Overview

overview

10

Static

static

10

12123434.exe

windows10-2004-x64

10

12123434.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    507s
  • max time network
    509s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 12:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    12123434.exe
  • Size 938KB
  • Sample261102-prv1mswt4m
  • SHA256 25847d420e245fc401d56150cf9e5b4391259c872b74ef0d10099e8d3680d8e4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaret.me/junk_codecosturadefense_evasiondiscoveryexecutiongomoratpackerpersistenceprivilege_escalationransomwareratspywaretrojan

Malware Config

Extracted

Family

  • gomorat

Version

  • 1.8

Botnet

  • t.me/junk_code

C2

  • art.cantdown.su:1788

Mutex

  • @junk_code

Attributes
  • antivirtual

    false

  • certificate

    jbkxujtydn0g5204j3mp

  • delay_unit

    Seconds

  • delay_value

    10

  • disk_spread

    true

  • enable_delay

    false

  • exclusion_wd

    true

  • hidden_file

    true

  • install

    true

  • install_watchdog

    true

  • key

    apnzyq2lsmp

  • path_client

    %ProgramFiles%\junkSearch.exe

  • path_watchdog

    %Windows%\junkSearcher.exe

  • pump

    false

  • rootkit

    2ojd99orkrumsws

  • rootkit_type

    junkkit

  • task_client

    ShellHost

  • task_watchdog

    CookieManager

  • usb_spread

    true

  • use_install_admin

    true

  • user_init

    true

  • winlogon_shell_enable

    true

  • wmi_name

    WindowsDefender

  • wmi_startup

    true

Signatures

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
    persistence
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 26 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 13 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Start PowerShell.

    execution
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Costura .NET executable packer 1 IoCs

    Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

    costurapacker
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\12123434.exe
    "C:\Users\Admin\AppData\Local\Temp\12123434.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Modifies registry class
      PID:3244
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" 471|OzEpy/3cGWMFkSx8JbMHyCrGAg5Cw5LEEQY4dFeQ6qDZZfHbKdK3PCQKqZ7cgTp5WindowsControl472|Tc7uA/sUXZHKRTYSbv3Dxr3sSkCziY35vfhtrFxouLk=C:\Program Files\junkSearch.exe" enable=yes & exit
      2⤵
        PID:2932
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2900
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3328
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2416
      • C:\Program Files\junkSearch.exe
        "C:\Program Files\junkSearch.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          3⤵
          • Loads dropped DLL
          PID:2556
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp2434.tmp.exe"' & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5008
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp2434.tmp.exe"'
            4⤵
            • Loads dropped DLL
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of WriteProcessMemory
            PID:5096
            • C:\Users\Admin\AppData\Local\Temp\tmp2434.tmp.exe
              "C:\Users\Admin\AppData\Local\Temp\tmp2434.tmp.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4936
              • C:\Windows\SysWOW64\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\scream\sound.vbs"
                6⤵
                • Checks computer location settings
                • Enumerates connected drives
                • Executes a VBScript file via the Windows Script Host.
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5108
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\SysWOW64\mshta.exe" "C:\scream\gif.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:4580
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpB819.tmp.zip"' & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpB819.tmp.zip"'
            4⤵
            • Loads dropped DLL
            • Command and Scripting Interpreter: PowerShell
            PID:3912
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp5261.tmp.exe"' & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4680
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp5261.tmp.exe"'
            4⤵
            • Loads dropped DLL
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of WriteProcessMemory
            PID:1152
            • C:\Users\Admin\AppData\Local\Temp\tmp5261.tmp.exe
              "C:\Users\Admin\AppData\Local\Temp\tmp5261.tmp.exe"
              5⤵
              • UAC bypass
              • Event Triggered Execution: Image File Execution Options Injection
              • Executes dropped EXE
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4864
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1544
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:4404
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2300
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3164
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Loads dropped DLL
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          2⤵
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Suspicious behavior: GetForegroundWindowSpam
          PID:3632
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:772
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
        1⤵
        • Loads dropped DLL
        PID:4080
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3308
      • C:\Program Files\junkSearch.exe
        "C:\Program Files\junkSearch.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4540
      • C:\Program Files\junkSearch.exe
        "C:\Program Files\junkSearch.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:1640
      • C:\Program Files\junkSearch.exe
        "C:\Program Files\junkSearch.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:2192
      • C:\Program Files\junkSearch.exe
        "C:\Program Files\junkSearch.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:4988
      • C:\Program Files\junkSearch.exe
        "C:\Program Files\junkSearch.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:4604
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
        • Loads dropped DLL
        PID:2424
      • C:\Program Files\junkSearch.exe
        "C:\Program Files\junkSearch.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:1060
      • C:\Program Files\junkSearch.exe
        "C:\Program Files\junkSearch.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:3420
      • C:\Users\Admin\AppData\Local\Temp\tmp5261.tmp.exe
        C:\Users\Admin\AppData\Local\Temp\tmp5261.tmp.exe explorer.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:616
      • C:\Program Files\junkSearch.exe
        "C:\Program Files\junkSearch.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:2828

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            3
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Event Triggered Execution

            2
            T1546

            AppInit DLLs

            1
            T1546.010

            Image File Execution Options Injection

            1
            T1546.012

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            3
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Event Triggered Execution

            2
            T1546

            AppInit DLLs

            1
            T1546.010

            Image File Execution Options Injection

            1
            T1546.012

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            1
            T1562

            Disable or Modify Tools

            1
            T1562.001

            Modify Registry

            6
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            4
            T1012

            System Information Discovery

            5
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            2
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            $Recycle.Bin.lnk
            • Path C:\$Recycle.Bin.lnk
            • Size 867B
            • SHA256 98607052456b2c50739e3264733946ea17b16947466da938f58177746a89264b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Backup.lnk
            • Path C:\Backup.lnk
            • Size 711B
            • SHA256 4ee3f95e6fafd43479cf781771730d4f8246de42f9f600880e65055608ffc928
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Documents and Settings.lnk
            • Path C:\Documents and Settings.lnk
            • Size 907B
            • SHA256 b719fef3bd845388801f27300ca80a7c289d218804014f46d00fe47deb5fc996
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Documents.lnk
            • Path C:\Documents.lnk
            • Size 717B
            • SHA256 5acb53a818c355e23078484779d87f930a0f34667760bbb2172c2b573cd7395a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PerfLogs.lnk
            • Path C:\PerfLogs.lnk
            • Size 851B
            • SHA256 d91cfd91e2dc1ac2242ce47029b42fd3052541cac65d0b9b1fcf99977b49086c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Photos.lnk
            • Path C:\Photos.lnk
            • Size 711B
            • SHA256 eb11e3f8b353411ffd4f137d15c4b7df6bd4d3750cb46b34efc7ab419408b793
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Program Files (x86).lnk
            • Path C:\Program Files (x86).lnk
            • Size 895B
            • SHA256 2e32f86c7f6835c1eaf0accb858ec22f0cab1d694d04153000c4c0106136bda8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Program Files.lnk
            • Path C:\Program Files.lnk
            • Size 871B
            • SHA256 0734b38d65090f235edd423f51d86aa6b1e4092d204f45816f5f46fd74321892
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            junkSearch.exe
            • Path C:\Program Files\junkSearch.exe
            • Size 938KB
            • SHA256 25847d420e245fc401d56150cf9e5b4391259c872b74ef0d10099e8d3680d8e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProgramData.lnk
            • Path C:\ProgramData.lnk
            • Size 863B
            • SHA256 9cc83081859d3a5a234da9221a4108e4ef25cb95f51b252e4cb7378976f0fd9a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Recovery.lnk
            • Path C:\Recovery.lnk
            • Size 851B
            • SHA256 e7b7124d3120e8b43f8ebfbdb9605283ec1ae105a0cf0727f7f75e06f86996d2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Users.lnk
            • Path C:\Users.lnk
            • Size 839B
            • SHA256 4193275543ac08f64854e2d6e2a21587319bfe9ef7781ca44492beb0865003f9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
            • Size 2KB
            • SHA256 ac4f7f1c29ee6e850eb2f907806dd38ff35da6dbaa31f9eccf6652cbc72ef035
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
            • Size 471B
            • SHA256 2596e9b42113831929d1f78070f990003d499f4bdce502acc0b74852881d8947
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
            • Size 422B
            • SHA256 f166cf82b69b71ac866fc12baa9add74fc222df294ddcf6da78dc37d90db86e7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
            • Size 412B
            • SHA256 a732b9fa804cba899704d8270eabdaff872ed1fd6c812d7601d06ae079978200
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            junkSearch.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\junkSearch.exe.log
            • Size 1KB
            • SHA256 77507c05c8131f73d1dd1500992223819a6ab09cd820716e00bf907c9c7fc857
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            WMSDKNS.XML.bak
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
            • Size 9KB
            • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thumbcache_idx.db
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
            • Size 28KB
            • SHA256 5992a3622b027f7f67aa8980882290bc9d745d9ffe0c092b749555c1267e660c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 64B
            • SHA256 787628c3dd129679416857bcb63c52f8477a02cfeadfe0d4d5d98eb7902c61d8
            • MD5 SHA1 SHA512
            Submit Download

            fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
            • Size 2KB
            • SHA256 c7454ef2216a2564f4665b5d51342deef00cfab32bed0f3b9710e0626d995495
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AppCache134380964915337987.txt.~tmp
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134380964915337987.txt.~tmp
            • Size 77KB
            • SHA256 180524afcfd1c6673605400a13a6060e85bd7945a5b9c2e43e81017901cba18e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            microsoft.windows[1].xml
            • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5IOFEKC1\microsoft.windows[1].xml
            • Size 97B
            • SHA256 ddfe9eaeeb2223aeb285e912b717118bf75e92b35bfb5b8a38a28b7d80d79ed7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_04vbr32d.bno.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_04vbr32d.bno.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tmp2434.tmp.exe
            • Path C:\Users\Admin\AppData\Local\Temp\tmp2434.tmp.exe
            • Size 14.7MB
            • SHA256 f0b481c95d762e5dd7575a22b520f32af3a1ed83f917abf2872c5ae3825dafb7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmpB819.tmp.zip
            • Path C:\Users\Admin\AppData\Local\Temp\tmpB819.tmp.zip
            • Size 2.3MB
            • SHA256 876abd41f437ab829e7415d0e747d880e07c24b317ad6a53c15500ba9db2679b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Windows.lnk
            • Path C:\Windows.lnk
            • Size 847B
            • SHA256 832544cc9d1e903ac35e7a93c4465c3e9e6d80efbefdd0067aa52e086172e004
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            junk.dll
            • Path C:\Windows\junk.dll
            • Size 58KB
            • SHA256 bd02435863c792fd6247bcc1242b12dca250a7db42cb8aa3e41170880881dadc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gif.hta
            • Path C:\scream\gif.hta
            • Size 1KB
            • SHA256 306e5356eddaf0f9c3a81435bb3649adfad37f0dc78bc6d7d495c19977ee874f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            sound.mp3
            • Path C:\scream\sound.mp3
            • Size 371KB
            • SHA256 77fbbaa29ef9163a352a57a48d2cbbb35f499a51545e257846d809639262d09c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sound.vbs
            • Path C:\scream\sound.vbs
            • Size 310B
            • SHA256 6cbf377b3b2369be137810746491e2f1044f7a53d6a3090646592b6cb77eacca
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tenor.gif
            • Path C:\scream\tenor.gif
            • Size 14.1MB
            • SHA256 f9663446ed05d86f44344f48e228e0623baaa223097b23ff064ee0287fdea92f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1544-92-0x00000000051D0000-0x00000000051D1000-memory.dmp
            Download

            memory/1640-548-0x00007FF850340000-0x00007FF850356000-memory.dmp
            Download

            memory/2192-585-0x00007FF850340000-0x00007FF850356000-memory.dmp
            Download

            memory/2556-242-0x00007FF850340000-0x00007FF850356000-memory.dmp
            Download

            memory/3080-0-0x000001C0F84A0000-0x000001C0F858E000-memory.dmp
            Download

            memory/3080-1-0x000001C0FA1F0000-0x000001C0FA200000-memory.dmp
            Download

            memory/3080-54-0x000001C0FA1F0000-0x000001C0FA200000-memory.dmp
            Download

            memory/3164-56-0x000001B43B250000-0x000001B43B350000-memory.dmp
            Download

            memory/3164-74-0x000001B43C240000-0x000001B43C260000-memory.dmp
            Download

            memory/3164-93-0x000001B43C650000-0x000001B43C670000-memory.dmp
            Download

            memory/3164-57-0x000001B43B250000-0x000001B43B350000-memory.dmp
            Download

            memory/3164-61-0x000001B43C280000-0x000001B43C2A0000-memory.dmp
            Download

            memory/3308-302-0x000001346C720000-0x000001346C820000-memory.dmp
            Download

            memory/3308-304-0x000001346C720000-0x000001346C820000-memory.dmp
            Download

            memory/3308-338-0x000001346DE60000-0x000001346DE80000-memory.dmp
            Download

            memory/3308-307-0x000001346D880000-0x000001346D8A0000-memory.dmp
            Download

            memory/3308-337-0x000001346D840000-0x000001346D860000-memory.dmp
            Download

            memory/4080-244-0x00007FF850340000-0x00007FF850356000-memory.dmp
            Download

            memory/4088-452-0x00007FF850340000-0x00007FF850356000-memory.dmp
            Download

            memory/4088-217-0x0000000003540000-0x0000000003541000-memory.dmp
            Download

            memory/4088-221-0x0000000003560000-0x0000000003561000-memory.dmp
            Download

            memory/4088-504-0x000000000AAA0000-0x000000000ACB4000-memory.dmp
            Download

            memory/4088-216-0x0000000003530000-0x0000000003531000-memory.dmp
            Download

            memory/4088-215-0x0000000003530000-0x0000000003531000-memory.dmp
            Download

            memory/4088-214-0x0000000003520000-0x0000000003521000-memory.dmp
            Download

            memory/4088-213-0x0000000003520000-0x0000000003521000-memory.dmp
            Download

            memory/4088-211-0x0000000003510000-0x0000000003511000-memory.dmp
            Download

            memory/4088-212-0x0000000003510000-0x0000000003511000-memory.dmp
            Download

            memory/4088-218-0x0000000003540000-0x0000000003541000-memory.dmp
            Download

            memory/4088-222-0x0000000003560000-0x0000000003561000-memory.dmp
            Download

            memory/4088-219-0x0000000003550000-0x0000000003551000-memory.dmp
            Download

            memory/4088-220-0x0000000003550000-0x0000000003551000-memory.dmp
            Download

            memory/4088-301-0x00000000052E0000-0x00000000052E1000-memory.dmp
            Download

            memory/4540-497-0x00007FF850340000-0x00007FF850356000-memory.dmp
            Download

            memory/4604-645-0x00007FF850340000-0x00007FF850356000-memory.dmp
            Download

            memory/4988-617-0x00007FF850340000-0x00007FF850356000-memory.dmp
            Download

            memory/5096-658-0x000001B21FFE0000-0x000001B220002000-memory.dmp
            Download

            memory/5096-675-0x00007FF850340000-0x00007FF850356000-memory.dmp
            Download

            memory/5108-709-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-713-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-703-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-702-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-701-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-704-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-705-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-729-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-708-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-707-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-706-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-730-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-711-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-712-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-716-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-715-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-714-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-700-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-718-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-722-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-721-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-720-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-719-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-717-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-724-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-725-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-728-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-727-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-726-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5108-723-0x0000000005970000-0x0000000005980000-memory.dmp
            Download

            memory/5112-498-0x0000025771480000-0x00000257714F8000-memory.dmp
            Download

            memory/5112-628-0x0000025700500000-0x000002570050C000-memory.dmp
            Download

            memory/5112-500-0x00000257715F0000-0x000002577163C000-memory.dmp
            Download

            memory/5112-502-0x0000025771640000-0x000002577168A000-memory.dmp
            Download

            memory/5112-501-0x00000257583D0000-0x00000257583FA000-memory.dmp
            Download