Overview

overview

10

Static

static

10

WoolperTools.exe

windows10-ltsc_2021-x64

Analysis

  • user interaction
    yes
  • max time kernel
    164s
  • max time network
    179s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    02/11/2026, 17:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    WoolperTools.exe
  • Size 908KB
  • Sample261102-vqa7qsff92
  • SHA256 2a8bdc2edb9f0aa75304a481bc006ce911982d2f6920b1852b473eacae573e01
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebootkitt.me/junk_codecosturadiscoveryexecutiongomoratpackerpersistenceprivilege_escalationransomwareratspyware

Malware Config

Extracted

Family

  • gomorat

Version

  • 1.8

Botnet

  • t.me/junk_code

C2

  • art.cantdown.su:1788

Mutex

  • @junk_code

Attributes
  • antivirtual

    false

  • certificate

    fljr4g5t35

  • delay_unit

    Seconds

  • delay_value

    5

  • disk_spread

    false

  • enable_delay

    false

  • exclusion_wd

    true

  • hidden_file

    true

  • install

    true

  • install_watchdog

    true

  • key

    ksgmnltgnr7u76oz

  • path_client

    %ProgramFiles%\junkSearch.exe

  • path_watchdog

    %Windows%\junkSearcher.exe

  • pump

    false

  • rootkit

    1mabx22advx

  • rootkit_type

    junkkit

  • task_client

    ShellHost

  • task_watchdog

    CookieManager

  • usb_spread

    true

  • use_install_admin

    true

  • user_init

    true

  • winlogon_shell_enable

    true

  • wmi_name

    WindowsDefender

  • wmi_startup

    true

Signatures

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 14 IoCs
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Start PowerShell.

    execution
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
    execution
  • Costura .NET executable packer 1 IoCs

    Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

    costurapacker
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WoolperTools.exe
    "C:\Users\Admin\AppData\Local\Temp\WoolperTools.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
        PID:2392
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" 471|zOVUu3Y9Ncg4RDt8ZtLGLwVoLJC1FgNZukg7KhXeKt4o+ZW/cOapmalibCWiYs9YWindowsControl472|9in96WvXqVcDtqLc3bhpOQ8G555a7dcK0JuNGVbvLdg=C:\Program Files\junkSearch.exe" enable=yes & exit
        2⤵
          PID:2556
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:924
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3264
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4200
        • C:\Program Files\junkSearch.exe
          "C:\Program Files\junkSearch.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4000
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            3⤵
            • Loads dropped DLL
            PID:2480
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp46AF.tmp.exe"' & exit
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2480
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp46AF.tmp.exe"'
              4⤵
              • Loads dropped DLL
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of WriteProcessMemory
              PID:4984
              • C:\Users\Admin\AppData\Local\Temp\tmp46AF.tmp.exe
                "C:\Users\Admin\AppData\Local\Temp\tmp46AF.tmp.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4976
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat" "
                  6⤵
                  • Checks computer location settings
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1664
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mbr.exe
                    mbr.exe
                    7⤵
                    • Executes dropped EXE
                    • Writes to the Master Boot Record (MBR)
                    • System Location Discovery: System Language Discovery
                    PID:4164
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sound.vbs"
                    7⤵
                    • Enumerates connected drives
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:4072
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe
                    erroricons.exe
                    7⤵
                    • Executes dropped EXE
                    PID:2264
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe
                    INVERS.exe
                    7⤵
                    • Executes dropped EXE
                    PID:1352
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe
                    crazywarningicons.exe
                    7⤵
                    • Executes dropped EXE
                    PID:1180
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe
                    crazyinvers.exe
                    7⤵
                    • Executes dropped EXE
                    PID:1176
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe
                    erroriconscursor.exe
                    7⤵
                    • Executes dropped EXE
                    PID:5076
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe
                    toonel.exe
                    7⤵
                    • Executes dropped EXE
                    PID:2548
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages2.vbs"
                    7⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:2456
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages.vbs"
                    7⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:4792
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpF00F.tmp.exe"' & exit
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1948
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpF00F.tmp.exe"'
              4⤵
              • Loads dropped DLL
              • Command and Scripting Interpreter: PowerShell
              PID:2512
              • C:\Users\Admin\AppData\Local\Temp\tmpF00F.tmp.exe
                "C:\Users\Admin\AppData\Local\Temp\tmpF00F.tmp.exe"
                5⤵
                  PID:4660
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpF2EF.tmp.exe"' & exit
              3⤵
              • Executes a command shell one-liner
              PID:4560
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpF2EF.tmp.exe"'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:232
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4472
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
          1⤵
            PID:3492
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:4936
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:3344
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2020
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Loads dropped DLL
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:2876
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
            1⤵
            • Loads dropped DLL
            PID:3884
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:2248
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:1148
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
            • Loads dropped DLL
            PID:3868

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                3
                T1059

                PowerShell

                1
                T1059.001

                Visual Basic

                1
                T1059.005

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Active Setup

                1
                T1547.014

                Winlogon Helper DLL

                1
                T1547.004

                Event Triggered Execution

                1
                T1546

                AppInit DLLs

                1
                T1546.010

                Pre-OS Boot

                1
                T1542

                Bootkit

                1
                T1542.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Active Setup

                1
                T1547.014

                Winlogon Helper DLL

                1
                T1547.004

                Event Triggered Execution

                1
                T1546

                AppInit DLLs

                1
                T1546.010

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Modify Registry

                3
                T1112

                Pre-OS Boot

                1
                T1542

                Bootkit

                1
                T1542.003

                Credential Access

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                4
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                2
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                junkSearch.exe
                • Path C:\Program Files\junkSearch.exe
                • Size 908KB
                • SHA256 2a8bdc2edb9f0aa75304a481bc006ce911982d2f6920b1852b473eacae573e01
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CurrentDatabase_400.wmdb
                • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                • Size 64KB
                • SHA256 0d6943432a32c38e203c1a2eace24145e470b06d9d73bdf3a82a32955124d00d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WMSDKNS.XML.bak
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
                • Size 9KB
                • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StructuredQuerySchema.bin
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
                • Size 414KB
                • SHA256 4d71760d6f3159849068b635ab4c39b9b747d899f03670533971a62d262c264e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                iconcache_idx.db
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                • Size 28KB
                • SHA256 0a2f3d6fda3e9f38d302c517394f7b90448ac036e5cd9f591ed18cee4d0ce728
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 64B
                • SHA256 0551a9f7ea3b7044f08d06265256052d51631f75e30e27b20dc2a43dd1f9052d
                • MD5 SHA1 SHA512
                Submit Download

                fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                • Size 2KB
                • SHA256 17d97202c72d9e3e957692f2dacafc054c972d4566fdb7e5cc94076f991cea4e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                AppCache134381131216223774.txt.~tmp
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134381131216223774.txt.~tmp
                • Size 85KB
                • SHA256 58f6c3db1999a6825019d7d3b38b7120338937c8ec773f786425a2dece4af415
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                microsoft.windows[1].xml
                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BJCA0IZM\microsoft.windows[1].xml
                • Size 97B
                • SHA256 92466f82cf14aa995418e12664c2b231c228c5f1203978bfe06f205c696b6726
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                INVERS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe
                • Size 2.3MB
                • SHA256 e69c9383b5d9fe4e069ddee15797c52e9116f883ad3b1717d2519621ab2751b2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                crazyinvers.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe
                • Size 2.3MB
                • SHA256 47f0e9a90d45b193e81d3e60b7a43e5a4550a07a3dd1f7c98110fde12265d999
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                crazywarningicons.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe
                • Size 1.2MB
                • SHA256 0ecbb8099ed1d9a1673165d3c4c9bbde88dd9678540a98b99434ff23b9e6d82c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dobrota.mp3
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\dobrota.mp3
                • Size 6.6MB
                • SHA256 a40dd9aedae52766593bce06a9a68d47fcf8d430f254ce5e50b0c55587d46213
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                erroricons.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe
                • Size 316KB
                • SHA256 994efdb644ca1acb029dfd8d8eeba440e1cb74d93841b17f21165b9900730b15
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                erroriconscursor.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe
                • Size 316KB
                • SHA256 f0fe346146c30129ed6f507906c973f1a54c7d8dd8821c97e9b6edc42545699d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mbr.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\mbr.exe
                • Size 47KB
                • SHA256 ea5d21e6598d52b30e9d055bc406c6227bbadb5c493addb27b32fb16a6dcae8c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                messages.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages.vbs
                • Size 37B
                • SHA256 e1cdab59df6508013e8b91c71043c8ecfe81b94a037706147ed19adf992539e6
                • MD5 SHA1 SHA512
                Submit Download

                messages2.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages2.vbs
                • Size 37B
                • SHA256 bffa14678b8c39c2fbfa54b76fbac5f750aebc8dc2954da10a55b7f1f90f351c
                • MD5 SHA1 SHA512
                Submit Download

                sound.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sound.vbs
                • Size 216B
                • SHA256 3d6123cae8ac645d9c9d33b0dada869a7fdd5117a2bf0f9080e4e30fe5bed736
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                start_dobrota.bat
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat
                • Size 220B
                • SHA256 d51fd681ba6346842afe2f9cb7ae117cb667986af0c67e28664124173b183740
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                toonel.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe
                • Size 317KB
                • SHA256 fe7ff85b95ec06ce0f3cb49fdfa4d36de1f08669d36d381794aaf597510afad7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_n2oiqdga.oaq.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2oiqdga.oaq.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                tmp46AF.tmp.exe
                • Path C:\Users\Admin\AppData\Local\Temp\tmp46AF.tmp.exe
                • Size 7.8MB
                • SHA256 10a45dc010df96cbd65bfd8a59e906ca5f98dd6f7541cf02bdfc17df8384bb8f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmpF00F.tmp.exe
                • Path C:\Users\Admin\AppData\Local\Temp\tmpF00F.tmp.exe
                • Size 225KB
                • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                junk.dll
                • Path C:\Windows\junk.dll
                • Size 58KB
                • SHA256 bd02435863c792fd6247bcc1242b12dca250a7db42cb8aa3e41170880881dadc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/232-575-0x00007FFCD24D0000-0x00007FFCD24E6000-memory.dmp
                Download

                memory/1148-488-0x00000282A2C00000-0x00000282A4530000-memory.dmp
                Download

                memory/1148-217-0x0000028AA4900000-0x0000028AA4A00000-memory.dmp
                Download

                memory/1148-251-0x0000028AA6540000-0x0000028AA6560000-memory.dmp
                Download

                memory/1148-250-0x0000028AA6560000-0x0000028AA6580000-memory.dmp
                Download

                memory/1148-236-0x0000028AA6520000-0x0000028AA6540000-memory.dmp
                Download

                memory/1148-265-0x0000028AB8C90000-0x0000028AB8D90000-memory.dmp
                Download

                memory/1148-360-0x00000282A2C00000-0x00000282A4530000-memory.dmp
                Download

                memory/1148-336-0x0000028AB8940000-0x0000028AB8A40000-memory.dmp
                Download

                memory/1176-492-0x0000000000400000-0x0000000000582000-memory.dmp
                Download

                memory/1180-491-0x0000000000400000-0x0000000000541000-memory.dmp
                Download

                memory/1352-490-0x0000000000400000-0x0000000000582000-memory.dmp
                Download

                memory/1884-0-0x000001FF692F0000-0x000001FF693D6000-memory.dmp
                Download

                memory/1884-55-0x00007FFCE56C0000-0x00007FFCE575D000-memory.dmp
                Download

                memory/1884-1-0x00007FFCE56C0000-0x00007FFCE575D000-memory.dmp
                Download

                memory/2020-106-0x0000028F3DD30000-0x0000028F3DE30000-memory.dmp
                Download

                memory/2020-92-0x0000028F2B9A0000-0x0000028F2B9C0000-memory.dmp
                Download

                memory/2020-81-0x0000028F2B980000-0x0000028F2B9A0000-memory.dmp
                Download

                memory/2020-91-0x0000028F2BC50000-0x0000028F2BC70000-memory.dmp
                Download

                memory/2020-183-0x0000028727CB0000-0x00000287295E0000-memory.dmp
                Download

                memory/2264-489-0x0000000000400000-0x0000000000454000-memory.dmp
                Download

                memory/2480-200-0x00007FFCD24D0000-0x00007FFCD24E6000-memory.dmp
                Download

                memory/2512-559-0x00007FFCD24D0000-0x00007FFCD24E6000-memory.dmp
                Download

                memory/2548-494-0x0000000000400000-0x0000000000454000-memory.dmp
                Download

                memory/2876-174-0x0000000002200000-0x0000000002201000-memory.dmp
                Download

                memory/2876-178-0x0000000002680000-0x0000000002681000-memory.dmp
                Download

                memory/2876-172-0x00000000021F0000-0x00000000021F1000-memory.dmp
                Download

                memory/2876-182-0x00000000026A0000-0x00000000026A1000-memory.dmp
                Download

                memory/2876-181-0x00000000026A0000-0x00000000026A1000-memory.dmp
                Download

                memory/2876-180-0x0000000002690000-0x0000000002691000-memory.dmp
                Download

                memory/2876-179-0x0000000002690000-0x0000000002691000-memory.dmp
                Download

                memory/2876-171-0x00000000021F0000-0x00000000021F1000-memory.dmp
                Download

                memory/2876-177-0x0000000002680000-0x0000000002681000-memory.dmp
                Download

                memory/2876-333-0x00007FFCD24D0000-0x00007FFCD24E6000-memory.dmp
                Download

                memory/2876-173-0x0000000002200000-0x0000000002201000-memory.dmp
                Download

                memory/2876-215-0x00000000028E0000-0x00000000028E1000-memory.dmp
                Download

                memory/2876-175-0x0000000002220000-0x0000000002221000-memory.dmp
                Download

                memory/2876-176-0x0000000002220000-0x0000000002221000-memory.dmp
                Download

                memory/3868-332-0x00007FFCD24D0000-0x00007FFCD24E6000-memory.dmp
                Download

                memory/3884-214-0x00007FFCD24D0000-0x00007FFCD24E6000-memory.dmp
                Download

                memory/4000-376-0x000002C9CBDF0000-0x000002C9CBE68000-memory.dmp
                Download

                memory/4000-412-0x000002C9CC1F0000-0x000002C9CC23A000-memory.dmp
                Download

                memory/4000-381-0x000002C9CBDB0000-0x000002C9CBDBC000-memory.dmp
                Download

                memory/4000-411-0x000002C9CC1C0000-0x000002C9CC1EA000-memory.dmp
                Download

                memory/4000-410-0x000002C9CC170000-0x000002C9CC1BC000-memory.dmp
                Download

                memory/4072-484-0x0000000005B00000-0x0000000005B10000-memory.dmp
                Download

                memory/4072-481-0x0000000005B00000-0x0000000005B10000-memory.dmp
                Download

                memory/4072-482-0x0000000005B00000-0x0000000005B10000-memory.dmp
                Download

                memory/4072-483-0x0000000005B00000-0x0000000005B10000-memory.dmp
                Download

                memory/4072-480-0x0000000005B00000-0x0000000005B10000-memory.dmp
                Download

                memory/4072-485-0x0000000005B00000-0x0000000005B10000-memory.dmp
                Download

                memory/4164-453-0x0000000000400000-0x0000000000412000-memory.dmp
                Download

                memory/4472-58-0x0000000004470000-0x0000000004471000-memory.dmp
                Download

                memory/4984-397-0x0000021E38710000-0x0000021E38732000-memory.dmp
                Download

                memory/4984-409-0x00007FFCD24D0000-0x00007FFCD24E6000-memory.dmp
                Download

                memory/5076-493-0x0000000000400000-0x0000000000454000-memory.dmp
                Download