Analysis
- user interaction
yes - max time kernel
457s - max time network
506s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 12:34
General
- Target 12123434.exe
- Size 938KB
- Sample261102-prv1mswt4m
- SHA256 25847d420e245fc401d56150cf9e5b4391259c872b74ef0d10099e8d3680d8e4
Malware Config
Extracted
-
gomorat
-
1.8
-
t.me/junk_code
-
art.cantdown.su:1788
-
@junk_code
-
antivirtual
false
-
certificate
jbkxujtydn0g5204j3mp
-
delay_unit
Seconds
-
delay_value
10
-
disk_spread
true
-
enable_delay
false
-
exclusion_wd
true
-
hidden_file
true
-
install
true
-
install_watchdog
true
-
key
apnzyq2lsmp
-
path_client
%ProgramFiles%\junkSearch.exe
-
path_watchdog
%Windows%\junkSearcher.exe
-
pump
false
-
rootkit
2ojd99orkrumsws
-
rootkit_type
junkkit
-
task_client
ShellHost
-
task_watchdog
CookieManager
-
usb_spread
true
-
use_install_admin
true
-
user_init
true
-
winlogon_shell_enable
true
-
wmi_name
WindowsDefender
-
wmi_startup
true
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 35 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of FindShellTrayWindow 39 IoCs
- Suspicious use of SendNotifyMessage 26 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\12123434.exe"C:\Users\Admin\AppData\Local\Temp\12123434.exe"1⤵
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|OzEpy/3cGWMFkSx8JbMHyCrGAg5Cw5LEEQY4dFeQ6qDZZfHbKdK3PCQKqZ7cgTp5WindowsControl472|Tc7uA/sUXZHKRTYSbv3Dxr3sSkCziY35vfhtrFxouLk=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
C:\$RECYCLER\junkSearch.exe"C:\$RECYCLER\junkSearch.exe" 615|lqiur3qXiUlbggP7pkU0fw==C:\Windows.old616|1qUlzpL65/9Sd4RDMhM/yw==3⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff83c01c728,0x7ff83c01c734,0x7ff83c01c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,2897005600084387887,6454522192486490131,262144 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,2650862150431080402,13977939266904134559,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,1434193668597375383,10626182987371496455,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,10790913139871127409,9844368704150431915,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,17957698775966236420,12105963178995055483,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4652,i,6116810935409575128,5062435170279344215,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4796,i,6181669621802613561,10001392489888524690,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,17681201638067258854,11007358497055925218,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5376,i,2316225555282680459,5312166791133015467,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5444,i,16287420905018939963,4397663645084833126,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5488,i,18012062148134392385,13323508414541342051,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,2542406525798155820,3041933814975602650,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5704,i,595324221207639534,929604445754674863,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5636,i,493733453556117009,12477700119941830923,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5480,i,2025236981969296999,9327470550551930996,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3956,i,12006529267127016489,4515482302586035779,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3204,i,17329571342892434175,4712483422761107357,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5472,i,2133668550526258963,7766566669858254899,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,8696294353052710006,3568489602088482158,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5468,i,14441530514186837361,7401411224998018831,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,15610533661632276838,10881185500641363567,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4752,i,13632243280104427949,4301102273819156807,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,2241892415159270988,4655630361258058188,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,3716604425851348637,6151988326580592011,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,16027754321051558627,5517851654359102708,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:124⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5636,i,4925408721079579551,12799301846480366298,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5484,i,4424791285943244908,12093973975660142570,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=4780,i,1670625578777316074,17532824987793831949,2097152 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,3133985134673197896,17789987711353987804,524288 --field-trial-handle=1848,i,532740509727043396,16625363883302852325,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:144⤵
-
-
-
C:\Users\Admin\Desktop\simpleunlocker_release\SU.exe"C:\Users\Admin\Desktop\simpleunlocker_release\SU.exe"3⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /43⤵
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
$Recycle.Bin.lnk
Backup.lnk
Documents and Settings.lnk
Documents.lnk
PerfLogs.lnk
Photos.lnk
Program Files (x86).lnk
Program Files.lnk
junkSearch.exe
ProgramData.lnk
Recovery.lnk
Users.lnk
2ecb9cb2-2692-48b6-9022-feaba7d2c92f.tmp
55e359f2-c308-47a4-9a13-639b742218bd.tmp
settings.dat
07584a33-82dc-44f5-b5f7-1f4d97a6255b.tmp
6996f955-7f5f-4bff-8dd9-2ae6e2c73141.tmp
6a0e8793-9423-4e35-a580-de4ca6e8051d.tmp
6be40647-1de1-40d4-8726-9360889e3f30.tmp
8e4df31e-6447-4edf-97f0-080671125a39.tmp
f_000006
f_00000f
f_00001c
f_00001d
f_00001e
f_000026
f_00004c
temp-index
temp-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
MANIFEST-000001
7c277522-110a-4d75-9969-294fb44fd1a6.tmp
a8555a5a-53a6-4b29-a27c-2f168915e1bb.tmp
b06298e6-45c1-4b76-aff6-fb0cbf72cb32.tmp
f94a4241-8131-4818-88e3-c83b11fd42ca.tmp
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
58a1c625-0ed0-4639-84a5-4a079f392c7b.tmp
Network Persistent State
d732155d-727a-4fab-bf60-c959691c8a81.tmp
e47610f0-ba69-40ce-8d3f-74d6f9d694f6.tmp
e5d9292f-7c53-412a-84af-23a4d73244c8.tmp
e87e65d0-e981-4ed7-b6cb-7c3c03e50c07.tmp
f76747a3-9cc0-4da1-805c-8929e92127f1.tmp
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
4933bfe3-2cbe-4ae2-86f1-3a3e9065a4c4.tmp
messages.json
5a2098e080cf7ac4.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
SU.exe
48391ca7-18bd-4018-ba92-8b314a07e4e4.tmp
simpleunlocker_release.zip.crdownload
Windows.lnk
Windows.old.lnk
junk.dll
memory/1008-301-0x00000213801E0000-0x00000213802E0000-memory.dmp
memory/1008-314-0x0000021382A00000-0x0000021382A20000-memory.dmp
memory/1008-302-0x00000213801E0000-0x00000213802E0000-memory.dmp
memory/1008-334-0x0000021382C60000-0x0000021382C80000-memory.dmp
memory/1008-348-0x00000213846E0000-0x0000021384700000-memory.dmp
memory/1008-316-0x0000021382E40000-0x0000021382F40000-memory.dmp
memory/1460-64-0x0000026102C90000-0x0000026102CB0000-memory.dmp
memory/1460-34-0x00000261001E0000-0x00000261002E0000-memory.dmp
memory/1460-45-0x0000026102C70000-0x0000026102C90000-memory.dmp
memory/1460-78-0x0000026114250000-0x0000026114270000-memory.dmp
memory/1460-32-0x00000261001E0000-0x00000261002E0000-memory.dmp
memory/1460-33-0x00000261001E0000-0x00000261002E0000-memory.dmp
memory/1460-46-0x0000026102E70000-0x0000026102F70000-memory.dmp
memory/1628-485-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/1668-545-0x000001D8E9740000-0x000001D8E97B8000-memory.dmp
memory/2284-1898-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/2284-1109-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/2352-1110-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/2644-1897-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/3664-508-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/3916-1859-0x000002C03AAC0000-0x000002C03AAC1000-memory.dmp
memory/3916-1861-0x000002C03AAC0000-0x000002C03AAC1000-memory.dmp
memory/3916-1852-0x000002C03AAC0000-0x000002C03AAC1000-memory.dmp
memory/3916-1877-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/3916-1860-0x000002C03AAC0000-0x000002C03AAC1000-memory.dmp
memory/3916-1858-0x000002C03AAC0000-0x000002C03AAC1000-memory.dmp
memory/3916-1850-0x000002C03AAC0000-0x000002C03AAC1000-memory.dmp
memory/3916-1857-0x000002C03AAC0000-0x000002C03AAC1000-memory.dmp
memory/3916-1856-0x000002C03AAC0000-0x000002C03AAC1000-memory.dmp
memory/3928-544-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/4700-606-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/5128-1702-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/5196-6-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-2-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-0-0x000001BF9D4B0000-0x000001BF9D59E000-memory.dmp
memory/5196-14-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-3-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-5-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-4-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-12-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-137-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-11-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-10-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-13-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-1-0x00007FF82140F000-0x00007FF821410000-memory.dmp
memory/5196-7-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-8-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-30-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-256-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-9-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-29-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5760-512-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/5760-507-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/5980-262-0x000002B2B1D80000-0x000002B2B1D81000-memory.dmp
memory/5980-266-0x000002B2B1DA0000-0x000002B2B1DA1000-memory.dmp
memory/5980-274-0x000002B2B1DD0000-0x000002B2B1DD1000-memory.dmp
memory/5980-543-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/5980-506-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/5980-271-0x000002B2B1DC0000-0x000002B2B1DC1000-memory.dmp
memory/5980-270-0x000002B2B1DC0000-0x000002B2B1DC1000-memory.dmp
memory/5980-269-0x000002B2B1DB0000-0x000002B2B1DB1000-memory.dmp
memory/5980-268-0x000002B2B1DB0000-0x000002B2B1DB1000-memory.dmp
memory/5980-267-0x000002B2B1DA0000-0x000002B2B1DA1000-memory.dmp
memory/5980-275-0x000002B2B1DD0000-0x000002B2B1DD1000-memory.dmp
memory/5980-265-0x000002B2B1D90000-0x000002B2B1D91000-memory.dmp
memory/5980-264-0x000002B2B1D90000-0x000002B2B1D91000-memory.dmp
memory/5980-263-0x000002B2B1D80000-0x000002B2B1D81000-memory.dmp
memory/6056-1829-0x00007FF83B850000-0x00007FF83B866000-memory.dmp
memory/6056-1824-0x0000000000DB0000-0x0000000000F42000-memory.dmp