dc3d29fa40a1fc0032e60de52e9de9584291e87d68c894c6dec6524b0f22938b

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
klutz.exe
Size 5.9MB
Sample261029-wftf1abh33
SHA256 dc3d29fa40a1fc0032e60de52e9de9584291e87d68c894c6dec6524b0f22938b
MD5 accc6230b40a1ffa61e36df89280a611
SHA1 153b432224b74f643b39faef788af8e77217a25f
SHA512 242c9a3fc57a338b3ce7258783f36695cf4d91d2303b5e338bf7bff428560c6b7b49b019b2534ae248d71f36ec32bba352f0f8a7ad8b2d7428abe030dbfe9c12
SSDEEP 49152:52Qq1gmRHUnkLvVshqYvxvtgcVegDFTAa0yrudrHlkB6CutLBoMzmmH1b/tQLKis:4n2DuGu9HL7V2GidpR34tYrouXaIo1
TLSH
T129565D03F66181E8C06EC579831AA633F732B89D093476AF57E45B312E66F60AF1D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1788	netsh.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	klutz.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 48 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5520	tasklist.exe
4340	tasklist.exe
1136	tasklist.exe
4792	tasklist.exe
1012	tasklist.exe
4896	tasklist.exe
5240	tasklist.exe
1728	tasklist.exe
3224	tasklist.exe
5444	tasklist.exe
4196	tasklist.exe
4948	tasklist.exe
5372	tasklist.exe
5408	tasklist.exe
3188	tasklist.exe
5276	tasklist.exe
1492	tasklist.exe
3244	tasklist.exe
2472	tasklist.exe
5768	tasklist.exe
5888	tasklist.exe
4744	tasklist.exe
5952	tasklist.exe
5720	tasklist.exe
5848	tasklist.exe
4300	tasklist.exe
1164	tasklist.exe
2712	tasklist.exe
1276	tasklist.exe
2788	tasklist.exe
3768	tasklist.exe
4328	tasklist.exe
3464	tasklist.exe
1972	tasklist.exe
1956	tasklist.exe
4688	tasklist.exe
2788	tasklist.exe
5444	tasklist.exe
1648	tasklist.exe
1492	tasklist.exe
676	tasklist.exe
2376	tasklist.exe
3856	tasklist.exe
912	tasklist.exe
3808	tasklist.exe
2184	tasklist.exe
4272	tasklist.exe
5288	tasklist.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_657800511\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_643981653\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_643981653\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1653215314\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1653215314\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_226158954\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_226158954\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_226158954\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_657800511\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_657800511\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_643981653\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_643981653\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_643981653\manifest.json	msedgewebview2.exe

Launches sc.exe 37 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
940	sc.exe
1252	sc.exe
1884	sc.exe
3996	sc.exe
4152	sc.exe
1136	sc.exe
5232	sc.exe
4000	sc.exe
5252	sc.exe
1864	sc.exe
800	sc.exe
3432	sc.exe
5052	sc.exe
1560	sc.exe
5284	sc.exe
2956	sc.exe
5408	sc.exe
1704	sc.exe
1864	sc.exe
4172	sc.exe
256	sc.exe
1392	sc.exe
2412	sc.exe
3220	sc.exe
5052	sc.exe
2136	sc.exe
5912	sc.exe
4624	sc.exe
4360	sc.exe
4956	sc.exe
4504	sc.exe
5228	sc.exe
3556	sc.exe
2848	sc.exe
1560	sc.exe
2788	sc.exe
2984	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5088	netstat.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5088	netstat.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4532	msedgewebview2.exe
4532	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4740	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	tasklist.exe
Token: SeDebugPrivilege	5088	netstat.exe
Token: SeDebugPrivilege	4744	tasklist.exe
Token: SeDebugPrivilege	3464	tasklist.exe
Token: SeDebugPrivilege	5520	tasklist.exe
Token: SeDebugPrivilege	5952	tasklist.exe
Token: SeDebugPrivilege	1164	tasklist.exe
Token: SeDebugPrivilege	2788	tasklist.exe
Token: SeDebugPrivilege	3224	tasklist.exe
Token: SeDebugPrivilege	3808	tasklist.exe
Token: SeDebugPrivilege	5444	tasklist.exe
Token: SeDebugPrivilege	4340	tasklist.exe
Token: SeDebugPrivilege	1648	tasklist.exe
Token: SeDebugPrivilege	1136	tasklist.exe
Token: SeDebugPrivilege	5720	tasklist.exe
Token: SeDebugPrivilege	4792	tasklist.exe
Token: SeDebugPrivilege	1012	tasklist.exe
Token: SeDebugPrivilege	4896	tasklist.exe
Token: SeDebugPrivilege	1492	tasklist.exe
Token: SeDebugPrivilege	1972	tasklist.exe
Token: SeDebugPrivilege	5276	tasklist.exe
Token: SeDebugPrivilege	5444	tasklist.exe
Token: SeDebugPrivilege	2712	tasklist.exe
Token: SeDebugPrivilege	1276	tasklist.exe
Token: SeDebugPrivilege	5848	tasklist.exe
Token: SeDebugPrivilege	4196	tasklist.exe
Token: SeDebugPrivilege	5240	tasklist.exe
Token: SeDebugPrivilege	2788	tasklist.exe
Token: SeDebugPrivilege	1492	tasklist.exe
Token: SeDebugPrivilege	1728	tasklist.exe
Token: SeDebugPrivilege	4948	tasklist.exe
Token: SeDebugPrivilege	676	tasklist.exe
Token: SeDebugPrivilege	4300	tasklist.exe
Token: SeDebugPrivilege	3244	tasklist.exe
Token: SeDebugPrivilege	2184	tasklist.exe
Token: SeDebugPrivilege	4272	tasklist.exe
Token: SeDebugPrivilege	5372	tasklist.exe
Token: SeDebugPrivilege	2376	tasklist.exe
Token: SeDebugPrivilege	2472	tasklist.exe
Token: SeDebugPrivilege	3856	tasklist.exe
Token: SeDebugPrivilege	3768	tasklist.exe
Token: SeDebugPrivilege	5768	tasklist.exe
Token: SeDebugPrivilege	1956	tasklist.exe
Token: SeDebugPrivilege	4688	tasklist.exe
Token: SeDebugPrivilege	5888	tasklist.exe
Token: SeDebugPrivilege	4328	tasklist.exe
Token: SeDebugPrivilege	5288	tasklist.exe
Token: SeDebugPrivilege	912	tasklist.exe
Token: SeDebugPrivilege	5408	tasklist.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2528	klutz.exe
2528	klutz.exe
2528	klutz.exe
2528	klutz.exe
2528	klutz.exe
2528	klutz.exe
2528	klutz.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2528	klutz.exe
2528	klutz.exe
2528	klutz.exe
2528	klutz.exe
2528	klutz.exe
2528	klutz.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 4740	2528	klutz.exe	90
PID 4740 wrote to memory of 4768	4740	msedgewebview2.exe	91
PID 4740 wrote to memory of 2256	4740	msedgewebview2.exe	92
PID 4740 wrote to memory of 2256	4740	msedgewebview2.exe	92
PID 4740 wrote to memory of 2256	4740	msedgewebview2.exe	92
PID 4740 wrote to memory of 2256	4740	msedgewebview2.exe	92
PID 4740 wrote to memory of 3932	4740	msedgewebview2.exe	93
PID 4740 wrote to memory of 4696	4740	msedgewebview2.exe	94
PID 4740 wrote to memory of 4696	4740	msedgewebview2.exe	94
PID 4740 wrote to memory of 4696	4740	msedgewebview2.exe	94
PID 4740 wrote to memory of 6120	4740	msedgewebview2.exe	95
PID 4740 wrote to memory of 6120	4740	msedgewebview2.exe	95
PID 4740 wrote to memory of 6120	4740	msedgewebview2.exe	95
PID 4740 wrote to memory of 6120	4740	msedgewebview2.exe	95
PID 4740 wrote to memory of 6120	4740	msedgewebview2.exe	95
PID 2528 wrote to memory of 3188	2528	klutz.exe	96
PID 2528 wrote to memory of 5088	2528	klutz.exe	98
PID 2528 wrote to memory of 4744	2528	klutz.exe	100
PID 2528 wrote to memory of 1788	2528	klutz.exe	101
PID 2528 wrote to memory of 4572	2528	klutz.exe	102
PID 2528 wrote to memory of 912	2528	klutz.exe	105
PID 2528 wrote to memory of 3464	2528	klutz.exe	106
PID 2528 wrote to memory of 5052	2528	klutz.exe	110
PID 2528 wrote to memory of 5520	2528	klutz.exe	112
PID 2528 wrote to memory of 5952	2528	klutz.exe	114
PID 2528 wrote to memory of 5232	2528	klutz.exe	116
PID 2528 wrote to memory of 1164	2528	klutz.exe	118
PID 2528 wrote to memory of 4172	2528	klutz.exe	120
PID 2528 wrote to memory of 2788	2528	klutz.exe	122
PID 2528 wrote to memory of 4000	2528	klutz.exe	124
PID 2528 wrote to memory of 3872	2528	klutz.exe	126
PID 2528 wrote to memory of 1872	2528	klutz.exe	128
PID 2528 wrote to memory of 3224	2528	klutz.exe	130
PID 2528 wrote to memory of 4956	2528	klutz.exe	132
PID 2528 wrote to memory of 3808	2528	klutz.exe	134
PID 2528 wrote to memory of 4504	2528	klutz.exe	136
PID 2528 wrote to memory of 5444	2528	klutz.exe	138
PID 2528 wrote to memory of 3220	2528	klutz.exe	140
PID 2528 wrote to memory of 4340	2528	klutz.exe	143
PID 2528 wrote to memory of 5052	2528	klutz.exe	145
PID 2528 wrote to memory of 1648	2528	klutz.exe	147
PID 2528 wrote to memory of 1136	2528	klutz.exe	149
PID 2528 wrote to memory of 5720	2528	klutz.exe	151
PID 2528 wrote to memory of 1560	2528	klutz.exe	153
PID 2528 wrote to memory of 4792	2528	klutz.exe	155
PID 2528 wrote to memory of 5252	2528	klutz.exe	157
PID 2528 wrote to memory of 1012	2528	klutz.exe	159
PID 2528 wrote to memory of 5284	2528	klutz.exe	161
PID 2528 wrote to memory of 4896	2528	klutz.exe	163
PID 2528 wrote to memory of 2788	2528	klutz.exe	165
PID 2528 wrote to memory of 1492	2528	klutz.exe	167
PID 2528 wrote to memory of 2136	2528	klutz.exe	169
PID 2528 wrote to memory of 1972	2528	klutz.exe	171
PID 2528 wrote to memory of 1864	2528	klutz.exe	173
PID 2528 wrote to memory of 5276	2528	klutz.exe	175
PID 2528 wrote to memory of 1252	2528	klutz.exe	177
PID 2528 wrote to memory of 5444	2528	klutz.exe	181
PID 2528 wrote to memory of 1884	2528	klutz.exe	183
PID 2528 wrote to memory of 2712	2528	klutz.exe	185
PID 2528 wrote to memory of 1276	2528	klutz.exe	187
PID 2528 wrote to memory of 5848	2528	klutz.exe	189
PID 2528 wrote to memory of 5912	2528	klutz.exe	191
PID 2528 wrote to memory of 4196	2528	klutz.exe	193
PID 2528 wrote to memory of 5228	2528	klutz.exe	195

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	26	curl/8.8.0
HTTP User-Agent header	27	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\klutz.exe
"C:\Users\Admin\AppData\Local\Temp\klutz.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2528.1176.769785956638556941 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView /prefetch:4 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc529c5fd8,0x7ffc529c5fe4,0x7ffc529c5ff0
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,14791824205062315507,9342015055675984730,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1760,i,14791824205062315507,9342015055675984730,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1760,i,14791824205062315507,9342015055675984730,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3372 --field-trial-handle=1760,i,14791824205062315507,9342015055675984730,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60 /prefetch:1
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=1760,i,14791824205062315507,9342015055675984730,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1760,i,14791824205062315507,9342015055675984730,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=1760,i,14791824205062315507,9342015055675984730,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4472 --field-trial-handle=1760,i,14791824205062315507,9342015055675984730,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView" --webview-exe-name=klutz.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4300 --field-trial-handle=1760,i,14791824205062315507,9342015055675984730,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0c761eee0bbccee7ab80a5725b64a6a8d98fef60
    3⤵
    PID:4372
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- C:\Windows\System32\netstat.exe
  "C:\Windows\System32\netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall show rule name="Klutz - Discord without QUIC" verbose
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1788
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks" /Query /TN Klutz-Autostart
  2⤵
  PID:4572
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" -fsSL -m 20 -H "User-Agent: klutz" https://api.github.com/repos/Flowseal/zapret-discord-youtube/releases/latest
  2⤵
  PID:912
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:5052
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5520
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5952
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:5232
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:4172
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:4000
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" -fsSL -m 20 https://api.github.com/repos/vbu00/zapret-klutz/releases/latest
  2⤵
  PID:3872
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" -fsSL -m 20 https://api.github.com/repos/vbu00/zapret-klutz/releases/latest
  2⤵
  PID:1872
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3224
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:4956
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:4504
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5444
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:3220
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:5052
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5720
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:1560
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:5252
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1012
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:5284
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:2788
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:2136
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:1864
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5276
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:1252
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5444
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:1884
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5848
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:5912
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4196
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:5228
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5240
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:2956
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:256
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:3996
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:4152
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:3556
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:800
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:1392
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:5408
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:3432
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:940
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:1704
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:2412
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:1864
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5768
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:2984
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5888
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:2848
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4328
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:4624
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5288
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:1136
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:1560
- C:\Windows\System32\tasklist.exe
  "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq winws.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5408
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc" query zapret
  2⤵
  - Launches sc.exe
  PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

34ce3f77-7e66-44e6-ad1a-3aac5a443d63.tmp

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\34ce3f77-7e66-44e6-ad1a-3aac5a443d63.tmp
Size 2KB
SHA256 21922c125dfd5eec2cc81abb3950a19ba9f6f479b257b03d713d5bf6a68cc50d
MD5 dc170dd788b42122c874a0a0a4a04e0f
SHA1 44cd9921d2e665ece5f70aca09c7da4c5e3f7080
SHA512 0ae69880b345e2af9308ec31cb17b6b4f290bc384023f4238830c64f3f004c279433366cdd519e38d5ba314ffc68d6dcf85c0f2c26a3f1d14fd9233bf28e6258
TLSH
T1325195337420AA379DB7D60579963F17DD7A61A9DA511F41C9EC070C00E725D1382C67
MD5 SHA1 SHA512 TLSH

Submit Download

8d556e47-cec3-4ee3-9e64-eb5f740dcd95.tmp

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\8d556e47-cec3-4ee3-9e64-eb5f740dcd95.tmp
Size 3KB
SHA256 e7ea143814064f591b244d4056461250c2a31e36134e4f52635847f74e03205e
MD5 01efaa1457d23c76ab5bc5aba46d5b49
SHA1 ab2dfe0c338f129efae0c313bdbc643d1dda4275
SHA512 68133423539ab175707b1094869d2cf0cfe7b374bdf39a64eb12bbaabb2e4261bb7c65ff7e988f0988d63f76356362878b6c3d4d62fad52914626a7c6fd0e0b8
TLSH
T18D6184376570A92B8DB7DA05B9C63B1BEAA65127E5813F95C9EC0F0D01E73981382C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 743e3ed42a5f540268644a3aa5bfbbb31999d9c8670f74f9ff81e7d9e118fca5
MD5 b59e22e51f5eb26353f7a673920ee8b5
SHA1 f01d4ea49f3f25b7fa6ab2f75a1850d7a2a70524
SHA512 8be92c53e20d6c7681f96ff66440b7d860ff3e8bbaefe9985bfe8beb7bac47dda5d97e61ae75fd691ba0ac85e3a9999df9a115403e9edaac9424b6e089eacbbb
TLSH
T15FD02417F7150334CC1030330003710C0D40C10F4105414C543CC57D1F14C540D4F753
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 712f58dc70d29dc0ba2d285903dc66b5bc609a6e7d7d328e6ea34c8eae7f6a30
MD5 6aa8691bc965ad3c8fdf42651677cdf9
SHA1 80ce9c82119a5c0cd47602b9eea03839ea857ebb
SHA512 6cf0025a9161b8e011aa6173e10e22934300e7ace4f1011bdd220dc34ef2c22ac90de4173740b2ff39ceac8cae25826079e6faad17dc558f9ba17a0e5d80843e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

6f3dda98-8830-430c-a503-ac916111f42e.tmp

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Default\6f3dda98-8830-430c-a503-ac916111f42e.tmp
Size 6KB
SHA256 85272a3dd7b5f343e33c0a42fcc3ca50fe39babdfd6f3d0f667a4dfffb581487
MD5 082e60b691e6b89f3cf4ff675ff3703e
SHA1 6702eaf0680fc1b538aeb8a5bfe2941f0c8f8bdd
SHA512 ef1635ec7f44e240e669246e2b05b5c5f35b48b7f423cd22cb70fe06b7ea53da7eace2e27f0d229ebebbc7103b41fb92626672bcf270fcda2e933e0f5de2b8b0
SSDEEP 96:stK/dM+Qghprb9FkWo5h16Z0gs7/x+6MhmuecJ0S1ejeGK+gC28XM1C7K:styOtu/ongsV+Fd0SQj6kG6K
TLSH
T108D1A3015E24697B4CC7F109BA69BB17E2F5647224D51E58EBFC862C08EB6CD2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 406038bec57ac0d8e929a9a9b0d97c39fb6850d3f986895f13513ce682b4fb67
MD5 50a380ce29ac691a2bf271dc68ed6736
SHA1 709e05b41928e34fcaace9d9edfcbe4a3c23fb39
SHA512 5b436a52be14193c4a020f350826f95520f39b9a73f94949cb30f225dd9cc65e9e1943bd192f1a0d03955c9837256e4f41bda63beb047e562a6ef04e3306821c
TLSH
T1B9B011B80000A082F28003B880EAE20032B3AB3202BB0800E0AA02B0E002B888220000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c5c55182dbc8790dbd846a97bd7d42b8faa0b3d1726030493fc1b3e2a155275e
MD5 5a707cd86c87a7a6f73f95d64e5ddb87
SHA1 887594e1a636b22fbeef5293f8f01b01e791c5cc
SHA512 df5a8b52027541dca88e4cb941e20aeb329bd883a42f49b297f88367bef26bc3b76be0df43003a5beb942adb537e60687acddda2679b528e0ebaee32b72fd41a
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

3792019e-3697-4dd1-ac7a-59a8b7c6a1b0.tmp

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Default\Network\3792019e-3697-4dd1-ac7a-59a8b7c6a1b0.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e8c7afa0-b958-4796-b1b3-f6dda0749d27.tmp

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Default\e8c7afa0-b958-4796-b1b3-f6dda0749d27.tmp
Size 6KB
SHA256 d8ca24b8fc215039b4977ca2d717b31944c244dde184e572e410488cf174a6cd
MD5 f8d2f03b70d2e6aef4a6ca9f8df3a1c1
SHA1 2229721488ee588609abfaa277f4c5c5e407af44
SHA512 e03683020bd81f90e8fb7248416314a564e2372701d1559c9b022c152c06296ff3fcee78a1624b0cf64d66f2d79f1927e55941b2c47078a24372df8dd591cbef
SSDEEP 96:stK/dM+QgIGprb9FkWo5h16Z0gs7/x+6MhmuecJ0S1ejeGK+g7u28XM1C7K:styOtE/ongsV+Fd0SQj6cG6K
TLSH
T1FAD1B5025A24797B4CC7F108BA69BB17E2F5647264D51E58EBFC862C08EB6CD2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\Local State
Size 1KB
SHA256 bbf8471d0c7ea3c129a94e901041fc299b07c73b105b1d3d4d373f6f25e16519
MD5 c8b7434e25aeff838821521b262400d6
SHA1 ab48568f73cfb2de89f538ff653b1f0db5d5b8fc
SHA512 c76845409283e3eb6d53e94c1f080e9e0070f05954abc16f051cca27a2d142878bc5f1fe7e46a142c7aecbb26cfcb559e186753e0b0ac3515a03b87b6d849762
TLSH
T1132140B3F1B05F32AC6AE34631A27B1B9D76246BC2014F00D5ED072E01E725D96AAC33
MD5 SHA1 SHA512 TLSH

Submit Download

c53503aa-34ee-4481-a8e3-374644dedfa8.tmp

Path C:\Users\Admin\AppData\Local\com.vbu00.klutz\EBWebView\c53503aa-34ee-4481-a8e3-374644dedfa8.tmp
Size 15KB
SHA256 cc645cf903467a28cf6e844044b5cecaa7204f236567b70a84f2596ba6fefd06
MD5 c6d44bb0947348c7abb3693c9048c3bb
SHA1 1b1186f5498775d35d1b509e2b4c642cb7fe1fd0
SHA512 6408ba58d9b4c4ea9d06ffb83162b968fc5d7a048b62358de5a42dea8f1e3e6c4abf6419e2929b7aefb694d503ea1897652f752a03c9cc2d79e63b5e06b23a8a
SSDEEP 384:S+OBqImmJvGBLx3NaFMJFNNBSijbMTNJ+g6r6:XcvGtlN1vuJIe
TLSH
T17972BF6B19726E672CBBC509BACA374BCEB56693C0D17BD5CCEC4F0F106B1801392852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1653215314\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_226158954\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_643981653\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_657800511\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2256-27-0x00007FFC73C20000-0x00007FFC73C21000-memory.dmp

Download

memory/4500-264-0x00007FFC72B50000-0x00007FFC72B51000-memory.dmp

Download

memory/4500-265-0x00007FFC748E0000-0x00007FFC748E1000-memory.dmp

Download

memory/4532-347-0x000002DCE52C0000-0x000002DCE52C1000-memory.dmp

Download

memory/4532-356-0x000002DCE52C0000-0x000002DCE52C1000-memory.dmp

Download

memory/4532-358-0x000002DCE52C0000-0x000002DCE52C1000-memory.dmp

Download

memory/4532-354-0x000002DCE52C0000-0x000002DCE52C1000-memory.dmp

Download

memory/4532-353-0x000002DCE52C0000-0x000002DCE52C1000-memory.dmp

Download

memory/4532-355-0x000002DCE52C0000-0x000002DCE52C1000-memory.dmp

Download

memory/4532-357-0x000002DCE52C0000-0x000002DCE52C1000-memory.dmp

Download

memory/4532-349-0x000002DCE52C0000-0x000002DCE52C1000-memory.dmp

Download

memory/6120-99-0x00007FFC73C20000-0x00007FFC73C21000-memory.dmp

Download