bdebe8d425b0a1d81290dab512f351d5d87ba17c4c2527a4e8f61a78574a18df

Analysis

max time kernel
595s
max time network
603s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/09/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WPS_Office_x64.exe
Size 109.0MB
Sample260908-ntmllsfb67
SHA256 bdebe8d425b0a1d81290dab512f351d5d87ba17c4c2527a4e8f61a78574a18df
MD5 1fef90dde8b4fb3043a9fc1b757e74fe
SHA1 c91620b858fb8364bcade5c4ccf13e3d7ab0427b
SHA512 99a5f7e32bcc07df4d5490de603f0267ea09725f2f3fac94c23e8fea964219ac9a543d5ce500fd1d95790d9d4766a408628093960f7873ddd84128c29f535c83
SSDEEP 3145728:4qtiu5om7PKG2uJnkCQ2BHGDV0uAfnRC5+StXXK+:tjqmzKruVkB25+09EK+
TLSH
T1A248331049835436E5CC10FB92326BA17C2AB6F067E4369E9EF5E00E173ECD5E1785EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery execution installer persistence ransomware spyware trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5612 created 3224	5612	elevation_service.exe	54

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3828	attrib.exe
4632	attrib.exe

Executes dropped EXE 11 IoCs

pid	Process
5408	WPS_Office_x64.tmp
3376	erkyhe.exe
1772	installer.exe
4492	erkyhe.exe
3168	erkyhe.exe
72	erkyhe.exe
5292	erkyhe.exe
6116	erkyhe.exe
3872	erkyhe.exe
1976	erkyhe.exe
5476	erkyhe.exe

Loads dropped DLL 9 IoCs

pid	Process
3376	erkyhe.exe
4492	erkyhe.exe
3168	erkyhe.exe
72	erkyhe.exe
5292	erkyhe.exe
6116	erkyhe.exe
3872	erkyhe.exe
1976	erkyhe.exe
5476	erkyhe.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3288	icacls.exe
5936	icacls.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	installer.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3196	cmd.exe
4836	cmd.exe
4104	cmd.exe
2588	cmd.exe
1476	cmd.exe
588	cmd.exe
920	cmd.exe
3860	cmd.exe
5436	cmd.exe
2808	cmd.exe
5088	cmd.exe
2312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPS_Office_x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPS_Office_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/memory/5396-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral3/memory/5396-38-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

GoLang User-Agent 8 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	547	Go-http-client/1.1
HTTP User-Agent header	672	Go-http-client/1.1
HTTP User-Agent header	782	Go-http-client/1.1
HTTP User-Agent header	29	Go-http-client/1.1
HTTP User-Agent header	149	Go-http-client/1.1
HTTP User-Agent header	236	Go-http-client/1.1
HTTP User-Agent header	291	Go-http-client/1.1
HTTP User-Agent header	423	Go-http-client/1.1

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
496	taskkill.exe
2092	taskkill.exe
1708	taskkill.exe
4840	taskkill.exe
4396	taskkill.exe
5092	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\FlightRoot	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\OemEsim	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TrustedDevices	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TestSignRoot	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	installer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
5408	WPS_Office_x64.tmp
5408	WPS_Office_x64.tmp
1772	installer.exe
1772	installer.exe
3376	erkyhe.exe
3376	erkyhe.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
1720	waitfor.exe
1720	waitfor.exe
3168	erkyhe.exe
3168	erkyhe.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
72	erkyhe.exe
72	erkyhe.exe
5612	elevation_service.exe
5612	elevation_service.exe
5292	erkyhe.exe
5292	erkyhe.exe
6116	erkyhe.exe
6116	erkyhe.exe
3872	erkyhe.exe
3872	erkyhe.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1976	erkyhe.exe
1976	erkyhe.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
5476	erkyhe.exe
5476	erkyhe.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe
1720	waitfor.exe

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
3376	erkyhe.exe
5612	elevation_service.exe
5612	elevation_service.exe
3168	erkyhe.exe
72	erkyhe.exe
5612	elevation_service.exe
5292	erkyhe.exe
6116	erkyhe.exe
3872	erkyhe.exe
1976	erkyhe.exe
5476	erkyhe.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	496	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	3376	erkyhe.exe
Token: SeShutdownPrivilege	5612	elevation_service.exe
Token: SeShutdownPrivilege	1720	waitfor.exe
Token: SeDebugPrivilege	1720	waitfor.exe
Token: SeDebugPrivilege	1720	waitfor.exe
Token: SeBackupPrivilege	1652	vssvc.exe
Token: SeRestorePrivilege	1652	vssvc.exe
Token: SeAuditPrivilege	1652	vssvc.exe
Token: SeDebugPrivilege	4492	erkyhe.exe
Token: SeDebugPrivilege	6128	whoami.exe
Token: SeDebugPrivilege	3168	erkyhe.exe
Token: SeDebugPrivilege	72	erkyhe.exe
Token: SeDebugPrivilege	5292	erkyhe.exe
Token: SeDebugPrivilege	6116	erkyhe.exe
Token: SeDebugPrivilege	3872	erkyhe.exe
Token: SeDebugPrivilege	1976	erkyhe.exe
Token: SeDebugPrivilege	5476	erkyhe.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5408	WPS_Office_x64.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1720	waitfor.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 5408	5396	WPS_Office_x64.exe	81
PID 5408 wrote to memory of 5092	5408	WPS_Office_x64.tmp	82
PID 5408 wrote to memory of 496	5408	WPS_Office_x64.tmp	85
PID 5408 wrote to memory of 2092	5408	WPS_Office_x64.tmp	87
PID 5408 wrote to memory of 1708	5408	WPS_Office_x64.tmp	89
PID 5408 wrote to memory of 4840	5408	WPS_Office_x64.tmp	91
PID 5408 wrote to memory of 4396	5408	WPS_Office_x64.tmp	93
PID 5408 wrote to memory of 3376	5408	WPS_Office_x64.tmp	95
PID 5408 wrote to memory of 1772	5408	WPS_Office_x64.tmp	96
PID 5612 wrote to memory of 2808	5612	elevation_service.exe	101
PID 2808 wrote to memory of 1720	2808	cmd.exe	103
PID 5612 wrote to memory of 5088	5612	elevation_service.exe	104
PID 5088 wrote to memory of 3288	5088	cmd.exe	106
PID 5612 wrote to memory of 2312	5612	elevation_service.exe	107
PID 2312 wrote to memory of 5936	2312	cmd.exe	109
PID 5612 wrote to memory of 4632	5612	elevation_service.exe	110
PID 1720 wrote to memory of 2224	1720	waitfor.exe	112
PID 5612 wrote to memory of 3828	5612	elevation_service.exe	113
PID 1720 wrote to memory of 2480	1720	waitfor.exe	115
PID 5612 wrote to memory of 1916	5612	elevation_service.exe	116
PID 4104 wrote to memory of 4492	4104	cmd.exe	123
PID 1720 wrote to memory of 2588	1720	waitfor.exe	125
PID 2588 wrote to memory of 4960	2588	cmd.exe	126
PID 2588 wrote to memory of 6128	2588	cmd.exe	127
PID 1476 wrote to memory of 3168	1476	cmd.exe	130
PID 3196 wrote to memory of 72	3196	cmd.exe	136
PID 588 wrote to memory of 5292	588	cmd.exe	140
PID 920 wrote to memory of 6116	920	cmd.exe	144
PID 4836 wrote to memory of 3872	4836	cmd.exe	150
PID 3860 wrote to memory of 1976	3860	cmd.exe	156
PID 5436 wrote to memory of 5476	5436	cmd.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4632	attrib.exe
3828	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3224
- C:\Users\Admin\AppData\Local\Temp\WPS_Office_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\WPS_Office_x64.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Users\Admin\AppData\Local\Temp\is-L9OK8.tmp\WPS_Office_x64.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-L9OK8.tmp\WPS_Office_x64.tmp" /SL5="$3024A,113930741,119296,C:\Users\Admin\AppData\Local\Temp\WPS_Office_x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM erkyhe.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5092
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM installer.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:496
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM erkyhe.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2092
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM installer.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1708
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM erkyhe.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4840
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM installer.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4396
  - - C:\Drivers\HawMHdS\erkyhe.exe
      "C:\Drivers\HawMHdS\erkyhe.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3376
  - - C:\Drivers\iWG4TtHV\installer.exe
      "C:\Drivers\iWG4TtHV\installer.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:1772
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:2224
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:2480
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4960
    - - C:\Windows\System32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:3288
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:5936
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4632
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3828
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn CqoxQeSKrMoDVVbVUHPbEcWd /tr "cmd /c cd /d \"C:\Drivers\HawMHdS\" && start \"\" \"C:\Drivers\HawMHdS\erkyhe.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1916

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:4048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\HawMHdS" && start "" "C:\Drivers\HawMHdS\erkyhe.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Drivers\HawMHdS\erkyhe.exe
  "C:\Drivers\HawMHdS\erkyhe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4492

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\HawMHdS" && start "" "C:\Drivers\HawMHdS\erkyhe.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Drivers\HawMHdS\erkyhe.exe
  "C:\Drivers\HawMHdS\erkyhe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3168

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:3272

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\HawMHdS" && start "" "C:\Drivers\HawMHdS\erkyhe.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Drivers\HawMHdS\erkyhe.exe
  "C:\Drivers\HawMHdS\erkyhe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:72

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\HawMHdS" && start "" "C:\Drivers\HawMHdS\erkyhe.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:588
- C:\Drivers\HawMHdS\erkyhe.exe
  "C:\Drivers\HawMHdS\erkyhe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:5292

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\HawMHdS" && start "" "C:\Drivers\HawMHdS\erkyhe.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:920
- C:\Drivers\HawMHdS\erkyhe.exe
  "C:\Drivers\HawMHdS\erkyhe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:6116

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:820

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\HawMHdS" && start "" "C:\Drivers\HawMHdS\erkyhe.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Drivers\HawMHdS\erkyhe.exe
  "C:\Drivers\HawMHdS\erkyhe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3872

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:2072

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\HawMHdS" && start "" "C:\Drivers\HawMHdS\erkyhe.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Drivers\HawMHdS\erkyhe.exe
  "C:\Drivers\HawMHdS\erkyhe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1976

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:412

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:548

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:4560

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:5496

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\HawMHdS" && start "" "C:\Drivers\HawMHdS\erkyhe.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Drivers\HawMHdS\erkyhe.exe
  "C:\Drivers\HawMHdS\erkyhe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:5476

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:6060

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:1164

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:5092

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:4604

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:1900

C:\Windows\system32\schtasks.exe
schtasks /query /tn CqoxQeSKrMoDVVbVUHPbEcWd
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

erkyhe.exe

Path C:\Drivers\HawMHdS\erkyhe.exe
Size 118KB
SHA256 e6873d63c910d712d0c77a37244b72f56d3f8061e791246a3a1b1b274a240c91
MD5 f192c032d734a3946754b0b82fba56e2
SHA1 ee3f66bed2ca0fb6d6b7ab972e33f02356cda37d
SHA512 89f82dccc782f4ba5e8a7464a0674802992e3c247eb6855538e1368f5b78ea309819985cc6c77345a1dd6f7cd0e0356760af9d5f9639352038cf5941fb9a6f84
SSDEEP 1536:ZNmX6Y2P0HSD31rBboMr+yxUxhg8CyHsWhbid09dlfGOeajp0WBrWB:ZNmqjESD3b0Mr+ySxhdCyfIM1eajp0k
TLSH
T1B8C39E5B73A430E9E6374A38C4A04916EB71F4721AA1CB6F026843951F273D19E7EF35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wSheY.fdy

Path C:\Drivers\HawMHdS\wSheY.fdy
Size 1.5MB
SHA256 543648eae341410f3783d3b7595e13ab9d8726bca1e9e6f5048f151d4d4b640b
MD5 a907c7778ec1f3b3d84fc908599d970c
SHA1 ad0a9e1dda7eceb94d36e178c34ede9320e03460
SHA512 29c80201da7658b524745bd3c5d4b2fb628573af025a0ebe070c1d8e0fe8f4771870191a7c61a1ce05e3fd6d2d45efa8062cc56a85ff154f2b366d10938e542a
SSDEEP 24576:cJbu5+G9bFHL8i6nOS4dB08doCsIhmZNuigWvOpORo6dl:ub5Gf8irDldo9IUUWvOQRo6b
TLSH
T16E75AFB7E56B18ECC0DCE5BCC624A26BF19074DA5E20774A6BB3C812AC627677F1C504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dft.psy

Path C:\Drivers\TrDSp\dft.psy
Size 10.2MB
SHA256 337815f763dd877eb2e7268c51eaa4575494b5549f2b2da003ed8a6ecd67ebca
MD5 e6fc29d6168aa2a1c53d8166899598dd
SHA1 91359a39fffc7476ae150180fac4cfad8644c519
SHA512 a8a0905966f8a25d187e8ca7e2c061aacc8a704c0534131dd4baa06eb2c0fc24ace5e4af74acf5f348e9140292b6376944f010cca988fb38071847ac00ffabbf
SSDEEP 196608:blS7EJEHrLrv3q15C9Kpy9K1S9rP03M/U4gZWoQqEPzzE7vZBjY:bs7Eyrv3aIY1SZPoM/dgWLfklZY
TLSH
T1A4B633FD613344BA6D46418ADAF3D3CAB0155591B4B0273C863C2BE5261F5832FBF2A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 117KB
SHA256 22a445aa51c0c01994e3b72e8fde3aabf1286971d0059455317a565816a0c608
MD5 9c412702ac7f0421aa732fd20844ba02
SHA1 197e06666c9fa93e0d6f9aaf51d68f282a6e4e40
SHA512 3afdb9fd45fa6888d234fab8c114184ca272d4fe7046cf2cbaa477efc4dbf4d005b45d588eaa8106f7dfb58763913f9ffcf870258f3bb61b2eb865c113deadfb
SSDEEP 3072:uFk0LhJj4Lqp0uO7O91hr46I4IUFBmlywYiy4eV:Isep0d7OZr454IA7Piy4A
TLSH
T143C312BBF075F4D514848C086293DA1FF7CE00D5B801DBBF22619AB71F67551A0F668A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 126KB
SHA256 c6784c8ba0db41f7b4d3b720fe31a12bb7b89bcf3c7b09bf0c7b69e30ba363a8
MD5 5ac7c87f067a18276755be98ea0789ea
SHA1 f77a84a9b89341898309f7b913fb5444400bf86d
SHA512 2d7f97d924da5c9be5c398c8c2aa0c6f063face3fb75668e03c79f7dba86d42144e39b45ef00495a77842395f104142bd4811dd25b90ad50b4f7887f00144861
SSDEEP 3072:uFk0LhJj4Lqp0uO7O91hr46I4IUFBmlywYiy4e/IS5N:Isep0d7OZr454IA7Piy4AN
TLSH
T12BC3126FE075F4D118888C086263D60FF6CD01D5BC41DB7F22209BBB1E7A991A0F168B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 17KB
SHA256 d196c4938244b7eb7e732b95d39efe9a991eaf6441a4965f0f95dc8ea30b29ee
MD5 0aea8c04c788bd3c85a9d4370b8d859d
SHA1 b9016386ef361ae2349c1f4a76411bc26c963a66
SHA512 22cd5f2ed0568f72532424a22d078f290343bce1937a59beae06a1c16a4930e8c157842bcb97acd363e893fbf6c86e03c1bdb4ef31ec5e848ce21c6890e45e9a
SSDEEP 384:d/YHs0QtORBqvgbwmdUM0SXRAHI+mPDJip3XciEjkuqA:dgHs0QtOjwmdUM0SXRAoDkeNjGA
TLSH
T1A782DFEBC27E74A146C08ED55182D33EFFDA04E67B404B3D62E68B356D15A152EE0D0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 3d351b9fc71cecb67ceeec5eb8abf33ee67722321826c0938ea392262d298829
MD5 55205972abd679c96153c111057c9112
SHA1 8f7cb4860b5bac7449c775f3328a88f7f62a1259
SHA512 e14f018b6716a5ec013482af3d326de76857ed0282d46fdd74f95d59ce27f556d26cd47ea4a877616bf359cb7dd6f09dc504ca2216367ff12fdee739f11e5e05
SSDEEP 768:dgHs0QtOjwmdUM0SXRAoDkeNjGMQscrHpdFNWpDBikay/KZz:uFjwqUn+RLhNjj4rvbWp0kGB
TLSH
T1F1F2F1ABC269F4B15B909E459143C72EFFCB4CD237800EBE4A574B316DB8B4294E190B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 52530e641b9873d892cc762a1184de9e7ee3b17c59627cf3f49fd4113dd6e4b8
MD5 36bba66ae6783a500ec3cf24be68ad55
SHA1 195127b3725bf1cde8d6824751ea9582b94dd0ce
SHA512 26e14bf977612746389a03646fa2463a102fe3cf1059c9b312608867358eaf970bf2b6c617cc167b1ebb51569408826f15eb5134b10afc344b5aee0fdcf99add
SSDEEP 768:dgHs0QtOjwmdUM0SXRAoDkeNjGMQscrHpdFNWpDBikay/KZlz97:uFjwqUn+RLhNjj4rvbWp0kGH97
TLSH
T111F2F1ABD269F4615BD0CE45A143C76EFFCB4CD236800EBE49578B316DB8B4294E190B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 36KB
SHA256 f60e55ba6a629c690377c2f209c3fda48f19591c7d7bd509ed757c02f8c20137
MD5 44728a91f58996761b9395adb796e00a
SHA1 08f5e133ad6c4b7626fe62b64997a89f3e9da7b2
SHA512 0534af1884f0d51d506a4c616fabb8312af7f3645c6c8680faca9c68746ab242bd33d4f559b39739f38006db948b9a02a8c5678a8b65f4ab926a21891fabdb8c
SSDEEP 768:dgHs0QtOjwmdUM0SXRAoDkeNjGMQscrHpdFNWpDBikay/KZlz9P/:uFjwqUn+RLhNjj4rvbWp0kGH9P/
TLSH
T1B2F2F1A7D259F4A15B90CE45A143C76EFFCB4CD236800EBE499B4B316DB4B4294D190F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 2KB
SHA256 6b773def0174be08caa10ad7eeb0d17add20ce29c3cd6592f35ddec0feaf61db
MD5 d939cb65c8ce9e8a5ddc66eb11196fef
SHA1 1231b29ea3a038a9fc28313eccbc0b8b9401d6a6
SHA512 d8d97d3ae5df00005bb3e4cf0ba3700b8bea1e1687a92e586034052832085d21a2836d0280b1e9d920af7ff797e61650ebf1d03f65f2d2e3032ad234a1d2d7a0
TLSH
T11C514CA2023E7314FF98A97B3ED177B5BAB815D1554406BC4E330B9B0E606E06EA0D79
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 d632ce2cf5a7bf378d049bf2de32130ab1c9d79bcc1c70db68acc4ac779d13ec
MD5 09c77260333ec74a5b0e5e17b895089e
SHA1 9cb03cb6cda439bbf5cf7733211415b9bebe92cb
SHA512 2f29e390c402c00fbc4c49df987af9b6be75650214db2e280d3769bcc5dc55ed4b223640a708e7db0656c75f18616d25a0ca8796a2d54c260502f64a75a82444
SSDEEP 768:dgHs0QtOjwmdUM0SXRAoDkeNjGMQscrHpdFNWpDBikay/KZlz9P/8PpZK/zOpxTV:uFjwqUn+RLhNjj4rvbWp0kGH9P0PW/zO
TLSH
T1F613F1A7D159F8F11A848D45A193D62BFBCB44D23B800EBF069B87726CB47C2D4E150E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 51KB
SHA256 517f80f0a27bed4fc0e1f03bfb68c3ccb0e25289b1ab6da5c3245e4ac2a815af
MD5 f8625ea9fa6e5e9b00e1345e94f05dca
SHA1 9a1f4a274809a07814590ad7c2107b9b8eff5471
SHA512 c5a3164888e1514359ddece74e8a2ba04ac741ba1440fb415fe168dd67ff4fc35e1196d54900c1bb92e0a3781201da8065cf5c699c9b43b576b47bca24f2d79e
SSDEEP 1536:uFjwqUn+RLhNjj4rvbWp0kGH9P0PW/zOpzuKsF9fi:uFk0LhJj4Lqp0uO7O91J
TLSH
T11233F177D269F8F159448D489083C66FFBCE08D33A404EBF059A9B736CA5AD2D1E250D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 57KB
SHA256 3344c3fa181b25271c64d0cad952a946101978ca41f78578969125dca482bc82
MD5 54fa0da695b028f7adecbbf0c202042b
SHA1 a19b04eefea0197e4eb2698a2d181edbb358980a
SHA512 0aaf5c31d0824669a9a6000e1f51da21411f7d7d349cb2fa512ed963172a81c3ab696090a45497704a76ac676860c7e602beff02377161d21e0924e2ac9dadf7
SSDEEP 1536:uFjwqUn+RLhNjj4rvbWp0kGH9P0PW/zOpzuKsF9fWE7CX9:uFk0LhJj4Lqp0uO7O91h3
TLSH
T1DE43F177E269F8E055848D45D1C3D62FFBCE08D336404ABF125B9B335D6AA92D0E250D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 65KB
SHA256 d5a516d9e26e7658c2278ff5c05e3bb41469c10a995588f9edd938781b61bd0e
MD5 922129add874a8243c6e6d0727e978e2
SHA1 af329dfefbf0bd6a54ac2f02b5676a7a93c92421
SHA512 411495388496e834327dfff31c9a5cbdbb376bdc2012355a11c3b5e93bd1ba6523dc86a3066291aea42e2ef91ef01afe62433d7dfbb1748451554144dedc289d
SSDEEP 1536:uFjwqUn+RLhNjj4rvbWp0kGH9P0PW/zOpzuKsF9fWE7CXiK46G:uFk0LhJj4Lqp0uO7O91hr46G
TLSH
T1A463F167E2A9F4E051848C0991C3E57FFBCE08E33A905B7F13465B735DB6A82D0D2549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 92KB
SHA256 9fb07fab30664f652b56d166d6d9a9d81e363cb50b67bd0c708b18fd8ed4c79b
MD5 16fd9adc3f0b25320a1795efda2f87d7
SHA1 40844f70dfe87df47651194e4aff783c30ab4f13
SHA512 a935db84bb5d08a2c0a7428c607abf1661486da63b26cb3dc61eff11a29f02c83637543e65f80bdfc70bdf48386e3ec62cfb5be5941612218cf20a4469dd9e9b
SSDEEP 1536:uFjwqUn+RLhNjj4rvbWp0kGH9P0PW/zOpzuKsF9fWE7CXiK46wFBRwRpG7p6FBHY:uFk0LhJj4Lqp0uO7O91hr46I4IUFBmlr
TLSH
T1679302B7F1B8F4D01180CC0862D3E66FFBCD04E675919B7B12459EB72EAA58190E274E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 110KB
SHA256 e8632432ecde54c8e7521df779a53bc36fa4ea2580e434dceb5216e6aeb3071b
MD5 0f0a4484812a92eb87287da8dbe09ad3
SHA1 2ba84034101f063f9b38c28c124a3bd1c54157e8
SHA512 a9421994dbe63b9028bc0b89331d024c8f1196c91ea91fd4632e0af8524ebea811f9731d9d7d32867214299b41f8475fd0074554582e77a1a92478a4c9ef61b9
SSDEEP 3072:uFk0LhJj4Lqp0uO7O91hr46I4IUFBmlywYiy4eJ:Isep0d7OZr454IA7Piy4Y
TLSH
T1C6B3127BF1B8F4D11484CC086293DA5FF7CE00E5785197BF22519AB71F67582A0F2A8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 117KB
SHA256 b29250df8b1c0b7ad40585a2189b85db8e419df468d16423094216bb384ee5fd
MD5 a7af8b8171b633ef02788aed59b2df6b
SHA1 9048d6ce27917382966985eca847b566d6b376c1
SHA512 b2105d1f7737a2eb358119a8cb0845cff50c2f523433d1c6f4408190759a39f6149a2dc1f18beba6c3977c2ba470f348f37dd8105db26c05283df9f156bea78d
SSDEEP 3072:uFk0LhJj4Lqp0uO7O91hr46I4IUFBmlywYiy4e9:Isep0d7OZr454IA7Piy4g
TLSH
T11DC312BBF075F4D514848C086293DA1FF7CE00D5B801DBBF22619AB71F67551A0F668A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 126KB
SHA256 8f48e9d24cd6b33aa61d2fd74efd3665e2b326fc2fbd57c97424deb1fae4c895
MD5 b33d50431f2b5b395091991c3463fae9
SHA1 0412d9d0c1d5020dbede5217294e8c893e4c49e7
SHA512 a87fbade2a483ed2cc0a9ee8c39400eb93814e2216073fd1f0ec6db08599e7a9438d0ee55fdaeb3dd0b84a657417594817b82a6b7887a41abf22c86f6da50148
SSDEEP 3072:uFk0LhJj4Lqp0uO7O91hr46I4IUFBmlywYiy4eHIS5N:Isep0d7OZr454IA7Piy4gN
TLSH
T1E1C3126FE075F4D118888C086263D60FF6CD01D5BC41DB7F22209BBB1E7A991A0F168B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 40KB
SHA256 99d67871144622c65aea136e3c3be12187a78a6ab42bde01deb80221f2b2d902
MD5 ff3b81c9894c45f2b6b898bfeb40669b
SHA1 12b2f4144ad1801c2e6d14a5a5448a3b5d5aab55
SHA512 1392c15c760a207caa93b67efa5f60bb021ad84c4e48064a957e844d36b5bf122b78e404d67929f0a2578e1f007526999f1c27f532bd04162ee6a0d1cc16e035
SSDEEP 768:dgHs0QtOjwmdUM0SXRAoDkeNjGMQscrHpdFNWpDBikay/KZlz9P/8PpZK/zOpxTU:uFjwqUn+RLhNjj4rvbWp0kGH9P0PW/zB
TLSH
T1CE03F1B7D159F8E11E408E859153D62FFBCA48E237800EBE499AC7726DA4B8394E150E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 df74f38089fba26d0ea2d4ab7663d911cbfe9568918ea32b1a14beded406a67a
MD5 f6ef039befb565ae7691cfdaff05470e
SHA1 7f4aa615c2bc2c540d4b79b61204a0c740eb4c75
SHA512 b7aafe93832ccba0beeb255cacd2d66dcfe7b1e53bfc71b0759ab10f8d635816858ce78540d848b510fa805d7f7a491af72b88756298e0eceb0c53349a0e38e9
TLSH
T164817E51423EB224E754AE6736D19775BAB809E5560003BCCD170F371E202906EE0D29
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 7KB
SHA256 ee26efdec632681178e8e3c5f876daa6fa3ef91d5b2b8a9e95b419363bdd8248
MD5 63ee742158916b5fdfc33df2230634d8
SHA1 27c6cdea83bb7e142b665c52f5acb03d09254def
SHA512 203a40b19a4a7adcd0ca90bd62d7258e36c7b9812054b79b601d35f3f362a8944856b70e1d89c318c3d0aed1483ef61fbc3a72d74a54dad1a3d555be980fc4cf
SSDEEP 192:QI/YmksEQG+rTHw7A5MRBTkTvmL563WN+59WdoE8dlggH:d/YHs0QtORBqvgbwmdUMK
TLSH
T10EF19F43C23A715059104E6F2192973AFFD848E5E54203788DA64B766D662A07DE0E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 92KB
SHA256 35d95a3a223f9af5b24e85f53e7b37c9cd2aff79b523c392d4321400f7829f0e
MD5 66ec06d60f85898273ce281fc5fea668
SHA1 4fcdb321d4faba9ccabd9d4f3a49990ccd52ab5e
SHA512 3e5797346f167ac9ba760b4bbd5eb790aec88a9a7b738bd14a9eef00427f1494f9721263ff733aab1d0cc2d62c71821a8d0b761c3230f95839cb017b322d9139
SSDEEP 1536:uFjwqUn+RLhNjj4rvbWp0kGH9P0PW/zOpzuKsF9fWE7CXiK46wFBRwRpG7p6FBHJ:uFk0LhJj4Lqp0uO7O91hr46I4IUFBmla
TLSH
T1D49302B7F1B8F4D11144CC08A2D3E66FF7C904E635919BBF13458EB72EAA58190E274A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gruppirovka.mp4

Path C:\Drivers\iWG4TtHV\gruppirovka.mp4
Size 31.1MB
SHA256 8d3e5e5b55a1abbc5951f205ccd4c4cfe687a9df7527e76a45caebf4c4570b88
MD5 7ac05a40e96571d1a58b3692f7ecc141
SHA1 d2f6d56ff4908847c447a97b61c4c456562ea156
SHA512 b30e5bea42beb79786fad95571d97dd8f9e24e78fc25edce696cb40f8208947862fa12dd3b17e58c020e0740dbae74eba08e135f31cefc3ba14b2169932c965c
SSDEEP 786432:VsOizBrwtEJFWQbS4x5F+GM2108UpDfsbYpS9Fu:JdtYUGMm08U5fsbYpCE
TLSH
T1CE6733758739B0C5C374E3FABAD831AF5B2756C60B5CF3B084A12387E069A41A9F7458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Drivers\iWG4TtHV\installer.exe
Size 5.5MB
SHA256 4932670ff54b6efef2ddef4835295646d3c5c66e69d944fce456d9c32a26f66b
MD5 5a2bdf7321c1c4cd4306837fc40c2e5d
SHA1 f4c101eaf525f116a6d6d0388a6b2cc2dba58142
SHA512 5a3ec1bc0a2b0688a956d12bc9549ea2f7fe6ff40366bc627dc02a56b0147923a46cd47708ce6c8a544a9e90d705586d31a23356b5e6be946ba1a8cb7cffadaa
SSDEEP 98304:kWJLSU6ZVUdnkurXJ1m2CJQvGPeuTxp6vTV1IWdsBO4+jQ/1pF:fmU6ZVwPrnYJTxpadsZ+o1pF
TLSH
T10346C011FB8681F1E4D201B0157BBBBA587DAA285B2588D7F7D02D2584302D37A3BF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

poisk.mp3

Path C:\Drivers\iWG4TtHV\poisk.mp3
Size 2.1MB
SHA256 c111726df47365303907d4aea434cc80cb20cd19ebf9ea1260eaf06293668596
MD5 fcf4344ad4eb250408337456adf616c5
SHA1 48803f1fdcf883cd9036bc2a4ee2cc6c896582e1
SHA512 7a03f5c0fab3e6be5650bc0064b465d6878a94c443cf4de28c8f07eb7b64bc4864a46f1a4eb4597aaad3c19235ee91c863ec17203b44c773b3e8c5f120ff30b1
SSDEEP 49152:YmDScdWwZl8sMBHJ5rrYlkPaoah0nJeR9IqsoBAK/DBjdriyab:Ym+cdTQscrYqP4h0J7kp/Dl1ab
TLSH
T116A533548206E6A5C67B46FFB2EC3B0F1792F5E81F3C368675D0289A12FA30BCA54475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proporciya.png

Path C:\Drivers\iWG4TtHV\proporciya.png
Size 17.7MB
SHA256 675796549888a89b9994f754a62fb9241004d13cdad2d6734a34ae9af1fe4387
MD5 1b725e1dc31eaef1c2c18382ebdccfc1
SHA1 6bd50fabc4d7cb9b388bf95cf34ab6e01f4702bc
SHA512 32fab52e569a15e8a34fbb9f9fde97e67db1394fa1f9d3a55c00cb9c7175551643887b7e1abcf6dd34ed403eee42386d140cb4cb6b8909ffc411c5d2cf657086
SSDEEP 393216:XRQZDJA3TwRBicgLSHI4m/yaAlRfp/61Ti7p6eDG5OYLW9ML9:X+6wPx4SHI4ujwfVM4xG5OYkM9
TLSH
T1621733304CD0AC1041DC60DFF68B7FDA39AF50D8EF554B5292D3BA41EE248E29D7946A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prosmotr.mp3

Path C:\Drivers\iWG4TtHV\prosmotr.mp3
Size 2.4MB
SHA256 eaa7ff4b4cc358efc6cff9cab9edf8217e717cc8ebba5eeed1d44783e6d2715f
MD5 6cf451649b483425db85b35b851a854b
SHA1 7528a790b62b76848dba3692036a234544566883
SHA512 9710a14ec9411685985ae04634677510e1813302d6488ead761ada3278c3e0d24834e6c84970de9702484d4683c847e31d175f3fec03faaf99ff901e519e41c9
SSDEEP 49152:hS4Y8ngXqUhngybowuZSqfQP4r4WH+DG9FxMeqk/OApCn4Exw6o:fY8ngXqUhn1bXk143I+0NBOApCnXP
TLSH
T1A6C533508FD89A1FC2AE8D36B391712D6764DFF83609302113CA3941ED736B09AE96CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ritm.mp4

Path C:\Drivers\iWG4TtHV\ritm.mp4
Size 31.4MB
SHA256 9ea2857ddefd4413b3c7db6d17d5af4a84b4fbc28547e28c7f0ff8e44d19da8e
MD5 9c4037370b916393960ce241f513044e
SHA1 315d99e7e14a0ce09140888e4f1e9dfe2f791f36
SHA512 197727a36af0e17270c9fe1197574cb4c8add162834b0dad947bcd1381189112f79c75211e3f0729a786baaf493feeb7e36aff22408037dd661fa7f4df0925ed
SSDEEP 786432:EEhpaQAMro0AC6kWUQkEtvw0z5lELLGVIihWF8uw6YeAE1thS2eY:E1Q9rAB1UQkEtvwW56uVIHBf31I2r
TLSH
T14077333C537A3595D310B3F374C6226F492BA3E24D1CB2E159AA23C2D53CA45DAF9C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zagolovok.png

Path C:\Drivers\iWG4TtHV\zagolovok.png
Size 18.4MB
SHA256 492b83beecac704cbe8bbda808532c94cbcf0b759c0a7c3898567df8dd1bed7b
MD5 820a2b3347278c1847ae925b209b1904
SHA1 a4b347d1fb4211b2eb8c6d6ef90397bf36ef99dd
SHA512 d51f4c723694d121c80182b2960aafd7682ca22b9b059ce0e6b1324f46fc6e38762a1af30a8b69508ef463b4c00145c3927a8171ca98eb43880f33b9e0290853
SSDEEP 393216:jvPJiQr5PLqYuUDIHVCi7QSRZiWzthTGDZ/Dxyi0Bkqz0kgk3KVGaZzsKtewGqG:9Vr5aMi7Qatha/zQybVGB/qG
TLSH
T1D3173388D7524D71B26F58BD52A60FF1150AF6E02F9CA3CF6F9A90021B8990BF75CD84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WPS_Office_x64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-L9OK8.tmp\WPS_Office_x64.tmp
Size 1.1MB
SHA256 cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839
MD5 129b8e200a6e90e813080c9ce0474063
SHA1 b5352cdae50e5ddf3eb62f75f2e77042386b8841
SHA512 10949e7f0b6dd55e0a5d97e4531ef61427920cccc2136c0dd3607cdc79afa0d8a7178965a07039948da97f0200ead8fe5a54921620c943c7fc76dd5ef5a7c841
SSDEEP 24576:WEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsyb7xyx:bdmbjTKlD00R
TLSH
T17C453A22A3D68433D5732E758D6BC2945C367E202FA4D48A7EF89E0C4E79B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1720-470-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-319-0x000001D4EEF00000-0x000001D4F00E1000-memory.dmp

Download

memory/1720-391-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-389-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-390-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-320-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-468-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-469-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-622-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-479-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-621-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/1720-396-0x000001D4F00F0000-0x000001D4F333A000-memory.dmp

Download

memory/5396-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/5396-38-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/5408-37-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/5408-5-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/5612-367-0x0000024079990000-0x0000024079A2B000-memory.dmp

Download

memory/5612-297-0x0000024079990000-0x0000024079A2B000-memory.dmp

Download

memory/5612-247-0x0000024079990000-0x0000024079A2B000-memory.dmp

Download

memory/5612-214-0x0000024079990000-0x0000024079A2B000-memory.dmp

Download

memory/5612-196-0x0000024079990000-0x0000024079A2B000-memory.dmp

Download

memory/5612-1041-0x0000024079990000-0x0000024079A2B000-memory.dmp

Download

memory/5612-1102-0x0000024079990000-0x0000024079A2B000-memory.dmp

Download

memory/5612-190-0x00000240798F0000-0x0000024079988000-memory.dmp

Download