14daf4e07c92a2e4a83e658a76a54ed907c7f3885de63149b64dc3168e55702f

Analysis

user interaction
yes
max time kernel
899s
max time network
905s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/10/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WPS_Office_x64.exe
Size 126.2MB
Sample261007-ep92nsds8r
SHA256 14daf4e07c92a2e4a83e658a76a54ed907c7f3885de63149b64dc3168e55702f
MD5 36919bc2b06e1f2e07cc3c7643c3e57a
SHA1 506353d007815df4c45596ebdac89cdc995d46b6
SHA512 ccb798f0b1c275ea4b2bacf19128ae0771c6fdc7aa9a81b762d7a77c3e76963a79ae5faecc55d9db43c64ab351d33304dd78a8805f5e1b6e29362855985d54d0
SSDEEP 3145728:pnsE1R2M8mVDcuy74o2iT7xt1ggmjxjbhkxvb/Q3:rRp8kDu72oLmxjgy
TLSH
T12C583322F29254B9D59642B0C5A763772938F9140731A7EB26906F385E32ED03E3FF58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery execution installer persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3524 created 3384	3524	elevation_service.exe	57

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2728	attrib.exe
5452	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Control Panel\International\Geo\Nation	installer.exe

Executes dropped EXE 9 IoCs

pid	Process
4596	WPS_Office_x64.tmp
6040	Larkpurity2027.exe
5308	installer.exe
4444	Larkpurity2027.exe
3516	Larkpurity2027.exe
1060	Larkpurity2027.exe
5140	Larkpurity2027.exe
5920	Larkpurity2027.exe
1600	Larkpurity2027.exe

Loads dropped DLL 7 IoCs

pid	Process
6040	Larkpurity2027.exe
4444	Larkpurity2027.exe
3516	Larkpurity2027.exe
1060	Larkpurity2027.exe
5140	Larkpurity2027.exe
5920	Larkpurity2027.exe
1600	Larkpurity2027.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5564	icacls.exe
5640	icacls.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:\	waitfor.exe
	\??\F:\	installer.exe
File opened (read-only)	\??\F:\	waitfor.exe
	\??\E:\	waitfor.exe
	\??\F:\	waitfor.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	installer.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4112	cmd.exe
4196	cmd.exe
2020	cmd.exe
5116	cmd.exe
5188	cmd.exe
4676	cmd.exe
2080	cmd.exe
4636	cmd.exe
5868	cmd.exe
4748	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPS_Office_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPS_Office_x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5964-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral2/memory/5964-50-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

GoLang User-Agent 10 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	662	Go-http-client/1.1
HTTP User-Agent header	755	Go-http-client/1.1
HTTP User-Agent header	1013	Go-http-client/1.1
HTTP User-Agent header	1271	Go-http-client/1.1
HTTP User-Agent header	78	Go-http-client/1.1
HTTP User-Agent header	394	Go-http-client/1.1
HTTP User-Agent header	523	Go-http-client/1.1
HTTP User-Agent header	884	Go-http-client/1.1
HTTP User-Agent header	1142	Go-http-client/1.1
HTTP User-Agent header	261	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5028	taskkill.exe
4136	taskkill.exe
4468	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe

Modifies system certificate store 2 TTPs 36 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\SystemCertificates\Homegroup Machine Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\Homegroup Machine Certificates\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\SystemCertificates\FlightRoot	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\SystemCertificates\TestSignRoot	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\SystemCertificates\TrustedDevices	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	installer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4596	WPS_Office_x64.tmp
4596	WPS_Office_x64.tmp
5308	installer.exe
5308	installer.exe
6040	Larkpurity2027.exe
6040	Larkpurity2027.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
1412	waitfor.exe
1412	waitfor.exe
1412	waitfor.exe
1412	waitfor.exe
3524	elevation_service.exe
3524	elevation_service.exe
4444	Larkpurity2027.exe
4444	Larkpurity2027.exe
3516	Larkpurity2027.exe
3516	Larkpurity2027.exe
1060	Larkpurity2027.exe
1060	Larkpurity2027.exe
1412	waitfor.exe
1412	waitfor.exe
5140	Larkpurity2027.exe
5140	Larkpurity2027.exe
5920	Larkpurity2027.exe
5920	Larkpurity2027.exe
1412	waitfor.exe
1412	waitfor.exe
1412	waitfor.exe
1412	waitfor.exe
1600	Larkpurity2027.exe
1600	Larkpurity2027.exe
1412	waitfor.exe
1412	waitfor.exe
1412	waitfor.exe
1412	waitfor.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1412	waitfor.exe

Suspicious behavior: MapViewOfSection 1 TTPs 10 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
6040	Larkpurity2027.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
4444	Larkpurity2027.exe
3516	Larkpurity2027.exe
1060	Larkpurity2027.exe
5140	Larkpurity2027.exe
5920	Larkpurity2027.exe
1600	Larkpurity2027.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	4136	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	6040	Larkpurity2027.exe
Token: SeShutdownPrivilege	3524	elevation_service.exe
Token: SeShutdownPrivilege	1412	waitfor.exe
Token: SeDebugPrivilege	1412	waitfor.exe
Token: SeDebugPrivilege	1412	waitfor.exe
Token: SeBackupPrivilege	5836	vssvc.exe
Token: SeRestorePrivilege	5836	vssvc.exe
Token: SeAuditPrivilege	5836	vssvc.exe
Token: SeDebugPrivilege	4444	Larkpurity2027.exe
Token: SeDebugPrivilege	3516	Larkpurity2027.exe
Token: SeDebugPrivilege	1060	Larkpurity2027.exe
Token: SeDebugPrivilege	5140	Larkpurity2027.exe
Token: SeDebugPrivilege	5920	Larkpurity2027.exe
Token: SeDebugPrivilege	1600	Larkpurity2027.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4596	WPS_Office_x64.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	waitfor.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5964 wrote to memory of 4596	5964	WPS_Office_x64.exe	81
PID 4596 wrote to memory of 5028	4596	WPS_Office_x64.tmp	82
PID 4596 wrote to memory of 4136	4596	WPS_Office_x64.tmp	86
PID 4596 wrote to memory of 4468	4596	WPS_Office_x64.tmp	90
PID 4596 wrote to memory of 6040	4596	WPS_Office_x64.tmp	94
PID 4596 wrote to memory of 5308	4596	WPS_Office_x64.tmp	95
PID 3524 wrote to memory of 5116	3524	elevation_service.exe	102
PID 5116 wrote to memory of 1412	5116	cmd.exe	104
PID 3524 wrote to memory of 5188	3524	elevation_service.exe	105
PID 5188 wrote to memory of 5564	5188	cmd.exe	107
PID 3524 wrote to memory of 4676	3524	elevation_service.exe	108
PID 4676 wrote to memory of 5640	4676	cmd.exe	110
PID 3524 wrote to memory of 5452	3524	elevation_service.exe	111
PID 1412 wrote to memory of 6052	1412	waitfor.exe	112
PID 3524 wrote to memory of 2728	3524	elevation_service.exe	114
PID 3524 wrote to memory of 456	3524	elevation_service.exe	116
PID 1412 wrote to memory of 4108	1412	waitfor.exe	118
PID 1412 wrote to memory of 5868	1412	waitfor.exe	122
PID 5868 wrote to memory of 4000	5868	cmd.exe	123
PID 4748 wrote to memory of 4444	4748	cmd.exe	127
PID 2080 wrote to memory of 3516	2080	cmd.exe	131
PID 4112 wrote to memory of 1060	4112	cmd.exe	137
PID 4636 wrote to memory of 5140	4636	cmd.exe	143
PID 4196 wrote to memory of 5920	4196	cmd.exe	155
PID 2020 wrote to memory of 1600	2020	cmd.exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2728	attrib.exe
5452	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\WPS_Office_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\WPS_Office_x64.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Users\Admin\AppData\Local\Temp\is-RP8S2.tmp\WPS_Office_x64.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-RP8S2.tmp\WPS_Office_x64.tmp" /SL5="$302A4,131909722,119296,C:\Users\Admin\AppData\Local\Temp\WPS_Office_x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Larkpurity2027.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5028
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Larkpurity2027.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4136
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Larkpurity2027.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4468
  - - C:\Drivers\SkimmingPutt\Larkpurity2027.exe
      "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:6040
  - - C:\Drivers\Addscolonist7038\installer.exe
      "C:\Drivers\Addscolonist7038\installer.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Enumerates connected drives
      Writes to the Master Boot Record (MBR)
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:5308
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:6052
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:4108
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5868
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:5564
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:5640
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5452
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2728
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MxzgbpyvHQimFGEcyKUoybwh /tr "cmd /c cd /d \"C:\Drivers\SkimmingPutt\" && start \"\" \"C:\Drivers\SkimmingPutt\Larkpurity2027.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:456

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:3884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4444

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3516

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:4120

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1060

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:1504

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:5140

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:3804

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:3420

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:3104

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:3200

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:5920

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:2176

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:3608

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:5592

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:1272

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:1324

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:1036

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1600

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:5528

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:5272

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:2184

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:4508

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:5700

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:5168

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:5312

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:3568

C:\Windows\system32\schtasks.exe
schtasks /query /tn MxzgbpyvHQimFGEcyKUoybwh
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Process Injection

T1055

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

element.mp4

Path C:\Drivers\Addscolonist7038\element.mp4
Size 33.5MB
SHA256 8856498cc64dfe296720288009cca8e9aba46414eb783514a80a8509ae4aa1b0
MD5 92fb1ed96fe2d7c5b29820737411709c
SHA1 9102a74bcfd188b60a4aa307b8be91d7fad01084
SHA512 d0ea25f48b8e70a5982e1c73b676ccb7127780344c6e0fd3621c31ac6ec201935d034e9ea04e32b369b0ffefee2edcecbde799307ed678a3edfdf4bd7863d2d9
SSDEEP 786432:KKzn9eNLh5n2Ao5/WP7FTyC8Ir7rZjyiqi8RsLGZGK4qCH:KuE1R2hWP7ZyCFVjyicsLy743H
TLSH
T11B77336D9376E085E36523F29FC431EE573DBBE80714B3A81AB2231BD03DA9190AD15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Drivers\Addscolonist7038\installer.exe
Size 5.5MB
SHA256 4932670ff54b6efef2ddef4835295646d3c5c66e69d944fce456d9c32a26f66b
MD5 5a2bdf7321c1c4cd4306837fc40c2e5d
SHA1 f4c101eaf525f116a6d6d0388a6b2cc2dba58142
SHA512 5a3ec1bc0a2b0688a956d12bc9549ea2f7fe6ff40366bc627dc02a56b0147923a46cd47708ce6c8a544a9e90d705586d31a23356b5e6be946ba1a8cb7cffadaa
SSDEEP 98304:kWJLSU6ZVUdnkurXJ1m2CJQvGPeuTxp6vTV1IWdsBO4+jQ/1pF:fmU6ZVwPrnYJTxpadsZ+o1pF
TLSH
T10346C011FB8681F1E4D201B0157BBBBA587DAA285B2588D7F7D02D2584302D37A3BF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-8R6A8.tmp

Path C:\Drivers\Addscolonist7038\is-8R6A8.tmp
Size 32.6MB
SHA256 b3445120834e759d39ea857029b64b1f5fac0ab2ee1add27ac43044974f6af76
MD5 df7d7ebd3af9d6035b977f9eab9d2e47
SHA1 6c9c3468cd2db2fa132699dba198bdcce0ce2c40
SHA512 1143f8cb7dbc346c96d7787893a9a706d5a6519f55c225458be570b63f7d3b6fe93db03691c1bc8fd7eb59e5985304f7cf83390c32e9900561ee8c3cf85d5aaf
SSDEEP 786432:tgdSrgRsKwRzjjhdWVS4nog2rao3se3EARacok+vczJ1GA:tgdmghwxjbrYkrT3UAkk+vW7T
TLSH
T1FD77337C42F9D444D37593F2FA86037F423C67D6094872608D6A6387D879E80ABFA85E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kopiya.mp3

Path C:\Drivers\Addscolonist7038\kopiya.mp3
Size 2.2MB
SHA256 411a33aa5fa7e6a3f111fd83428b7bab86901249fcc2cd772d97558368c223f6
MD5 ffd8d58ec282a409772a4adc06b1e3b9
SHA1 4f7373d980bcda6cd0dc8d3d3971594a8bd52d96
SHA512 7685581f7fb7c23560775bed3c3036e662b284faf90255e78f36f776c1dff6f3232ef8335d3728f7e8a2fbf12d7b093ebdb95f457e953e98be4df070ebb72ab2
SSDEEP 49152:Y6vVDboaaqFCQq8bEmDoLQlet8PHg7/ZXxi5VGuUvJ:DvVDbAqFuCEmJQOHgXi5Py
TLSH
T1EAB5335AF6A89106ECFC7B7A57F70BD8CE1A4B260E8473128D15102390B5790E5EFB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primer.png

Path C:\Drivers\Addscolonist7038\primer.png
Size 15.4MB
SHA256 8860fbad4d22e158ec6b4d3ac92b7f475f2f36ac2d5ab5038dd8552e179bc7f2
MD5 3eb98348d7b7bd5640ca6ac933ede3aa
SHA1 af68224f8bdb05c259c367d69ecd037348af2f8d
SHA512 4bc1be734cc5aecf6915d794606aee66682f39151eed326a17342d32135f41764ac49625a119de2451e5dfa592a4807a1e384f2a535f12a598c3de8067151253
SSDEEP 393216:3siqwShpdGhfqsntp/g+QOFGaAXIJYaukujXSdQglxQdg:3s30hB3nFuIJYaukVd/lx8g
TLSH
T1CAF633F806AF4DE57202B0A9702773FC17D5FBF00A06B9A2FB65409B125E8EC1667794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registraciya.png

Path C:\Drivers\Addscolonist7038\registraciya.png
Size 14.2MB
SHA256 50a5ea14ce344b4081abd4e5d01cda3c5e99c3ee11398ef1bf0b65f4c32d82cf
MD5 cf9ba4848d04056cbe2ff4198edde496
SHA1 e2a87694ff936c7a4a9552b633c9a9500d7e1cdb
SHA512 8963fd757b41e4ef22893a95c921783b69eb7114759a878b4819158411347fe6bc8f888624ad119bcdb62e6cc5a76fcb752344ec78fdf0e96c495828f0c13e39
SSDEEP 393216:OcxjBJUrSHGfN9mOpk6kGvrCYRKTYP47l0gQ8zF:OcxjzU2aN9GGvrqlQ0
TLSH
T120E633472FD71371E16BEA2ADF7F63807B8DC36A1A82E5A19C8C1207559A22D5D3C31C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stil.mp3

Path C:\Drivers\Addscolonist7038\stil.mp3
Size 2.4MB
SHA256 02e135568e0e142448eecd47aaad3ea3a1768b73f958f415eced3a05804b20c0
MD5 17828f7c343a444f043c6ad03ba78877
SHA1 44882ba2073ac29bd9a34ad29e8a3ad2b6c1b299
SHA512 372b533ad436b9ef9094c74c970370d8e321667a2dce908a2e3c39aa05367ad3b307d37687d3ffc3550009d20f96d714f3e9590fd08b2c3e21944efccade7fde
SSDEEP 49152:bAcTjd20i/Twfv9Zip9LgjMDpZU/EO9tBK7zS7YZztHI/1/170L1+SU1TLlr:ccTjdmEfO3eM3UsPNZzto/1lSU1TL
TLSH
T173C533398834101FF4E186F3A149396FC4A6D79D5D28B694E5B0341BC542F2BEBE5D83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Larkpurity2027.exe

Path C:\Drivers\SkimmingPutt\Larkpurity2027.exe
Size 6.3MB
SHA256 4cf7281ac1036468edceccbe3535a35dc528c8954b9466df1722b5a7205b59f9
MD5 7c0969dfc870eb1a6033c9452afdf792
SHA1 43ea34ce3a77cc4cc0da9f651ccb2f4e59e1cc43
SHA512 4e57a58d96e45d9ac8ccd2b5f761b0aac3e055b1cc80ca45a32edad4d3ca14d6ee353b225cded8522a629c4cbaa77b4382ef00709933dfc64bf861967a6f7fff
SSDEEP 98304:Z8Bn5Ucs9D50zg2UlAvaP8UGi9Q+0wZkn4mQk93PSfggTlzQM7nP6nXqJhE6GM4Y:b9T8X54s9jmXov13uFnCPwHMStuNzm
TLSH
T151666C26F25268ADC99A9270C69753333635F8501332EB3F2654EB342F27ED02E5EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuakePreceding5900.F3

Path C:\Drivers\SkimmingPutt\QuakePreceding5900.F3
Size 4.4MB
SHA256 d9cef7ddeb83d025793b2b802ed4eed7c4a4d8d28bbd9d8f79ebad2383b226bf
MD5 c510f3db221e59bf11d077b8e69184d5
SHA1 1a9dc635e847300810630595a867551b72d94d10
SHA512 f492faea0f1e4e9e1fee20276cf119ad561ba3bc4971fd26eab53149321d70a32c3bb92fea01d9b5ae97384aeff862853393fcee8e8e3495d09af227490cf6c6
SSDEEP 49152:W0yti4T67dMa1yBtIi+/QlkOanjrTr4eaYGWnOc4/hSvWby8m:W0ytB6Xi+/QmOqj3rIYHnOcmHe
TLSH
T12126BF313241A914E16F431AD1B85E1CD67D6A48A3BA5F5C8F13BFE23E95302FA7819C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 179KB
SHA256 08b0d5f47d3e792931c5c5855b0bd03e1883b1d65db491c2d608aa61a2383ff8
MD5 07e1683a79110cee0158c96be0e0d1a8
SHA1 c5c57206e4b0becdb7c022fa4a5b0dff823f493e
SHA512 af350eb9ef9f5445b040baec41581e23c2f0a062409b899de6fc0216f9ec38480ed7db974230ef569318b6195d9240bad1e3fa4a51ab9037a0559a7c4fb73f0e
SSDEEP 3072:TJ7QOfyplx4p9T+0JpIs0ji23+xiM9YtSpVGjqVEJEv3PN+Cy1UAmO0jC8TByl:Tjfynx4p5CnD89oUVOWEJg/vAz0mqkl
TLSH
T1F2041267E0EF72DAD64A89C42CB9F7DDF2E845ECFB4CB03535A106908E15582D2DC0A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 226KB
SHA256 51b8b86af94840281de0b2d8f987a6ab3f5b0d58077b48ad473621a4bc04f5cc
MD5 acae121694b9f49830aebd9fc482b933
SHA1 779906640f394b3b602c776e9efab60621b47456
SHA512 0b80280033a51b013a787e0987845199a791f5a4fbf0bc417efc4ef6e1432e154869101ee8bd31777b89dd20e37b9c63f6d06f1a7a0f0607cb35bb131525fc2b
SSDEEP 6144:Tjfynx4p5CnD89oUVOWEJg/vAz0mqkAbcFY/:g2yY7VBEJ5nFY/
TLSH
T1DE34236BA4EB72DE565948C52CB5E39DF2EC01ECFB4CA036385506468E1DD42F2DC0AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 17KB
SHA256 73c6f939122d696511385334179e0b3f4e40e0c2ad6e003a971178a7c44aa027
MD5 23ac72281ef2289ff8dd8fd906c95bcc
SHA1 2aad98f12b3f8428dc699fed713b765bdad0a4a5
SHA512 3a27b24b29ba2ef97d109c388a05d33945376aec2e078531672f3a65f42973262b50112520da296c9e62f47ec61941211842a817ce7e4e04c191fe2342e5e53b
SSDEEP 384:aLWFE1RvQs8T+gDYo9xeJ2l09iMbPSG6QsZerrMKyR43iDslRvkh:UZJ/8pZ9xy2lnKPSnQJrrMJjsTsh
TLSH
T1E782D0E7851730C4802A0CC1C6A6E7DBF2E06BF8F75152F14B900EAC8C5F381DAD5905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 34KB
SHA256 dc746a9c50babaf13b4873dda30cb794cb593b8a67d6111c3b5f5ad89a069bb0
MD5 b7602f52c8cce95a8020642042f8a13b
SHA1 da4e0fdaf220b67d5d03c688302b1b4959a437c5
SHA512 6d8107aef797d03f0d8106dd995560cb083b4fcc8e9993e1b5b336bed2d3e335bc9e6a1ebb59edec4614ee83c9fb7ba012a4a668bdb87ca840e1c15fcf28ce8e
SSDEEP 768:UZJ/8pZ9xy2lnKPSnQJrrMJjsTsjVtAjNowEIKWScQsgV09PBAH:Usfws3Aj2p3cFoCPk
TLSH
T15EF2F297105B34DC503788C298E6E3DBF6F17BEDF7A092B14AE20ECCAC2668251E5515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 f024b7aed0e65eb40909cb7efa81f69ae99bf2c1150b73a00b4d856675e1e79d
MD5 d45968e11b8f2ad2d394bbec12cc8730
SHA1 90fdd2e27c5d4db51a2e9cb7758e3bdf52d260e9
SHA512 1a2b4db4d583a841beab566228d2c99196375590dc04fa287be666258340fdbb5ebdc8df072a26f6ba71d7d2cbf9f0d1c1ba4dd1409720e4c40e28d400e1f732
SSDEEP 768:UZJ/8pZ9xy2lnKPSnQJrrMJjsTsjVtAjNowEIKWScQsgV09PBAdYSG1n542Sea:Usfws3Aj2p3cFoCPqG1h9a
TLSH
T16C13F193008B38D9A02B4DC68CA6E3DFF6F56AEDF760D2B54AD34788AC16681A1E5504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 50KB
SHA256 21c613d9a736e4b2ff6188b38dfec588dde0371e49d6ed6118b3b1acbc0d26b4
MD5 710211e40b32ef7255441f54b5fa665f
SHA1 eacff9ac8d1419c053ccd8aad08d430168b6ac48
SHA512 78b9bcdd4f87b4498dffeb8ce98ac8d28a3196601e77059a05ff00b5db12f1e9074551781ef89fe7ab7e646a5bbf1351f40e47a1e663295bd83460e08e07f6a5
SSDEEP 768:UZJ/8pZ9xy2lnKPSnQJrrMJjsTsjVtAjNowEIKWScQsgV09PBAdYSG1n542Se4lR:Usfws3Aj2p3cFoCPqG1h9cfG70+PR8n
TLSH
T10D330157109B38DCA02E4DD5C8A0E3EFF7F16AE8FB54D7B045D28B45AC1BA80A1D9604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 2KB
SHA256 6c24905d73ced0a8e585dc739407e46c927a79c3ba9ce5f223155ca9da095f51
MD5 0c7f2621eb464c747d06690bc78b2c54
SHA1 7d47efaaedeee94c22daec2dac4701c6902968ad
SHA512 28e8b1aaacc9f79cf2c64dcbd8ba23e5877f7bba17a81d010f317cc8dc7db129c68ad5633179064d7dd23c0b92f172dd0783bc61df3e520445382d3a0cdb7536
TLSH
T1B0515EEB840BB889654949EC186755C1FB52BFD9FB04A1EC0B030E494EFA9630ABAC05
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 3KB
SHA256 dc722445212469f537220b1e3463b7de60a679ae02b72dcffaf39683c64b6bcf
MD5 90490dc0ef0d6de27c46f1d88e158352
SHA1 3972826b2ece74406c2decf21e297990d7edff3a
SHA512 bd08e9aaca7a45dd06a97606c7f1ce19183a7b096dc8fccef72a973f4a2b7156ad118f13dae8e1a07d4a405a8b8070c29aa56f3140e3c5db4c6443ad94d1b618
TLSH
T1A9716D97458678C459084DBC6DA798C5BBA2BFF8F704A1F80B130E4D4EEA45216F6D12
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 85KB
SHA256 20cae1cf809e3cbd28af12b8642605add7e1c0f22d7e8f6b44772f0aacfd5a31
MD5 0e3bc4fe91d94515f1bd61aeb864e9fa
SHA1 73213263264a86c2089156bc49808b717645905f
SHA512 398075f8de6d75dd5732221f601764fce7759ed48fa15ed726d5bed2b1dd0bc13f46f6960b3ca17734b3cee62b77c334c51e684a1452d2963877783b2d1cf330
SSDEEP 1536:Usfws3Aj2p3cFoCPqG1h9cfG70+PR8Gx44dC9T6D0S0pIsa:TJ7QOfyplx4p9T+0JpIsa
TLSH
T1D783125360CB31DD541F4AC66CB2E3ADF6E44AF8FB58A6B231E50B509E44AC2F0D915C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 5KB
SHA256 c00911c4bd0f9382055c7fa456ca5a4e14359ee4f4c282b2d14aa92289ce198b
MD5 e0c0da779686d5a5ce6f26c4f6944777
SHA1 fb1dc589d6a6e0adefabccdbaf4f142d981edc69
SHA512 96bebb0116356cddbda2623d3b08e8ddbdffb9ab5f1caf2a58dd7d8175d21dbcfffaffb5bb03866368707f1b153becdbe60057cb259dbfa661f1b6889835ae2a
SSDEEP 96:QCGroWhLcGOt+4RxE1lLk+Qmrwt/aKGhWh42+Ve0FIclOWv8Om8cS2rOcuAW:QLoWhLTOtFRxE1RvQkBh8T+g0FIclOWl
TLSH
T10AB19E2B48163841544509F9986BA8C7FBE06EF8B70892F90F238E4D4EC660111E2D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 112KB
SHA256 2d6a548d279c276b9567ae0bfff570efb286ff63beef95dfdaf7381cf55aacdb
MD5 cede041440067bf973769e00f7422c7f
SHA1 9d89ea21ac9032ecda9e558d760823c89c0fe2cd
SHA512 dffddd724c61f356bc758b9138702c9e6d99ceda843e82f4a8f9fb6a103f82cc3df8c0c79d62dafa094d399f2d3b7ef408961b236fde4258cc5f93b3d03d7f47
SSDEEP 3072:TJ7QOfyplx4p9T+0JpIs0ji23+xiM9YtSpVGj4:Tjfynx4p5CnD89oUVO4
TLSH
T16FB3129350DB31CD594F48C76C7AE39EF6F846F8FA14A0B125E10AA05E49AC2F1EC19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 141KB
SHA256 a42766ef4a5d87a8b21fa3e643b98e9fe8564984b30497e6b01e2ce91c45a2a7
MD5 a2713f62830a8df92227fcd02b5ecb01
SHA1 baa5a015b4181951009122e5c3091339e42cd02e
SHA512 b76f1421b79ecd7f0c0d8c879497d7c2441535070a8921c46b4087a57c8652a45d41db80dd8350a4bd196cb716ffd727f8f1f55d86217186e293eba55c87cd16
SSDEEP 3072:TJ7QOfyplx4p9T+0JpIs0ji23+xiM9YtSpVGjqVEJEv3PN+Cy1UAmZ:Tjfynx4p5CnD89oUVOWEJg/vAu
TLSH
T1A4E312A3E0EF31C9AA99C9C56C69F39DF2E846ECFA0C60B225A549548F155C3F1DC09C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 226KB
SHA256 120573c6d5f17ce7ed3b7c8d44ac0ce68fa89378da126a5788061b67c954434d
MD5 576a3ebdf66b5a44ef4fdc5e9fdecafb
SHA1 b8572e2cd996b1e8d61ad94708785287b782cf66
SHA512 dea4e7792ce0682966f69720f6d7a9ab826cd718aba4b2b311bd2a6550e2165f59e7ad13e6a485d8c0ff8b88de1492b9ec62085a3cddfbf284c417413297443f
SSDEEP 6144:Tjfynx4p5CnD89oUVOWEJg/vAz0mqkAbcFYh:g2yY7VBEJ5nFYh
TLSH
T1E434236BA4EB72EE565948C12CB5E39DF2EC01ECFF4CA036385506468E1DD46E2DC1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 41KB
SHA256 f4f68646935f1a955faea947a98c70cd3ecbf9a937ebcec767f8a85a60cab304
MD5 0f098026a0e03057a7d9a494a95cdcc1
SHA1 3710ad20921bd8f7364d7c072addf5be630d41ef
SHA512 a7cb404b1e1bd5d250ab304821ebca1ddda9e8ca31c63b3ed102d58e6074e3a866ecf5620fd273a9494eae575ca8e482565595172efdcdcb0ab9e4fb2b581cd8
SSDEEP 768:UZJ/8pZ9xy2lnKPSnQJrrMJjsTsjVtAjNowEIKWScQsgV09PBAdYSG1n542SR:Usfws3Aj2p3cFoCPqG1hK
TLSH
T10813F1A3008F34DDA02B48868CA6E3DFF6E567E9F7A4D3B10AD34A84EC56681D1E5504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 60KB
SHA256 cc457c15cebb9a5a460186963de95423bab94e2ddd38de27378d2ecaef0a8200
MD5 c1a732fad9108552bf03d86b4f173925
SHA1 79bbe9b6218768494355241201a44f459c2c61b0
SHA512 ad75abb9f8e993cce90522f8fb50cb6b55e12dd8751b5a7c32ec2da2fa9b7e6950cf23a839a7ef127239a4d1e2243d120625ffde7c10c55884d5cda7972e9caa
SSDEEP 1536:Usfws3Aj2p3cFoCPqG1h9cfG70+PR8Gx44O:TJ7QOfyplx4t
TLSH
T12A53015320D639CC102E498689E2E3DBFAF15AFCFF50A6F111E64B50AC4A682F1D661D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BouquetZipping-8276.T4Is

Path C:\Drivers\easierviewed80\BouquetZipping-8276.T4Is
Size 10.3MB
SHA256 34260e1cf907112ceb2a280712cdf679470569bb3d95092818ecc456d708954d
MD5 5dd6a658e0f32a899cdbda6e087067ef
SHA1 80e44709959a5689fdc41ad079da1641a643eebf
SHA512 586c76710e21b7a534394b18e2f0e1e14b38eb76158c6970e944b4adbfbe2f38f143b3111e2dac5fe22bf4d1ad764dd51df27a63acdc80a37172c53cc3dca3ed
SSDEEP 196608:/UPV1KD3cYyU2OzElApy2E7gkmrhblALjWi6DoJTL2gETmzBOFSk1/SLgmY8XV/H:c98GUDYl6Lkm7ALit1mzBOFD1/sg1CND
TLSH
T1F4B633E35924E783E743DD169CE88F589B87F0684524B668D3BEA62C666F4C2FF05D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WPS_Office_x64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RP8S2.tmp\WPS_Office_x64.tmp
Size 1.1MB
SHA256 cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839
MD5 129b8e200a6e90e813080c9ce0474063
SHA1 b5352cdae50e5ddf3eb62f75f2e77042386b8841
SHA512 10949e7f0b6dd55e0a5d97e4531ef61427920cccc2136c0dd3607cdc79afa0d8a7178965a07039948da97f0200ead8fe5a54921620c943c7fc76dd5ef5a7c841
SSDEEP 24576:WEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsyb7xyx:bdmbjTKlD00R
TLSH
T17C453A22A3D68433D5732E758D6BC2945C367E202FA4D48A7EF89E0C4E79B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-1073-0x0000000001C30000-0x0000000001E5B000-memory.dmp

Download

memory/1412-383-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1412-406-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1412-400-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1412-399-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1412-401-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1412-459-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1412-360-0x0000017550690000-0x0000017551898000-memory.dmp

Download

memory/1412-482-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1412-483-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1412-488-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1412-497-0x00000175518A0000-0x0000017554B11000-memory.dmp

Download

memory/1600-1762-0x0000000001E80000-0x00000000020AB000-memory.dmp

Download

memory/3516-843-0x0000000001BF0000-0x0000000001E1B000-memory.dmp

Download

memory/3524-200-0x00000287A2E10000-0x00000287A2EF9000-memory.dmp

Download

memory/3524-210-0x00000287A2F00000-0x00000287A2FEB000-memory.dmp

Download

memory/3524-228-0x00000287A2F00000-0x00000287A2FEB000-memory.dmp

Download

memory/3524-550-0x00000287A2F00000-0x00000287A2FEB000-memory.dmp

Download

memory/3524-378-0x00000287A2F00000-0x00000287A2FEB000-memory.dmp

Download

memory/3524-307-0x00000287A2F00000-0x00000287A2FEB000-memory.dmp

Download

memory/3524-257-0x00000287A2F00000-0x00000287A2FEB000-memory.dmp

Download

memory/3524-611-0x00000287A2F00000-0x00000287A2FEB000-memory.dmp

Download

memory/4444-614-0x0000000001D50000-0x0000000001F7B000-memory.dmp

Download

memory/4596-47-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/4596-5-0x0000000002400000-0x0000000002401000-memory.dmp

Download

memory/5140-1303-0x0000000001F00000-0x000000000212B000-memory.dmp

Download

memory/5920-1532-0x0000000001F10000-0x000000000213B000-memory.dmp

Download

memory/5964-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/5964-50-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/6040-51-0x0000000001EC0000-0x00000000020EB000-memory.dmp

Download