Analysis

  • user interaction
    yes
  • max time kernel
    368s
  • max time network
    396s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 11:52

General

  • Target
    KLO.rar
  • Size 524.9MB
  • Sample261024-n1rh5styhv
  • SHA256 8a95aaeedc3a1d6fec72acaa8327bb102e3149c705b854a7ea2726becbdf89b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\KLO.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1408
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2152

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          KLO.ico

          • Path C:\Users\Admin\AppData\Local\Temp\KLO.ico
          • Size 422KB
          • SHA256 b35bab69b40f9ab858c3d7a1dcdfbf6615e456e79c3739dd76f23440201a54f5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          appico_large.png

          • Path C:\Users\Admin\AppData\Local\Temp\appico_large.png
          • Size 39KB
          • SHA256 0d0244d5e52e9104c33c21da604b78b95a1a500bfa28bf675fefd2a97188fdda
          • MD5 SHA1 SHA512 SSDEEP TLSH

          how-to-create-a-plugin.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\developer-guide\idapython\how-to-create-a-plugin.html
          • Size 32KB
          • SHA256 6f8265720413ae0600181261c9ecf05579b1229fe50a436deea9012c94a92dc2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          idapython-examples.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\developer-guide\idapython\idapython-examples.html
          • Size 199KB
          • SHA256 e95a6f1ad7f00c8354ac763526c34cffc6fdd7d87bc37495245293ffb6801284
          • MD5 SHA1 SHA512 SSDEEP TLSH

          idapython-getting-started.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\developer-guide\idapython\idapython-getting-started.html
          • Size 32KB
          • SHA256 9b082571fd1290738de7f55ff0a2c8ab3420ae22a712e479b028928f675b273f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          idapython-porting-guide-ida-9.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\developer-guide\idapython\idapython-porting-guide-ida-9.html
          • Size 144KB
          • SHA256 21dd7841f61e3ae9aac282ad0aa343d2e356a6be97897a945ef95f34b29d9bab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ttd-debugger-actions.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\debugger\local-debugging\assets\ttd-debugger-actions.png
          • Size 164KB
          • SHA256 c2590766ae9df0f0707f47214bc9417e413c5f9741828127b2ae79c9e81a43c1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dalvik_type_guessing_on.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\debugger\tutorials\debugger_dalvik\dalvik_type_guessing_on.png
          • Size 257KB
          • SHA256 81af1fd4c6b36fbf862eb099dc99f60bc7fc754487e249370979c9d330997d2f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          debugging_gdb_linux_vmware_11.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\debugger\tutorials\gdb_linux_vmware\assets\debugging_gdb_linux_vmware_11.jpg
          • Size 86KB
          • SHA256 e3ef4afc80a7bcc2370ab609ab05945f44c355a81dd6d6faec2b7e5395425d08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          80-86-architecture-watcom-runtime.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\disassembler\disassembly-gallery\80-86-architecture-watcom-runtime.html
          • Size 22KB
          • SHA256 a335a8db1d31fda8a5f1c0dfa213448274056dda88439684a114ee11ec1c553c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mips-processor-sony-psx.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\disassembler\disassembly-gallery\mips-processor-sony-psx.html
          • Size 22KB
          • SHA256 8ab124891fc5d45026a7273692ef6d49662077537a255ce397fe00a1e08df4b8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          site_details.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\hv_user_manual\site_details.png
          • Size 15KB
          • SHA256 cac3e0e27f43abf3e59760b32ad05fbaa6b231886b57439075456765f2384991
          • MD5 SHA1 SHA512 SSDEEP TLSH

          scan_and_commit_options.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\actions\scan_and_commit_options.png
          • Size 11KB
          • SHA256 4a7b7254109b6fece43297b56077922687f00e348ee3c73d6298889b9643162d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          apply_button.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\apply_button.png
          • Size 3KB
          • SHA256 4d758969a45120f7ae902e8973541ba9ca85d4a2ff6132234922256ce5abc481
          • MD5 SHA1 SHA512 TLSH

          ida_in_diff_mode.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\ida_in_diff_mode.png
          • Size 53KB
          • SHA256 dc48cc6e16df8b38b91fa43dcc9317b8e9b40e928307fe31733d0d638e797558
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ida_in_diff_mode_diff_progress.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\ida_in_diff_mode_diff_progress.png
          • Size 5KB
          • SHA256 50e3665f558907c7745b8cc74455c5eb834c535ef82f0ffff79b927a36f25994
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ida_in_diff_mode_left_panel.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\ida_in_diff_mode_left_panel.png
          • Size 19KB
          • SHA256 163be47ab6b3e13717c062071d16632e1e197885d9d55d3db3d7e74674879c90
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ida_in_diff_mode_panel_details.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\ida_in_diff_mode_panel_details.png
          • Size 6KB
          • SHA256 ef3519f2ce5c12a7d67e97767d510392c9ee9dc658d65385e561a83ce4324e01
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ida_in_diff_mode_right_panel.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\ida_in_diff_mode_right_panel.png
          • Size 21KB
          • SHA256 17160725b2121fd6d6c303037cd630bee4bf2e1a0ef5a87de3aed6c9af2569a3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ida_in_diff_mode_toolbar.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\ida_in_diff_mode_toolbar.png
          • Size 1KB
          • SHA256 1bef0ec26a0c170a12a954a1828be5c939b75c56f445428324a0cb639f111cef
          • MD5 SHA1 SHA512 TLSH

          ida_interactive_merge.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\ida_interactive_merge.png
          • Size 46KB
          • SHA256 69129c16175cc266d3e30b2cd9a379a3c0c56376c70d529dfb58dbaf1c52ba9c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          merge_progress_steps.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\merge_progress_steps.png
          • Size 5KB
          • SHA256 cc4ea7945f37170b444aed000ffeba1c5e323175d208648ffbe0cca44d98b7f2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          open_ida_for_diff.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\open_ida_for_diff.png
          • Size 27KB
          • SHA256 1fe1176269aecb7b5a6caa93a48036e11214d208a4b05fb1d105f94d4354fe64
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resolve_pp.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\resolve_pp.png
          • Size 20KB
          • SHA256 d8d0a3d67cb863a9fcfc88bd17848d2b3b07fcdd7632324272b0e348ad4fa55a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          worklists_pending_resolve.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_and_merging\worklists_pending_resolve.png
          • Size 6KB
          • SHA256 8e9b1eb3e9ac6d22522d1dc5302450668a5a6c57791718e9a4b15abec9b43479
          • MD5 SHA1 SHA512 SSDEEP TLSH

          functions_noret_visible.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_caveat\functions_noret_visible.png
          • Size 43KB
          • SHA256 43a16825d6f37450dc3b1c7c0f5482acf86f4cd7155309766bfef33fc1230eec
          • MD5 SHA1 SHA512 SSDEEP TLSH

          listings_noret_not_visible.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\diffing_caveat\listings_noret_not_visible.png
          • Size 55KB
          • SHA256 3bdb2f7242643e9bae75d7eb4358b227c5b02026eec96749cd32064b8f3acde4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_commit.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_commit.png
          • Size 10KB
          • SHA256 1632968385ac4eb1ed1c522c61cc528c85b1a6df3a0e8b9c975d117c1c44e0e6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_commit_context_menu.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_commit_context_menu.png
          • Size 29KB
          • SHA256 9e99b4d115a95210468880e48b848a4aed4c2a3623b1381098153a71461ad01a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_commits.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_commits.png
          • Size 12KB
          • SHA256 bbe72806b8a414806232e442cb173afea02a968f99609abf3d4196961d008105
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_commits_context_menu.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_commits_context_menu.png
          • Size 21KB
          • SHA256 fd61138c32b2f3053b6fff9eab46a8390b2565c81638744eafe0e8be6154ca08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_file_history.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_file_history.png
          • Size 16KB
          • SHA256 7c570609e0ad7b7577b7c4df9588bc23373a7882d34afe36fe8ad548ca9a1c8f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_file_history_context_menu.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_file_history_context_menu.png
          • Size 38KB
          • SHA256 8111b1e8084bca8158fd464702d48aed4b69fbdf590099fd499c92de2fcbc694
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_local_files.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_local_files.png
          • Size 13KB
          • SHA256 076b341c8b678628b739633d1b38cc17ae84a8886d28c2d79d0fbf3173e7d395
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_local_files_context_menu.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_local_files_context_menu.png
          • Size 57KB
          • SHA256 90f5d6b9734b10aba481e998fa8fd8d1bb5b0c5f263a3a3f535114ef3b64c576
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_log.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_log.png
          • Size 2KB
          • SHA256 bb9a1a0f64ba85794b5354695c7095f0e2d1ae72a6d58c0779cda72c6acc07a7
          • MD5 SHA1 SHA512 TLSH

          widget_log_context_menu.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_log_context_menu.png
          • Size 10KB
          • SHA256 2f99cdfe6903427b37f0a4519fd6b14d32a9f2b68d3ec7ea2e7d19cfbbc8dcc9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_sites.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_sites.png
          • Size 4KB
          • SHA256 ca0cf96b114fdaba66a1647f0632d41c2a24c436e630bec86d548fee835fe7a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_sites_context_menu.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_sites_context_menu.png
          • Size 20KB
          • SHA256 e1710c9c39b8a8dfa17591df8c2667a74f128347bcf29cbf5d71ce2c75336463
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_users.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_users.png
          • Size 20KB
          • SHA256 9b18f3c82728c1bc99b44c41139f22e36edc40220cd880187c272cbcb71cc831
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_users_context_menu.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_users_context_menu.png
          • Size 23KB
          • SHA256 25617ddb124cc007b69981f1ca7ec881056eba5875da1aafb6080332a35b6fb0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_vault_files.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_vault_files.png
          • Size 28KB
          • SHA256 c2846918014f511eff9a236d27b440c8bf45fa8150647c63d9f2d019e3a8fc2c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_vault_files_context_menu.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_vault_files_context_menu.png
          • Size 30KB
          • SHA256 c594f6bc2678e9b91d021eaf3f46ed5860c55ce243a438e36cbd8c2303cee631
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_worklists.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_worklists.png
          • Size 15KB
          • SHA256 37f9dcb3f94aee62515118426842855051bd1a0e6f0eaf1f459b2bdaa4ffcd8a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          widget_worklists_context_menu.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\teams\images\merge\widgets_and_menus\widget_worklists_context_menu.png
          • Size 27KB
          • SHA256 69f99ff8db6bedc8cbc8cdea0243c415c61477a96fca3176196253a75808a17e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          import-enum.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\types\assets\import-enum.png
          • Size 110KB
          • SHA256 fa2d9cbb2f62e48f626a14056c7d2eabd5bd7707346eac6f7ce13f7ddc853033
          • MD5 SHA1 SHA512 SSDEEP TLSH

          add-struct.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\assets\add-struct.png
          • Size 89KB
          • SHA256 27cc8c4752eb173580a2811cc507ec5f877b8c0e1fe0e3e724e636a548d568d9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ida-view-modes.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\assets\ida-view-modes.png
          • Size 866KB
          • SHA256 77088e5fab66bd1275ec2c534ed3559e6c73d9931982cf28a2a2bbf25ce1b441
          • MD5 SHA1 SHA512 SSDEEP TLSH

          patched-bytes.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\edit\assets\patched-bytes.png
          • Size 144KB
          • SHA256 427f23c62f1fc0723776cf94ed18de5c1f9d82c5b43301bfe04dca508bbe8431
          • MD5 SHA1 SHA512 SSDEEP TLSH

          license-manager.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\help\assets\license-manager.png
          • Size 33KB
          • SHA256 7b3a3d445f6c0188abe18cdacccf66556faadc7a3bd1957f11215cfe95129073
          • MD5 SHA1 SHA512 SSDEEP TLSH

          functions-actions.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\jump\functions-actions.html
          • Size 30KB
          • SHA256 89932010b8c0bf565deae62703ce7077eea5f0cd9f0c8871d7f936c7146de82e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hex-view-actions.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\jump\hex-view-actions.html
          • Size 30KB
          • SHA256 0f1beebf688308e57bdf510f32f9298d8913a8c6ab31a47e828ad4d2428dcc03
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ida-view-actions.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\jump\ida-view-actions.html
          • Size 30KB
          • SHA256 c2a5a5c36bff111d0c99be741bab76a8f2fceea74ee414c4a106de579a9861c9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          local-types-actions.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\jump\local-types-actions.html
          • Size 23KB
          • SHA256 05db41a28760b4d9940058685446d5a45eccd18fb89c66ae6bda8975aab54e3e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pseudocode-actions.html

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\jump\pseudocode-actions.html
          • Size 30KB
          • SHA256 bd6b22bd6fccbcf717d372738c89f583755a244cbf812fd385d898c7de5a5923
          • MD5 SHA1 SHA512 SSDEEP TLSH

          options-graph.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\options\assets\options-graph.png
          • Size 372KB
          • SHA256 902a105f15d5b8607c62faf6ae112dcd2eceb396ae2e7eaf3db85b7c13815ebf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot-manager.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\view\assets\snapshot-manager.png
          • Size 16KB
          • SHA256 e16d1cd909ec0c405287d907ca34e4d48118ba44f5454dde4d2bac659a05b1a9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          command-line.png

          • Path C:\Users\Admin\AppData\Local\Temp\docs\user-guide\user-interface\menu-bar\windows\assets\command-line.png
          • Size 69KB
          • SHA256 d96bacfa1b1bac3aca464b5a40b0c725256ec4b5c71ed3be4e7e9c27f6412ce7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          __init__.py

          • Path C:\Users\Admin\AppData\Local\Temp\plugins\ida_feeds\feeds\core\__init__.py
          • Size 76B
          • SHA256 30bcdba14ac6560ac4ac00577a1aa03ea0976e7e9647e81995ce8d86c2cc50d3
          • MD5 SHA1 SHA512 TLSH