
  • Virus.DOS.LSD
  • Virus.DOS.Lichen
  • Virus.DOS.Morphine
  • Virus.DOS.OneHalf
  • Virus.DOS.PZ
  • Virus.DOS.RSA
  • Virus.DOS.RTL
  • Virus.DOS.Radio
  • Virus.DOS.Raving
  • Virus.DOS.Satanic
  • Virus.DOS.Skynet
  • Virus.DOS.Sov
  • Virus.DOS.Suicide
  • Virus.DOS.TPE.Kela
  • Virus.DOS.Techno
  • Virus.DOS.Ukraine
  • Virus.DOS.Walker
  • Virus.VBS.Karma
  • Virus.Win16.Apparition
  • Virus.Win16.Gollum
  • Virus.Win32.Antares
  • Virus.Win32.Rigel
  • Virus.Win32.Winfig
  • Virus.Win9x.CIH (Infected AlZip program)
  • Virus.Win9x.CIH
  • Virus.Win9x.Prizm
  • Virus.Win9x.Shoerec
  • Virus.Win9x.Smash
  • Virus
  • WannaCryPlus
  • WannaCrypt0r
  • Worm Locker 2.0
  • Worm
  • XXX
  • Xylitol
  • YouAreAnIdiot
  • Zepa
  • blue_skull
  • cuppotrium
  • deckufniw 1.1
  • dobrota
  • inoccoece
  • loh_trojan
  • modos-main
  • nttdsl
  • photenium
  • rogues
  • slam-ransomware-main
  • takinium
  • winDelete-New
  • winbmpdestructive
  • #READ ME#.txt
  • $uckyLocker.exe
  • 000.exe
  • 000.zip
  • 0x07.exe
  • 1234.jpg
  • 25b4699a7b9eeb15e85525d843d4ab05e94d43f3202136927e13b3ebafa153525.exe
  • 5_6077904848743826573.exe
  • 666.zip
  • 7ev3n.exe
  • 7ev3n.zip
  • 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f.exe
  • @_.rar
  • ADs_TFA1206.rar
  • AIDS_NT.exe
  • Abantes (1).zip
  • Activation.reg
  • AdStRkJ.7z
  • Amoguz Meme.exe
  • AnViPC2009.exe
  • AnViPC2009.zip
  • Ana.exe
  • Android.Spy.49_iBanking_Feb2014.exe
  • Annabelle.zip
  • AnnoyingPingPong.exe
  • Antivirus 2010.zip
  • Antivirus.exe
  • Antivirus.zip
  • Antivirus2010.exe
  • AntivirusPlatinum.exe
  • AntivirusPlatinum.zip
  • AntivirusPro2017.exe
  • AntivirusPro2017.zip
  • Antivirus_Installer.exe
  • Application Petya screen locker.exe
  • Aramaware.zip
  • Artemis.exe
  • Astranizer.exe
  • Astranizer2.0.exe
  • Avoid.exe
  • Avoid.zip
  • BG.png
  • BUG32.exe
  • BUG32.zip
  • BadRabbit.exe
  • BadRabbit.zip
  • BaldiTrojan-x32.exe
  • BaldiTrojan-x64.exe
  • Bat To Exe Converter.rar
  • BatchPower1.zip
  • Benzene Trojan.rar
  • Benzene.exe
  • Birele.exe
  • Birele.zip
  • BitBlt.exe
  • Bitmap2.exe
  • Bitmap2_GDIOnly.exe
  • BlackCatRansomware.rar
  • BlackEnergy2.1.exe
  • Bonzify.exe
  • Bonzify.zip
  • BossDaMajor.exe
  • Brave Setup.exe
  • Busy Real2.0.exe
  • Busy.Trojan.exe
  • Catware•WinLocker.exe
  • Cerber5.exe
  • Cerber5.zip
  • Chaos Ransomware Builder.exe
  • Chaos Ransomware Builder.zip
  • Chernobyl.exe
  • ChilledWindows.exe
  • ChilledWindows.zip
  • Chimera.exe
  • Chimera.zip
  • Chlorine 2.0.7z
  • Chris@Spark.exe
  • Chrome_T-Rex.exe
  • Clay.zip
  • CleanThis.exe
  • CleanThis.zip
  • Clutt4-Clean.exe
  • Clutt4-Destructive.exe
  • Clutt4.5 Builder.exe
  • Clutt4.5.exe
  • Clutt4.5.zip
  • Clutt4.zip
  • Clutt6.6.6.exe
  • CmdRegCleaner.exe
  • CmdRegCleaner.zip
  • CoViper.exe
  • Coffin32.exe
  • Cohr.exe
  • Coinvault&bitcryptor_decrypter.zip
  • ColorBug.exe
  • ColorBug.zip
  • ColorCs.exe
  • ConsoleApp1.exe
  • Convert_mp4_to_mkv.exe
  • CookieClickerHack.exe
  • CookieClickerHack.zip
  • CoreR.exe
  • CoronaVirus.exe
  • CoronaVirus.zip
  • Covid-666.exe
  • CrazyNCS.exe
  • CrazyNCS.zip
  • CryptoLocker.exe
  • CryptoLocker.zip
  • CryptoLocker_22Jan2014.exe
  • CryptoWall.exe
  • CryptoWall.zip
  • Cs_Hacks_Free_no_hacks.exe
  • Curfun.exe
  • Curfun.zip
  • Cyborg Builder Ransomware V 1.0.exe
  • Cyborg Builder Ransomware V 1.0.zip
  • DETCEFNINIW.exe
  • DETCEJENIW.rar
  • Daily Dose of Malware.zip
  • DeathPlus.zip
  • DeriaLock.exe
  • DeriaLock.zip
  • Deskbottom.exe
  • DesktopBoom.exe
  • DesktopBoom.zip
  • DesktopGoose v0.3.exe
  • DesktopGoose v0.3.zip
  • DesktopPuzzle.exe
  • DesktopPuzzle.zip
  • Dharma.exe
  • Dimethylcadmium.exe
  • Dioxide.exe
  • DiskFucker.exe
  • DittoDestructive.exe
  • DomenicoBini.exe
  • Driver Easy.exe
  • Dro trojan. Virus prank.exe
  • Duqu2.exe
  • EliteMonitor.exe
  • Endermanch@000.exe
  • Evascape.exe
  • EvilQuest.zip
  • EvilSelenium.exe
  • FFProInstall.exe
  • FaZoN.bat
  • Fack.jpg
  • Fake Nvidia installer.7z
  • FakeActivation.exe
  • FakeActivation.zip
  • FakeAdwCleaner.exe
  • FakeAdwCleaner.zip
  • FakeMEMZ Clean.exe
  • FakeMEMZ.Destructive.exe
  • FakeMEMZ.Peaceful.exe
  • FakePetya.zip
  • FakeWindowsUpdate.zip
  • Fantom.exe
  • Fantom.zip
  • FileDeleter.rar
  • Fizz.exe
  • Flasher.exe
  • Flasher.zip
  • Fortect.exe
  • FreeYoutubeDownloader.exe
  • GandCrab.exe
  • Glodrix.exe
  • GoldenEye Builder.exe
  • GoldenEye Builder.exe.config
  • GoldenEye Builder.zip
  • GoldenEye.Builder.exe
  • Goldeneye_rebuild.zip
  • GolderFuck.zip
  • Gruel.exe
  • Gruel.zip
  • Guide.7z
  • HE0450-2958.exe
  • HE0450-2958.rar
  • HMBlocker.exe
  • HMBlocker.zip
  • HURR-DURR.zip
  • HY76SG38.exe
  • Halloware #READ ME#.txt
  • Halloware (BerkayV).exe
  • Halloware_BerkayV.zip
  • HalloweenLocker.exe
  • HalloweenLocker.zip
  • Happy99.exe
  • Happy99.zip
  • HappyAntivirus.exe
  • HappyAntivirus.zip
  • Hello.exe
  • Hexjan.exe
  • HollowKnight.exe
  • HollowKnight.zip
  • Holzer.exe
  • Holzer.zip
  • HorrorBob2.exe
  • HorrorRansom2.zip
  • HorrorTrojan Special Edition.zip
  • HorrorTrojan123.exe
  • HorrorTrojan5.zip
  • HorrorTubbies 1.0.exe
  • HorrorTubbies-main.7z
  • HostsFucker.exe
  • HtkLkr.exe
  • Hydra.exe
  • Hydra.zip
  • Hydrogen.exe
  • Hydromatic.exe
  • Hyptonium.exe
  • Illerka.C.exe
  • Illerka.C.zip
  • Illuminati.exe
  • Illuminati.zip
  • InfiniteBlue.exe
  • InfiniteBlue_2.exe
  • InfinityCrypt.exe
  • InfinityCrypt.zip
  • Install Windows20.7z
  • InstallWinFx.exe
  • Interim.exe
  • InternetSecurityGuard.exe
  • InternetSecurityGuard.zip
  • Itachi14.rar
  • ItachiNoSleep2.exe
  • ItachiRansomwareLock.exe
  • Jigsaw.exe
  • Jigsaw.zip
  • JigsawRansomware.exe
  • Joke Program.bat
  • Joke.WindowBlock.exe
  • Joke.zip
  • JustCrypt0r.exe
  • JustCrypt0r.zip
  • Karma.exe
  • Karma.zip
  • KingHamlet.exe
  • Kirurg v2.exe
  • Kirurg.exe
  • Kirurg_remsaterd.exe
  • Koteyka2.exe
  • Krotten.exe
  • Krotten.zip
  • LOIC.exe
  • LOL.exe
  • LOL.zip
  • LPS2019.exe
  • LSDG.zip
  • Launcher.exe
  • Launcher.zip
  • LetsBuildRansomware.exe
  • Linux.Wirenet.exe
  • Live Protection Suite 2019.exe
  • Live Protection Suite 2019.zip
  • Locky.AZ.exe
  • Locky.exe
  • Locky.zip
  • Log4J Malware.rar
  • LogonFuck Peaceful.exe
  • LogonFuck.exe
  • LogonFuck.zip
  • LoselconIw.exe
  • Losinium.zip
  • M0dules.exe
  • MBR - Image Builder.exe
  • MBR - Note Builder.exe
  • MBRLock.exe
  • MBRLock.zip
  • MCrypt2018.exe
  • MCrypt2018.zip
  • MEMZ 4.0 Clean.zip
  • MEMZ DPI.exe
  • MEMZ-Clean.bat
  • MEMZ-Clean.exe
  • MEMZ-Clone.exe
  • MEMZ-Clone.zip
  • MEMZ-Destructive.bat
  • MEMZ-Destructive.exe
  • MEMZ.exe
  • MEMZ.zip
  • MEMZ1.0.exe
  • MEMZ1.1.exe
  • MEMZ2.0.exe
  • MEMZ3.0.exe
  • MEMZ4.0.exe
  • MEMZTrojan.exe
  • MLG.exe
  • MLG.zip
  • MS-RickRoll.exe
  • Malware Collection v1.rar
  • Malware Collection v2.rar
  • Malware Collection v3.rar
  • Malware Collection v4.rar
  • Malware Collection v5.rar
  • Malware Collection v6.rar
  • Malware Collection v7.rar
  • Malware-downloader.exe
  • Mamba.exe
  • Mamba.zip
  • MediaCreationTool.exe
  • Melting.exe
  • Melting.zip
  • MercuryC.exe
  • MercuryXhoffle.exe
  • Mercuryx86.zip
  • Microsoft Windows Succ Panel.exe
  • Mischa.exe
  • Mischa.zip
  • MischaV2.exe
  • Mistake1.0 Destructive Release.exe
  • Mistake1.0 destructive beta.exe
  • Mistake2.0 Control.exe
  • Mistake2.0 Destructive.exe
  • Mistake3.0 Destructive beta.exe
  • MomoxemooDestructive.exe
  • Monoxide GDI 3.0.rar
  • Monoxidex64.GDI.exe
  • Monoxidex64.Sound.exe
  • Monoxidex64.exe
  • Monoxidex86.GDI.exe
  • Monoxidex86.Sound.exe
  • Monoxidex86.exe
  • MoonR.7z
  • MouseVerse.exe
  • Movie.mpeg.exe
  • Movie.mpeg.zip
  • MrHackerGroup.exe
  • MrsMajor2.0.7z
  • MrsMajor3.0.exe
  • MsWorld.exe
  • MsWorld.zip
  • MyDoom.exe
  • MyDoom.zip
  • Mythlas.exe
  • NavaShield.exe
  • NavaShield.zip
  • Neptunium.exe
  • NetPakoe.bat
  • NetPakoe3.0.exe
  • NetSky.exe
  • NetSky.zip
  • NitroGen.exe
  • NitroGen.zip
  • NoEscape-Clone.exe
  • NoEscape-Clone.zip
  • NoEscape.exe
  • NoEscape8.0.exe
  • NoMoreRansom.exe
  • NoMoreRansom.zip
  • NoWay Launcher.exe
  • Not a Forkbomb 2.cmd
  • NotPetya.exe
  • NotSolaris.exe
  • Notepad Spam.zip
  • OMG.exe
  • OSX_Wirenet.exe
  • Outbyte PC Repair.exe
  • PC shaking v4.0.exe
  • PCDefender v2.zip
  • PCDefender.exe
  • PCDefender.zip
  • PCDefenderv2.msi
  • PCOptimizerPro.zip
  • PCShredder.exe
  • PCShredder.zip
  • PE!.exe
  • Parrot.exe
  • Parrot.zip
  • PetrWrap(Patched).exe
  • PetrWrap.exe
  • PetrWrap.zip
  • Petya.A.exe
  • Petya.exe
  • Petya.zip
  • PetyaBuilder.zip
  • PetyaDecryptor.7z
  • Phsyletric.exe
  • Pikachu.exe
  • Pikachu.zip
  • Plantilla por si la quieren.jpeg
  • Plutonium (Revived Version).exe
  • Plutonium.exe
  • Polaris.7z
  • Polaris.exe
  • Polaris2.0.exe
  • PolyRansom.exe
  • PolyRansom.zip
  • Popup.exe
  • Popup.zip
  • PowerPoint 2019.exe
  • PowerPoint.exe
  • PowerPoint.zip
  • ProgramOverflow.exe
  • Pyro.exe
  • Quarknova.exe
  • RBXMCPQKVAOE.exe
  • README!!!!.txt
  • README!!!.txt
  • README!.txt
  • README.md
  • README.txt
  • Rably.exe
  • RansomBuilder.zip
  • Ransomware.Locky.exe
  • Readme.txt
  • RealBSOD.exe
  • Rebcoana README.txt
  • Rebcoana.exe
  • Rebcoana.rar
  • Rebcoana.zip
  • RectylescOS11.exe
  • RedBoot.exe
  • RedBoot.zip
  • RedDeath.exe
  • RedEye.exe
  • RedEye.zip
  • RegFuck.exe
  • RegFuck.zip
  • RegistrySmart.exe
  • RegistrySmart.zip
  • Rensenware.exe
  • Rensenware.zip
  • Rensenware_forcer.exe
  • Roentgenium.exe
  • Rokku.exe
  • Rokku.zip
  • Rubly.zip
  • Rust-Ransomware.exe
  • SE2011.exe
  • SE2011.zip
  • Saitama.exe
  • Saitama.zip
  • Sankylium.exe
  • Satana.zip
  • Saturn.exe
  • ScaryInstaller.exe
  • Scorpion Virus.exe
  • Scorpion Virus.zip
  • ScreenScrew.exe
  • ScreenScrew.zip
  • Security Central.zip
  • Security Defender 2015.zip
  • Security Defender.zip
  • Security Scanner.zip
  • SecurityCentral.exe
  • SecurityDefender.exe
  • SecurityDefender2015.exe
  • SecurityDefener2015.exe
  • SecurityScanner.exe
  • Seftad.exe
  • Seftad.zip
  • Serafin.exe
  • Setup - ItachiContactSecure.exe
  • Shadow Defender.exe
  • Sheld.exe
  • SimpleTaskManager.exe
  • Skywiper-A.Flame.exe
  • Smart Defragmenter.zip
  • SmartDefragmenter.exe
  • SnakeRansom.zip
  • Sofanium.exe
  • Spark.exe
  • Spark.zip
  • Spirit.exe
  • SpongebobFuck.exe
  • StalinLocker.exe
  • StalinLocker.zip
  • SumoX64 safety.exe
  • SumoX64.exe
  • SumoX86 safety.exe
  • SumoX86.exe
  • SuperDeath2.exe
  • SuperDeath3.exe
  • SystemBlocker.zip
  • TEMZ.exe
  • TaskILL.exe
  • TaskILL.zip
  • Terminator.exe
  • TestVirus.zip
  • Thallium.exe
  • TheCoolCat-Final.exe
  • TheCoolCat.exe
  • TheEchoOfFear (Special Edition).rar
  • Time.exe
  • Time.zip
  • TimeFuck.exe
  • TimeFuck.zip
  • Transmit.exe
  • TrashDestruct.7z
  • Trihydridoarsenic.exe
  • Trojan.Loadmoney.exe
  • Trojan.Ransom.Covid-666.exe
  • Trojan.Ransom.Giuliano.zip
  • Trojan.exe
  • TrojanXD-clean.exe
  • TrollRAT.exe
  • Trololo.exe
  • Trololo.zip
  • Trycolix.exe
  • Trycolix.rar
  • Trycolix.zip
  • UIWIX.exe
  • UnamBinder.exe
  • Underwater.exe
  • Universal-USB-Installer-2.0.1.0.exe
  • Unlock Virus.txt
  • UserOverflow.exe
  • V-Bucks Generator.exe
  • V-Bucks Generator.zip
  • VAV2008.exe
  • VAV2008.zip
  • Vanadium.exe
  • Vichingo455-MEMZ.zip
  • Vichingo455@Annabelle.exe
  • Vichingo455@PCOptimizerPro.exe
  • Vichingo455@Virus Maker.exe
  • ViraLock.exe
  • ViraLock.zip
  • Viral Ransomware 3.0.zip
  • Virus Maker.exe
  • Virus Maker.zip
  • Virus.exe
  • Virus_Destructive.zip
  • Vista.exe
  • Vista.zip
  • VoiceChanger32(1.66).exe
  • VoiceChanger64f(1.66).exe
  • WISEA J171227.81-232210.7.exe
  • WannaCry.exe
  • WannaCry.zip
  • WannaCryPlus.zip
  • WannaCrypt0r.exe
  • White.exe
  • White.zip
  • Win10.Update-kb8723467.msi
  • Win32.Infostealer.Dexter.exe
  • Win7Recovery.exe
  • Win7Recovery.zip
  • WinRAR.zip
  • Windows 11.exe
  • Windows 11.zip
  • Windows Accelerator Pro.zip
  • Windows Power Tools.exe
  • Windows Power Tools.zip
  • Windows Update.exe
  • Windows-KB2670838.msu.exe
  • Windows.11.Compatibility.Checker.exe
  • Windows.Malware.Effects.Remediation.Tool.exe
  • WindowsAcceleratorPro.exe
  • WindowsUpdate.exe
  • WindowsUpdate.zip
  • WinlockerVB6Blacksod.exe
  • WinlockerVB6Blacksod.zip
  • WolframAV.exe
  • WolframAV.zip
  • Worm Locker 2.0.zip
  • XDos.exe
  • XFileCorrupter.exe
  • XFileCorrupter.zip
  • XPAntivirus2008.exe
  • XPAntivirus2008.ico
  • XPAntivirus2008.zip
  • XXX.zip
  • Xenon.exe
  • Xyeta clean.exe
  • Xyeta.exe
  • Xyeta.zip
  • Xylitol.exe
  • YouAreAnIdiot.zip
  • ZeusGameover_Feb2014.exe
  • ZippedFiles.exe
  • ZippedFiles.zip
  • advokenop.exe
  • androfucker_v1.0.zip
  • baritone.exe
  • blue_skull.zip
  • bmp.exe
  • bmp_GDIOnly.exe
  • clutt6.6.6 - by CYBER SOLDIER.rar
  • clutt6.6.6.rar
  • conti_v3.rar
  • cuppotrium.rar
  • darkness.exe
  • ddom.exe
  • ddostool.bat
  • decrypt_777.exe
  • decrypt_Jigsaw.exe
  • dobrota.exe
  • dobrota_clean.exe
  • even0.5.exe
  • exel_icon.ico
  • fixiki.exe
  • fpfstb.dll
  • free r0bax hack (2 versions).rar
  • gif.7z
  • hi2.0.exe
  • hydrogen.exe
  • hydrogen0.25.exe
  • icefun.rar
  • itachi.exe
  • log4jscan.zip
  • lsd.exe
  • malware.exe
  • mbrrrrrrrrrrr.exe
  • memz.exe
  • mrsmajor.exe
  • msgspammer.bat
  • msvcp140d.dll
  • neptunium.exe
  • netfx3_enable.bat
  • newyear_trojan_2022.exe
  • nuget.exe
  • obrinty 0.6.exe
  • obrinty 0.9.exe
  • openrct2.exe
  • petya-580x335.png
  • petya_ransomware.jpg
  • putty.exe
  • ransom_builder.exe
  • ransomnote.exe
  • registry otval.rar
  • rickraas.py
  • rickroll.exe
  • satan.exe
  • separatum.zip
  • setup.exe
  • slam ransomware builder installer.exe
  • slamransomware.txt
  • sqlite3.dll
  • structdestr.7z
  • teslacrypt.zip
  • thematrix.bat
  • trojan.ransom.devilransom.zip
  • trojangen.bat
  • u.exe
  • uac.exe
  • ucrtbased.dll
  • vcruntime140.dll
  • vcruntime140d.dll
  • venus.exe
  • vinememz.txt
  • vmac_v1.0.4-win32.exe
  • wanacry decryptor.zip
  • weblector-setup.exe
  • wfc6setup.exe
  • winDelete-DestructiveV3.exe
  • winDelete-New.rar
  • winDelete.exe
  • winDelete.rar
  • winbmpdestructive.rar
  • windows.exe
  • winnit6.6.6 V10.exe
  • winnit6.6.6_V6.exe
  • winvbsdescrutive.exe
  • wrar401.exe
  • x2s443bc.cs1.exe
  • x86-stdout.vbs
  • yesisdied.exe
  • youaredied.zip
  • yttrium.exe
  • zip_bomb_42.zip
  • ß.exe
  • ő (en).bat
  • ő (en).exe
  • ƁĕӊίᾓďƳỡטּ.exe
  • ƁĕӊίᾓďƳỡטּ.zip
PayloadFileTreeItemsPath:
  • 000 virus
  • 666
  • ADs_TFA1206
  • Banking-Malware
  • Batchs
  • Botnets
  • Browser Hijackers
  • CIH (Win32)
  • Chimichi
  • Clay
  • Coffin32
  • CoreR Trojan
  • DittoDestructive
  • Email-Worm.Win32.Magistr
  • Email-Worm.Win32.Maldal
  • Email-Worm.Win32.MeltingScreen
  • Email-Worm
  • EternalBlue
  • EvilQuest
  • Exploits
  • Fake GoldenEye
  • Fake PetrWrap
  • HURR-DURR
  • Hachi
  • Hello
  • Holzer
  • Holzery
  • HtkLkr
  • Hungadian
  • Hyptonize
  • Interim
  • Itachi14
  • ItachiNoSleep
  • JanusPetya Ransomware
  • Joke Programs
  • Joke.Win32.Badgame
  • Joke.Win32.FakePetya
  • Joke
  • LAndy@Clean
  • LivingDeath
  • LoselconIw
  • Lumitium
  • MEMZ 4.0 Clean
  • Mist (Win32)
  • Monster Ransomware (second new version)
  • Monster Ransomware
  • MrsMajor
  • Net-Worm.Win32.Opaserv
  • Net-Worm
  • NotMyFault
  • Notepad Spam
  • OIETIF
  • OneHalf
  • OneLastSong-main
  • PCToaster
  • PUP
  • Petya
  • PetyaMFTDestroyer
  • Pony
  • Quarknova
  • RAT
  • Ransomware
  • SOCIAL CREDIT TEST (virus)
  • Satana
  • SnakeRansom
  • Spyware
  • Stealer
  • Trojan.ROTANOTEDKSID
  • Trojan.Ransom.GoldenEye
  • Trojan.Ransom.NotPetya
  • Trojan.Ransom.PetrWrap
  • Trojan.VBS.Bolbi
  • Trojan.Win32.Alerta
  • Trojan.Win32.IconDance
  • Trojan.Win32.Sevgi
  • Trojan.Win32.Whiter
  • Trojan.Win9x.FlashKiller
  • Trojan
  • Ultra Defender
  • Viper Ransomware
  • Viral Ransomware 3.0
  • Virus.Boot-DOS.Implant
  • Virus.Boot-DOS.LivingDeath
  • Virus.Boot-DOS.Prowler
  • Virus.DOS.Abraxas
  • Virus.DOS.Barrotes
  • Virus.DOS.Billiard
  • Virus.DOS.Christmas
  • Virus.DOS.Claudia
  • Virus.DOS.Devil
  • Virus.DOS.Diamond
  • Virus.DOS.Executioner
  • Virus.DOS.Holiday
  • Virus.DOS.Immortal
  • Virus.DOS.Italian
  • Virus.DOS.Karina
  • Virus.DOS.Kwok
  • Virus.DOS.LSD
  • Virus.DOS.Lichen
  • Virus.DOS.Morphine
  • Virus.DOS.OneHalf
  • Virus.DOS.PZ
  • Virus.DOS.RSA
  • Virus.DOS.RTL
  • Virus.DOS.Radio
  • Virus.DOS.Raving
  • Virus.DOS.Satanic
  • Virus.DOS.Skynet
  • Virus.DOS.Sov
  • Virus.DOS.Suicide
  • Virus.DOS.TPE.Kela
  • Virus.DOS.Techno
  • Virus.DOS.Ukraine
  • Virus.DOS.Walker
  • Virus.VBS.Karma
  • Virus.Win16.Apparition
  • Virus.Win16.Gollum
  • Virus.Win32.Antares
  • Virus.Win32.Rigel
  • Virus.Win32.Winfig
  • Virus.Win9x.CIH (Infected AlZip program)
  • Virus.Win9x.CIH
  • Virus.Win9x.Prizm
  • Virus.Win9x.Shoerec
  • Virus.Win9x.Smash
  • Virus
  • WannaCryPlus
  • WannaCrypt0r
  • Worm Locker 2.0
  • Worm
  • XXX
  • Xylitol
  • YouAreAnIdiot
  • Zepa
  • blue_skull
  • cuppotrium
  • deckufniw 1.1
  • dobrota
  • inoccoece
  • loh_trojan
  • modos-main
  • nttdsl
  • photenium
  • rogues
  • slam-ransomware-main
  • takinium
  • winDelete-New
  • winbmpdestructive
  • #READ ME#.txt
  • $uckyLocker.exe
  • 000.exe
  • 000.zip
  • 0x07.exe
  • 1234.jpg
  • 25b4699a7b9eeb15e85525d843d4ab05e94d43f3202136927e13b3ebafa153525.exe
  • 5_6077904848743826573.exe
  • 666.zip
  • 7ev3n.exe
  • 7ev3n.zip
  • 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f.exe
  • @_.rar
  • ADs_TFA1206.rar
  • AIDS_NT.exe
  • Abantes (1).zip
  • Activation.reg
  • AdStRkJ.7z
  • Amoguz Meme.exe
  • AnViPC2009.exe
  • AnViPC2009.zip
  • Ana.exe
  • Android.Spy.49_iBanking_Feb2014.exe
  • Annabelle.zip
  • AnnoyingPingPong.exe
  • Antivirus 2010.zip
  • Antivirus.exe
  • Antivirus.zip
  • Antivirus2010.exe
  • AntivirusPlatinum.exe
  • AntivirusPlatinum.zip
  • AntivirusPro2017.exe
  • AntivirusPro2017.zip
  • Antivirus_Installer.exe
  • Application Petya screen locker.exe
  • Aramaware.zip
  • Artemis.exe
  • Astranizer.exe
  • Astranizer2.0.exe
  • Avoid.exe
  • Avoid.zip
  • BG.png
  • BUG32.exe
  • BUG32.zip
  • BadRabbit.exe
  • BadRabbit.zip
  • BaldiTrojan-x32.exe
  • BaldiTrojan-x64.exe
  • Bat To Exe Converter.rar
  • BatchPower1.zip
  • Benzene Trojan.rar
  • Benzene.exe
  • Birele.exe
  • Birele.zip
  • BitBlt.exe
  • Bitmap2.exe
  • Bitmap2_GDIOnly.exe
  • BlackCatRansomware.rar
  • BlackEnergy2.1.exe
  • Bonzify.exe
  • Bonzify.zip
  • BossDaMajor.exe
  • Brave Setup.exe
  • Busy Real2.0.exe
  • Busy.Trojan.exe
  • Catware•WinLocker.exe
  • Cerber5.exe
  • Cerber5.zip
  • Chaos Ransomware Builder.exe
  • Chaos Ransomware Builder.zip
  • Chernobyl.exe
  • ChilledWindows.exe
  • ChilledWindows.zip
  • Chimera.exe
  • Chimera.zip
  • Chlorine 2.0.7z
  • Chris@Spark.exe
  • Chrome_T-Rex.exe
  • Clay.zip
  • CleanThis.exe
  • CleanThis.zip
  • Clutt4-Clean.exe
  • Clutt4-Destructive.exe
  • Clutt4.5 Builder.exe
  • Clutt4.5.exe
  • Clutt4.5.zip
  • Clutt4.zip
  • Clutt6.6.6.exe
  • CmdRegCleaner.exe
  • CmdRegCleaner.zip
  • CoViper.exe
  • Coffin32.exe
  • Cohr.exe
  • Coinvault&bitcryptor_decrypter.zip
  • ColorBug.exe
  • ColorBug.zip
  • ColorCs.exe
  • ConsoleApp1.exe
  • Convert_mp4_to_mkv.exe
  • CookieClickerHack.exe
  • CookieClickerHack.zip
  • CoreR.exe
  • CoronaVirus.exe
  • CoronaVirus.zip
  • Covid-666.exe
  • CrazyNCS.exe
  • CrazyNCS.zip
  • CryptoLocker.exe
  • CryptoLocker.zip
  • CryptoLocker_22Jan2014.exe
  • CryptoWall.exe
  • CryptoWall.zip
  • Cs_Hacks_Free_no_hacks.exe
  • Curfun.exe
  • Curfun.zip
  • Cyborg Builder Ransomware V 1.0.exe
  • Cyborg Builder Ransomware V 1.0.zip
  • DETCEFNINIW.exe
  • DETCEJENIW.rar
  • Daily Dose of Malware.zip
  • DeathPlus.zip
  • DeriaLock.exe
  • DeriaLock.zip
  • Deskbottom.exe
  • DesktopBoom.exe
  • DesktopBoom.zip
  • DesktopGoose v0.3.exe
  • DesktopGoose v0.3.zip
  • DesktopPuzzle.exe
  • DesktopPuzzle.zip
  • Dharma.exe
  • Dimethylcadmium.exe
  • Dioxide.exe
  • DiskFucker.exe
  • DittoDestructive.exe
  • DomenicoBini.exe
  • Driver Easy.exe
  • Dro trojan. Virus prank.exe
  • Duqu2.exe
  • EliteMonitor.exe
  • Endermanch@000.exe
  • Evascape.exe
  • EvilQuest.zip
  • EvilSelenium.exe
  • FFProInstall.exe
  • FaZoN.bat
  • Fack.jpg
  • Fake Nvidia installer.7z
  • FakeActivation.exe
  • FakeActivation.zip
  • FakeAdwCleaner.exe
  • FakeAdwCleaner.zip
  • FakeMEMZ Clean.exe
  • FakeMEMZ.Destructive.exe
  • FakeMEMZ.Peaceful.exe
  • FakePetya.zip
  • FakeWindowsUpdate.zip
  • Fantom.exe
  • Fantom.zip
  • FileDeleter.rar
  • Fizz.exe
  • Flasher.exe
  • Flasher.zip
  • Fortect.exe
  • FreeYoutubeDownloader.exe
  • GandCrab.exe
  • Glodrix.exe
  • GoldenEye Builder.exe
  • GoldenEye Builder.exe.config
  • GoldenEye Builder.zip
  • GoldenEye.Builder.exe
  • Goldeneye_rebuild.zip
  • GolderFuck.zip
  • Gruel.exe
  • Gruel.zip
  • Guide.7z
  • HE0450-2958.exe
  • HE0450-2958.rar
  • HMBlocker.exe
  • HMBlocker.zip
  • HURR-DURR.zip
  • HY76SG38.exe
  • Halloware #READ ME#.txt
  • Halloware (BerkayV).exe
  • Halloware_BerkayV.zip
  • HalloweenLocker.exe
  • HalloweenLocker.zip
  • Happy99.exe
  • Happy99.zip
  • HappyAntivirus.exe
  • HappyAntivirus.zip
  • Hello.exe
  • Hexjan.exe
  • HollowKnight.exe
  • HollowKnight.zip
  • Holzer.exe
  • Holzer.zip
  • HorrorBob2.exe
  • HorrorRansom2.zip
  • HorrorTrojan Special Edition.zip
  • HorrorTrojan123.exe
  • HorrorTrojan5.zip
  • HorrorTubbies 1.0.exe
  • HorrorTubbies-main.7z
  • HostsFucker.exe
  • HtkLkr.exe
  • Hydra.exe
  • Hydra.zip
  • Hydrogen.exe
  • Hydromatic.exe
  • Hyptonium.exe
  • Illerka.C.exe
  • Illerka.C.zip
  • Illuminati.exe
  • Illuminati.zip
  • InfiniteBlue.exe
  • InfiniteBlue_2.exe
  • InfinityCrypt.exe
  • InfinityCrypt.zip
  • Install Windows20.7z
  • InstallWinFx.exe
  • Interim.exe
  • InternetSecurityGuard.exe
  • InternetSecurityGuard.zip
  • Itachi14.rar
  • ItachiNoSleep2.exe
  • ItachiRansomwareLock.exe
  • Jigsaw.exe
  • Jigsaw.zip
  • JigsawRansomware.exe
  • Joke Program.bat
  • Joke.WindowBlock.exe
  • Joke.zip
  • JustCrypt0r.exe
  • JustCrypt0r.zip
  • Karma.exe
  • Karma.zip
  • KingHamlet.exe
  • Kirurg v2.exe
  • Kirurg.exe
  • Kirurg_remsaterd.exe
  • Koteyka2.exe
  • Krotten.exe
  • Krotten.zip
  • LOIC.exe
  • LOL.exe
  • LOL.zip
  • LPS2019.exe
  • LSDG.zip
  • Launcher.exe
  • Launcher.zip
  • LetsBuildRansomware.exe
  • Linux.Wirenet.exe
  • Live Protection Suite 2019.exe
  • Live Protection Suite 2019.zip
  • Locky.AZ.exe
  • Locky.exe
  • Locky.zip
  • Log4J Malware.rar
  • LogonFuck Peaceful.exe
  • LogonFuck.exe
  • LogonFuck.zip
  • LoselconIw.exe
  • Losinium.zip
  • M0dules.exe
  • MBR - Image Builder.exe
  • MBR - Note Builder.exe
  • MBRLock.exe
  • MBRLock.zip
  • MCrypt2018.exe
  • MCrypt2018.zip
  • MEMZ 4.0 Clean.zip
  • MEMZ DPI.exe
  • MEMZ-Clean.bat
  • MEMZ-Clean.exe
  • MEMZ-Clone.exe
  • MEMZ-Clone.zip
  • MEMZ-Destructive.bat
  • MEMZ-Destructive.exe
  • MEMZ.exe
  • MEMZ.zip
  • MEMZ1.0.exe
  • MEMZ1.1.exe
  • MEMZ2.0.exe
  • MEMZ3.0.exe
  • MEMZ4.0.exe
  • MEMZTrojan.exe
  • MLG.exe
  • MLG.zip
  • MS-RickRoll.exe
  • Malware Collection v1.rar
  • Malware Collection v2.rar
  • Malware Collection v3.rar
  • Malware Collection v4.rar
  • Malware Collection v5.rar
  • Malware Collection v6.rar
  • Malware Collection v7.rar
  • Malware-downloader.exe
  • Mamba.exe
  • Mamba.zip
  • MediaCreationTool.exe
  • Melting.exe
  • Melting.zip
  • MercuryC.exe
  • MercuryXhoffle.exe
  • Mercuryx86.zip
  • Microsoft Windows Succ Panel.exe
  • Mischa.exe
  • Mischa.zip
  • MischaV2.exe
  • Mistake1.0 Destructive Release.exe
  • Mistake1.0 destructive beta.exe
  • Mistake2.0 Control.exe
  • Mistake2.0 Destructive.exe
  • Mistake3.0 Destructive beta.exe
  • MomoxemooDestructive.exe
  • Monoxide GDI 3.0.rar
  • Monoxidex64.GDI.exe
  • Monoxidex64.Sound.exe
  • Monoxidex64.exe
  • Monoxidex86.GDI.exe
  • Monoxidex86.Sound.exe
  • Monoxidex86.exe
  • MoonR.7z
  • MouseVerse.exe
  • Movie.mpeg.exe
  • Movie.mpeg.zip
  • MrHackerGroup.exe
  • MrsMajor2.0.7z
  • MrsMajor3.0.exe
  • MsWorld.exe
  • MsWorld.zip
  • MyDoom.exe
  • MyDoom.zip
  • Mythlas.exe
  • NavaShield.exe
  • NavaShield.zip
  • Neptunium.exe
  • NetPakoe.bat
  • NetPakoe3.0.exe
  • NetSky.exe
  • NetSky.zip
  • NitroGen.exe
  • NitroGen.zip
  • NoEscape-Clone.exe
  • NoEscape-Clone.zip
  • NoEscape.exe
  • NoEscape8.0.exe
  • NoMoreRansom.exe
  • NoMoreRansom.zip
  • NoWay Launcher.exe
  • Not a Forkbomb 2.cmd
  • NotPetya.exe
  • NotSolaris.exe
  • Notepad Spam.zip
  • OMG.exe
  • OSX_Wirenet.exe
  • Outbyte PC Repair.exe
  • PC shaking v4.0.exe
  • PCDefender v2.zip
  • PCDefender.exe
  • PCDefender.zip
  • PCDefenderv2.msi
  • PCOptimizerPro.zip
  • PCShredder.exe
  • PCShredder.zip
  • PE!.exe
  • Parrot.exe
  • Parrot.zip
  • PetrWrap(Patched).exe
  • PetrWrap.exe
  • PetrWrap.zip
  • Petya.A.exe
  • Petya.exe
  • Petya.zip
  • PetyaBuilder.zip
  • PetyaDecryptor.7z
  • Phsyletric.exe
  • Pikachu.exe
  • Pikachu.zip
  • Plantilla por si la quieren.jpeg
  • Plutonium (Revived Version).exe
  • Plutonium.exe
  • Polaris.7z
  • Polaris.exe
  • Polaris2.0.exe
  • PolyRansom.exe
  • PolyRansom.zip
  • Popup.exe
  • Popup.zip
  • PowerPoint 2019.exe
  • PowerPoint.exe
  • PowerPoint.zip
  • ProgramOverflow.exe
  • Pyro.exe
  • Quarknova.exe
  • RBXMCPQKVAOE.exe
  • README!!!!.txt
  • README!!!.txt
  • README!.txt
  • README.md
  • README.txt
  • Rably.exe
  • RansomBuilder.zip
  • Ransomware.Locky.exe
  • Readme.txt
  • RealBSOD.exe
  • Rebcoana README.txt
  • Rebcoana.exe
  • Rebcoana.rar
  • Rebcoana.zip
  • RectylescOS11.exe
  • RedBoot.exe
  • RedBoot.zip
  • RedDeath.exe
  • RedEye.exe
  • RedEye.zip
  • RegFuck.exe
  • RegFuck.zip
  • RegistrySmart.exe
  • RegistrySmart.zip
  • Rensenware.exe
  • Rensenware.zip
  • Rensenware_forcer.exe
  • Roentgenium.exe
  • Rokku.exe
  • Rokku.zip
  • Rubly.zip
  • Rust-Ransomware.exe
  • SE2011.exe
  • SE2011.zip
  • Saitama.exe
  • Saitama.zip
  • Sankylium.exe
  • Satana.zip
  • Saturn.exe
  • ScaryInstaller.exe
  • Scorpion Virus.exe
  • Scorpion Virus.zip
  • ScreenScrew.exe
  • ScreenScrew.zip
  • Security Central.zip
  • Security Defender 2015.zip
  • Security Defender.zip
  • Security Scanner.zip
  • SecurityCentral.exe
  • SecurityDefender.exe
  • SecurityDefender2015.exe
  • SecurityDefener2015.exe
  • SecurityScanner.exe
  • Seftad.exe
  • Seftad.zip
  • Serafin.exe
  • Setup - ItachiContactSecure.exe
  • Shadow Defender.exe
  • Sheld.exe
  • SimpleTaskManager.exe
  • Skywiper-A.Flame.exe
  • Smart Defragmenter.zip
  • SmartDefragmenter.exe
  • SnakeRansom.zip
  • Sofanium.exe
  • Spark.exe
  • Spark.zip
  • Spirit.exe
  • SpongebobFuck.exe
  • StalinLocker.exe
  • StalinLocker.zip
  • SumoX64 safety.exe
  • SumoX64.exe
  • SumoX86 safety.exe
  • SumoX86.exe
  • SuperDeath2.exe
  • SuperDeath3.exe
  • SystemBlocker.zip
  • TEMZ.exe
  • TaskILL.exe
  • TaskILL.zip
  • Terminator.exe
  • TestVirus.zip
  • Thallium.exe
  • TheCoolCat-Final.exe
  • TheCoolCat.exe
  • TheEchoOfFear (Special Edition).rar
  • Time.exe
  • Time.zip
  • TimeFuck.exe
  • TimeFuck.zip
  • Transmit.exe
  • TrashDestruct.7z
  • Trihydridoarsenic.exe
  • Trojan.Loadmoney.exe
  • Trojan.Ransom.Covid-666.exe
  • Trojan.Ransom.Giuliano.zip
  • Trojan.exe
  • TrojanXD-clean.exe
  • TrollRAT.exe
  • Trololo.exe
  • Trololo.zip
  • Trycolix.exe
  • Trycolix.rar
  • Trycolix.zip
  • UIWIX.exe
  • UnamBinder.exe
  • Underwater.exe
  • Universal-USB-Installer-2.0.1.0.exe
  • Unlock Virus.txt
  • UserOverflow.exe
  • V-Bucks Generator.exe
  • V-Bucks Generator.zip
  • VAV2008.exe
  • VAV2008.zip
  • Vanadium.exe
  • Vichingo455-MEMZ.zip
  • Vichingo455@Annabelle.exe
  • Vichingo455@PCOptimizerPro.exe
  • Vichingo455@Virus Maker.exe
  • ViraLock.exe
  • ViraLock.zip
  • Viral Ransomware 3.0.zip
  • Virus Maker.exe
  • Virus Maker.zip
  • Virus.exe
  • Virus_Destructive.zip
  • Vista.exe
  • Vista.zip
  • VoiceChanger32(1.66).exe
  • VoiceChanger64f(1.66).exe
  • WISEA J171227.81-232210.7.exe
  • WannaCry.exe
  • WannaCry.zip
  • WannaCryPlus.zip
  • WannaCrypt0r.exe
  • White.exe
  • White.zip
  • Win10.Update-kb8723467.msi
  • Win32.Infostealer.Dexter.exe
  • Win7Recovery.exe
  • Win7Recovery.zip
  • WinRAR.zip
  • Windows 11.exe
  • Windows 11.zip
  • Windows Accelerator Pro.zip
  • Windows Power Tools.exe
  • Windows Power Tools.zip
  • Windows Update.exe
  • Windows-KB2670838.msu.exe
  • Windows.11.Compatibility.Checker.exe
  • Windows.Malware.Effects.Remediation.Tool.exe
  • WindowsAcceleratorPro.exe
  • WindowsUpdate.exe
  • WindowsUpdate.zip
  • WinlockerVB6Blacksod.exe
  • WinlockerVB6Blacksod.zip
  • WolframAV.exe
  • WolframAV.zip
  • Worm Locker 2.0.zip
  • XDos.exe
  • XFileCorrupter.exe
  • XFileCorrupter.zip
  • XPAntivirus2008.exe
  • XPAntivirus2008.ico
  • XPAntivirus2008.zip
  • XXX.zip
  • Xenon.exe
  • Xyeta clean.exe
  • Xyeta.exe
  • Xyeta.zip
  • Xylitol.exe
  • YouAreAnIdiot.zip
  • ZeusGameover_Feb2014.exe
  • ZippedFiles.exe
  • ZippedFiles.zip
  • advokenop.exe
  • androfucker_v1.0.zip
  • baritone.exe
  • blue_skull.zip
  • bmp.exe
  • bmp_GDIOnly.exe
  • clutt6.6.6 - by CYBER SOLDIER.rar
  • clutt6.6.6.rar
  • conti_v3.rar
  • cuppotrium.rar
  • darkness.exe
  • ddom.exe
  • ddostool.bat
  • decrypt_777.exe
  • decrypt_Jigsaw.exe
  • dobrota.exe
  • dobrota_clean.exe
  • even0.5.exe
  • exel_icon.ico
  • fixiki.exe
  • fpfstb.dll
  • free r0bax hack (2 versions).rar
  • gif.7z
  • hi2.0.exe
  • hydrogen.exe
  • hydrogen0.25.exe
  • icefun.rar
  • itachi.exe
  • log4jscan.zip
  • lsd.exe
  • malware.exe
  • mbrrrrrrrrrrr.exe
  • memz.exe
  • mrsmajor.exe
  • msgspammer.bat
  • msvcp140d.dll
  • neptunium.exe
  • netfx3_enable.bat
  • newyear_trojan_2022.exe
  • nuget.exe
  • obrinty 0.6.exe
  • obrinty 0.9.exe
  • openrct2.exe
  • petya-580x335.png
  • petya_ransomware.jpg
  • putty.exe
  • ransom_builder.exe
  • ransomnote.exe
  • registry otval.rar
  • rickraas.py
  • rickroll.exe
  • satan.exe
  • separatum.zip
  • setup.exe
  • slam ransomware builder installer.exe
  • slamransomware.txt
  • sqlite3.dll
  • structdestr.7z
  • teslacrypt.zip
  • thematrix.bat
  • trojan.ransom.devilransom.zip
  • trojangen.bat
  • u.exe
  • uac.exe
  • ucrtbased.dll
  • vcruntime140.dll
  • vcruntime140d.dll
  • venus.exe
  • vinememz.txt
  • vmac_v1.0.4-win32.exe
  • wanacry decryptor.zip
  • weblector-setup.exe
  • wfc6setup.exe
  • winDelete-DestructiveV3.exe
  • winDelete-New.rar
  • winDelete.exe
  • winDelete.rar
  • winbmpdestructive.rar
  • windows.exe
  • winnit6.6.6 V10.exe
  • winnit6.6.6_V6.exe
  • winvbsdescrutive.exe
  • wrar401.exe
  • x2s443bc.cs1.exe
  • x86-stdout.vbs
  • yesisdied.exe
  • youaredied.zip
  • yttrium.exe
  • zip_bomb_42.zip
  • ß.exe
  • ő (en).bat
  • ő (en).exe
  • ƁĕӊίᾓďƳỡטּ.exe
  • ƁĕӊίᾓďƳỡטּ.zip
PayloadFileTreeTotalCount: 815
PayloadFileTreeRansomwareItemsContentType:
  • directory
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
  • file
PayloadFileTreeRansomwareItemsName:
  • GoldenEye
  • $uckyLocker.exe
  • 7ev3n.exe
  • BadRabbit.exe
  • Birele.exe
  • Cerber5.exe
  • DeriaLock.exe
  • Dharma.exe
  • Fantom.exe
  • GandCrab.exe
  • InfinityCrypt.exe
  • Krotten.exe
  • Locky.AZ.exe
  • NoMoreRansom.exe
  • NotPetya.exe
  • Petya.A.exe
  • PolyRansom.exe
  • PowerPoint.exe
  • RedEye.exe
  • Rensenware.exe
  • SporaRansomware.exe
  • UIWIX.exe
  • ViraLock.exe
  • WannaCry.exe
  • WinlockerVB6Blacksod.exe
  • Xyeta.exe
  • satan.exe
PayloadFileTreeRansomwareItemsPath:
  • Ransomware/GoldenEye
  • Ransomware/$uckyLocker.exe
  • Ransomware/7ev3n.exe
  • Ransomware/BadRabbit.exe
  • Ransomware/Birele.exe
  • Ransomware/Cerber5.exe
  • Ransomware/DeriaLock.exe
  • Ransomware/Dharma.exe
  • Ransomware/Fantom.exe
  • Ransomware/GandCrab.exe
  • Ransomware/InfinityCrypt.exe
  • Ransomware/Krotten.exe
  • Ransomware/Locky.AZ.exe
  • Ransomware/NoMoreRansom.exe
  • Ransomware/NotPetya.exe
  • Ransomware/Petya.A.exe
  • Ransomware/PolyRansom.exe
  • Ransomware/PowerPoint.exe
  • Ransomware/RedEye.exe
  • Ransomware/Rensenware.exe
  • Ransomware/SporaRansomware.exe
  • Ransomware/UIWIX.exe
  • Ransomware/ViraLock.exe
  • Ransomware/WannaCry.exe
  • Ransomware/WinlockerVB6Blacksod.exe
  • Ransomware/Xyeta.exe
  • Ransomware/satan.exe
PayloadFileTreeRansomwareTotalCount: 27
PayloadFileTreeProcessingTime: 174.219044
PayloadPath: Ransomware/BadRabbit.exe
PayloadReducedMotionEnabled: null
PayloadRefInfoCanEdit: -
PayloadRefInfoCurrentOid: ab33000abe1b26fcbdaa4fc6f535de5afc8f7e25
PayloadRefInfoListCacheKey: v0:1659434254.1775382
PayloadRefInfoName: main
PayloadRefInfoRefType: branch
PayloadRepoCreatedAt: 2021-10-02T11:22:52.000Z
PayloadRepoCurrentUserCanPush: -
PayloadRepoDefaultBranch: main
PayloadRepoId: 412775311
PayloadRepoIsEmpty: -
PayloadRepoIsFork: -
PayloadRepoIsOrgOwned: -
PayloadRepoName: Malware-Collection-Part-2
PayloadRepoOwnerAvatar: https://avatars.githubusercontent.com/u/71582475?v=4
PayloadRepoOwnerLogin: Zusyaku
PayloadRepoPrivate: -
PayloadRepoPublic:
PayloadSymbolsExpanded: -
PayloadTreeExpanded:
Title: Malware-Collection-Part-2/Ransomware/BadRabbit.exe at main · Zusyaku/Malware-Collection-Part-2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
99
Monitored processes
53
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ntvdm.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs coronavirus.exe explorer.exe no specs cmd.exe no specs mode.com no specs vssadmin.exe no specs coronavirus.exe cmd.exe no specs mode.com no specs vssadmin.exe no specs vssvc.exe no specs cmd.exe no specs mode.com no specs vssadmin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\System32\ntvdm.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
560"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—CoronaVirus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
848"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=4564 --field-trial-handle=1144,i,3383376463072567869,12800647618785462383,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
948"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1084 --field-trial-handle=1144,i,3383376463072567869,12800647618785462383,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
956"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1600 --field-trial-handle=1144,i,3383376463072567869,12800647618785462383,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
968"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=4908 --field-trial-handle=1144,i,3383376463072567869,12800647618785462383,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1216"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1144,i,3383376463072567869,12800647618785462383,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1376mode con cp select=1251C:\Windows\System32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
DOS Device MODE Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1540"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1144,i,3383376463072567869,12800647618785462383,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1572"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3500 --field-trial-handle=1144,i,3383376463072567869,12800647618785462383,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
8 958
Read events
8 770
Write events
187
Delete events
1

Modification events

(PID) Process:(2084) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2084) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2084) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2084) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2084) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2084) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
1
(PID) Process:(2084) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2084) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2084) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_installdate
Value:
0
(PID) Process:(2084) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_enableddate
Value:
0
Executable files
255
Suspicious files
5 894
Text files
54
Unknown types
35

Dropped files

PID
Process
Filename
Type
2084chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RFe4d60.TMP —
MD5:—
SHA256:—
2084chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
128ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsF994.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
2084chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
2084chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:9F941EA08DBDCA2EB3CFA1DBBBA6F5DC
SHA256:127F71DF0D2AD895D4F293E62284D85971AE047CA15F90B87BF6335898B0B655
2084chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFe4d60.TMPtext
MD5:05CF4C3C5148DA6355D3561A9EAA5E8A
SHA256:8D720243F6876898E4F197C8867C4CEE69F1C7335C55B8A29C120B1028D93E41
2084chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
2084chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.oldtext
MD5:E53573A93829681410D5E7DBB1B61C78
SHA256:A82D28F2C1E22A2AE0ABC5F5AF0CC8EE7AD913BAB3A0BF84CE6D8D23F67E06A3
2084chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RFe509c.TMP —
MD5:—
SHA256:—
2084chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
67
DNS requests
101
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
—
—
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
5.41 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
10.0 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
9.48 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
1.55 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
7.70 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
binary
70.7 Kb
unknown
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acs7jwb4vh357wtsxdlrthyegyqq_2023.11.27.1202/ggkkehgbnfjpeggfpleeakpidbkibbmn_2023.11.27.1202_all_admxda2vchtoykhnnwzdlbnqqt6a.crx3
unknown
binary
1.55 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
binary
117 Kb
unknown
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
binary
8.68 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2084
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
1596
chrome.exe
142.250.184.195:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
1596
chrome.exe
108.177.15.84:443
accounts.google.com
GOOGLE
US
unknown
1596
chrome.exe
142.250.186.68:443
www.google.com
GOOGLE
US
whitelisted
1596
chrome.exe
216.58.212.163:443
www.gstatic.com
GOOGLE
US
whitelisted
1596
chrome.exe
216.58.206.46:443
apis.google.com
GOOGLE
US
whitelisted
2084
chrome.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 142.250.184.195
whitelisted
accounts.google.com
  • 108.177.15.84
shared
www.google.com
  • 142.250.186.68
  • 142.250.186.132
whitelisted
www.gstatic.com
  • 216.58.212.163
  • 142.250.186.67
whitelisted
apis.google.com
  • 216.58.206.46
whitelisted
update.googleapis.com
  • 142.250.184.195
whitelisted
encrypted-tbn0.gstatic.com
  • 172.217.16.206
whitelisted
fonts.gstatic.com
  • 142.250.186.99
whitelisted
consent.google.com
  • 142.250.185.78
shared
safebrowsing.googleapis.com
  • 142.250.185.202
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/Zusyaku/Malware-Collection-Part-2/blob/main/Ransomware/BadRabbit.exe