Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 02:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
General
-
Target
a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe
-
Size
70KB
-
MD5
b7b8c6622d451a1ad91825f48ee3e1d2
-
SHA1
bb0817a3885c7daee2809a600fd02fa86e5b339d
-
SHA256
a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65
-
SHA512
5f5942797b50b5598b9152a868f173ced0b650456f8eed76b6033620c72e73538e8177158c2674a916ca140ae1882b09febc129596d0a84baaa0a672e93b595f
-
SSDEEP
1536:Aie+Zk77RNH2iT919XKKkQeZriw+d9bHrkT5gUHz7FxtJ:Aie+aX3rX9DsrBkfkT5xHzD
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4580 Logo1_.exe 3144 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{C02579D9-A0AB-42F6-B7D3-0D46468AED6D}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe File created C:\Windows\Logo1_.exe a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe 4580 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3324 wrote to memory of 2960 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 81 PID 3324 wrote to memory of 2960 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 81 PID 3324 wrote to memory of 2960 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 81 PID 2960 wrote to memory of 2836 2960 net.exe 84 PID 2960 wrote to memory of 2836 2960 net.exe 84 PID 2960 wrote to memory of 2836 2960 net.exe 84 PID 3324 wrote to memory of 2616 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 87 PID 3324 wrote to memory of 2616 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 87 PID 3324 wrote to memory of 2616 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 87 PID 3324 wrote to memory of 4580 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 89 PID 3324 wrote to memory of 4580 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 89 PID 3324 wrote to memory of 4580 3324 a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe 89 PID 4580 wrote to memory of 4832 4580 Logo1_.exe 90 PID 4580 wrote to memory of 4832 4580 Logo1_.exe 90 PID 4580 wrote to memory of 4832 4580 Logo1_.exe 90 PID 4832 wrote to memory of 5096 4832 net.exe 92 PID 4832 wrote to memory of 5096 4832 net.exe 92 PID 4832 wrote to memory of 5096 4832 net.exe 92 PID 2616 wrote to memory of 3144 2616 cmd.exe 93 PID 2616 wrote to memory of 3144 2616 cmd.exe 93 PID 4580 wrote to memory of 2184 4580 Logo1_.exe 97 PID 4580 wrote to memory of 2184 4580 Logo1_.exe 97 PID 4580 wrote to memory of 2184 4580 Logo1_.exe 97 PID 2184 wrote to memory of 3756 2184 net.exe 99 PID 2184 wrote to memory of 3756 2184 net.exe 99 PID 2184 wrote to memory of 3756 2184 net.exe 99 PID 4580 wrote to memory of 3352 4580 Logo1_.exe 55 PID 4580 wrote to memory of 3352 4580 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe"C:\Users\Admin\AppData\Local\Temp\a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2836
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D26.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe"C:\Users\Admin\AppData\Local\Temp\a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe"4⤵
- Executes dropped EXE
PID:3144
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:5096
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3756
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5650c508b3fe23bd58f4378d98516f537
SHA1bbecc4f218f0dc1b01d124f074d4af10583d9c78
SHA256de9a43a0018b4ee76f16019df0c554abacea852d07b7d37a86fc70f34f299d5b
SHA512f93fb27574087b82f5ebd36f064b0efc34ee5c2e3c3774c0d4892af95a63e1c1178617fa93d5e152532e9e90b2867e7d1a5872b03de1147f149baff0db9145cb
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5c13829dbc1ac12f05d12e1dbad982e30
SHA1960baf69ff0079d77cd7f7a9e69d6fd806d20783
SHA25686d5ce82c71e2c3c86b994d4e0ed1ba15106dbf9b1319d3d8270794346c63d5d
SHA51273bc97687a97d6ca378c2b0b76d3a1443f761ebdb603e373ead6a2b979ce416a329509261e89707afb3cca6fd8dbc27a07ee7ee28ef1936d47aa12d9e434a11b
-
Filesize
722B
MD5fb6b8572d2c2b6ef9dcf6794ad9a1a8b
SHA1ae4eca84e5e8b0bda2cbfcfd9cf52c05e237e744
SHA2561465723890fb68165c0172c34ed4e32159e4c0d20b4dd1f194f42c514d715f1a
SHA51207e824901c619a0297eb880361990b0dd613d45a8e79635ebd2164c8bc91ec640839bc403c0137116a7ac67a068cc44621310949b3f4cec09cc471759a050962
-
C:\Users\Admin\AppData\Local\Temp\a4354399aeac5bc87ae2213cef7e551c34eb603cc78d0fbbf1485924b036ff65.exe.exe
Filesize36KB
MD59f498971cbe636662f3d210747d619e1
SHA144b8e2732fa1e2f204fc70eaa1cb406616250085
SHA2568adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41
SHA512b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93
-
Filesize
33KB
MD5db0109967be916a106fce9383d019fde
SHA1eac68b8e0b6d46d781cf04145401f9292b09b164
SHA256a942172e30917abd01969f3be6ad254b877d04dfeb5c642bab2d0a9d0eaa28fa
SHA512c2f1254cfc812c3bcf7b9196cde3cb14f184e211f9d75d74cb38f8638a5ef438af3301779203eb0ed06ad02b7c06de3fa03f956b0537901e3c971cf9433ade6f
-
Filesize
9B
MD54d28283e4d415600ffc2f8fda6d8c91e
SHA1053dcb8d5d84b75459bc82d8740ee4684d680016
SHA256b855effeaf01610130d3f38de35bc7f98bfc6643d98d4198af18534f048e8df7
SHA51273a758cd5e5ac48d62dd89719be604214895e0cc9a10ff7464a6cf9161a37fd27d15dd2d2565f18198b381ac6442bcb36f38614df7b1176061a83616517a7edb