a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
Size

26KB
MD5

3b6a05b3634e7169fd0ad6deb0dbc644
SHA1

4beb4f3237883a962da7c83f9c9fcb8e3924912c
SHA256

a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5
SHA512

c1cbe6bc734de171ecd9882899f03f82f28e82d99412bff8af5c22d18c4455dcdb3695ff38f3e720e74a3b9c373ee4191d21a92ecfdf952c15403e3bbb382af5
SSDEEP

768:m1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:AfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\H:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\E:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\Z:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\X:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\V:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\T:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\O:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\J:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\Y:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\U:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\Q:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\P:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\S:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\M:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\K:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\I:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\W:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\R:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\L:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened (read-only)	\??\G:	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\microsoft.system.package.metadata\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\Java\jre-1.8\lib\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Content\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\da-DK\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\commerce\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Fonts\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-white\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Velocity\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x86\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\font\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\Fonts\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\Java\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3868	2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe	96
PID 2916 wrote to memory of 3868	2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe	96
PID 2916 wrote to memory of 3868	2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe	96
PID 3868 wrote to memory of 2484	3868	net.exe	99
PID 3868 wrote to memory of 2484	3868	net.exe	99
PID 3868 wrote to memory of 2484	3868	net.exe	99
PID 2916 wrote to memory of 3364	2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe	57
PID 2916 wrote to memory of 3364	2916	a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3364
- C:\Users\Admin\AppData\Local\Temp\a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe
  "C:\Users\Admin\AppData\Local\Temp\a0a30b77689b576933f180e999cf603a0b85e08fbb223e10804458b735d98be5.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\dotnet.exe

Filesize
165KB

MD5
43077a8a7047fd604bdd5b9074e47612

SHA1
fd7c781c75bd0406957196ab863511c9cdcdeed7

SHA256
d6f313ec62045eaaba0c0c86fc2752452b7e381ab5b405432a7932858d123582

SHA512
d0bdd48d9c5858aecf33cb7803c5e6dedb47e9b95c8d89bc36121251a834496a66625ddb950f65244bc8407a1c3bb8245b5ca76582e8f91d1b5f372c825b505f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

Filesize
9B

MD5
cbff752523567179ac32a14f905e1944

SHA1
446aa136e2ec27c083df7dd49d0252f1c0243bde

SHA256
eb7756d2a0d4fe754f1fe3d1d30c92a3f7ac52252b13cd171fd7ce553d760371

SHA512
9131c53463d7ce35aa85fbd70b312fdbc04c7c649fae0f6a762758e8e39ee863bdf84a6d23d1879814f69a6d4c4fe38501235c2e557b68309d560f06c18e9eff

Download Submit
memory/2916-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-363-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-1002-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-1003-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-1170-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download