Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 15:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe
Resource
win7-20240215-en
windows7-x64
10 signatures
150 seconds
General
-
Target
de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe
-
Size
852KB
-
MD5
8a5746ecc73037d3383e78321c8f13c6
-
SHA1
d0038e9133d9e0c6d55a8f66750605adb5c7df3e
-
SHA256
de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19
-
SHA512
8ee52d81e933c4698c2b514bd1b7e0f222757038274f212c173259288b4e0662a3edd4c76c8561163b0477a7b8175942538be119956859f2c4beaf8fb3dca74a
-
SSDEEP
24576:L1q51q1lx7SqE0xJ2pm8FiWCm3LHgZpJEHp3/:U1q171dxJ6mAQm3LHkJEJv
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 3372 Logo1_.exe 1392 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.37\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe File created C:\Windows\Logo1_.exe de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe 3372 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2960 wrote to memory of 184 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 83 PID 2960 wrote to memory of 184 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 83 PID 2960 wrote to memory of 184 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 83 PID 184 wrote to memory of 732 184 net.exe 85 PID 184 wrote to memory of 732 184 net.exe 85 PID 184 wrote to memory of 732 184 net.exe 85 PID 2960 wrote to memory of 2176 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 89 PID 2960 wrote to memory of 2176 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 89 PID 2960 wrote to memory of 2176 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 89 PID 2960 wrote to memory of 3372 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 90 PID 2960 wrote to memory of 3372 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 90 PID 2960 wrote to memory of 3372 2960 de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe 90 PID 3372 wrote to memory of 1980 3372 Logo1_.exe 91 PID 3372 wrote to memory of 1980 3372 Logo1_.exe 91 PID 3372 wrote to memory of 1980 3372 Logo1_.exe 91 PID 1980 wrote to memory of 2756 1980 net.exe 94 PID 1980 wrote to memory of 2756 1980 net.exe 94 PID 1980 wrote to memory of 2756 1980 net.exe 94 PID 2176 wrote to memory of 1392 2176 cmd.exe 96 PID 2176 wrote to memory of 1392 2176 cmd.exe 96 PID 2176 wrote to memory of 1392 2176 cmd.exe 96 PID 3372 wrote to memory of 4972 3372 Logo1_.exe 98 PID 3372 wrote to memory of 4972 3372 Logo1_.exe 98 PID 3372 wrote to memory of 4972 3372 Logo1_.exe 98 PID 4972 wrote to memory of 448 4972 net.exe 100 PID 4972 wrote to memory of 448 4972 net.exe 100 PID 4972 wrote to memory of 448 4972 net.exe 100 PID 3372 wrote to memory of 3440 3372 Logo1_.exe 56 PID 3372 wrote to memory of 3440 3372 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe"C:\Users\Admin\AppData\Local\Temp\de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B10.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe"C:\Users\Admin\AppData\Local\Temp\de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe"4⤵
- Executes dropped EXE
PID:1392
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2756
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:448
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5c41a2d76081e9fc371d69ae2956408c6
SHA1d026980a0961f0a9009b6d208c0f692577638a0d
SHA256fc296521d6121bc74b6e7e43d97f4994d829d5e36d95ade3d71523bf8b289bf4
SHA512fd6dc9ba513b3244e03655e7e32f4f346525f266f61064a5584896fbb6f630e0d3d2ddad6fd492c136d27204382a986d10da84f4dde1b081ab8e18f8585239be
-
Filesize
577KB
MD5d7e456d0fc75d57d135b524072ef3883
SHA11951c4bb2bbe40c5ac1446ce221e0ed649b46ed7
SHA2561a4633f76c3518b84fc12280ed0aa97294c2818999663de045f0c30949aefade
SHA512bfa24fd8e9f771142b808ef0340b5cd2468f012a7be827d54497e91e59e9a7a246a3f35be3bae0ea6fcac58b0cb7a2229851ac27fb740a66439ee6b62cf4f113
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD59363a720e098b38389b25a7b18cfbcdd
SHA17b5e835b22262b47e6042e7aadecc67dac05f7db
SHA25610579b661dade8697f252204f241952eb2029ea6978165f9336fd60a72b3205e
SHA512564b873358ebe4d4d194b924e9934cb5c1666df901db2556e8cbab8276f8c4380a5bee157cc8eb2063fe0f48a1d0dc1cf339d3d3040d764c974e1c46b0870f88
-
Filesize
722B
MD59b4fc2ef4cf2283e4603b72a5307b217
SHA10d93c5eb7ae6c6f0563d2340b3726714e30f1c0a
SHA2569ef4a6d18db3137dc6dc5546a4db490473fde0062bcb8a0724bf9a1f14261d3e
SHA512a3eb40f326d28da573303f6dce6441cde54b5eaa935a5e5d3202084257fa510000bbcb3286e834e276f28bda5bd851fe7d286fb93f5df64ad725c23c3248d4b1
-
C:\Users\Admin\AppData\Local\Temp\de8e3ac9aafb7973477e82db7fbdf234007b82d25eb21dbca120cd8f1a278c19.exe.exe
Filesize818KB
MD5a41e524f8d45f0074fd07805ff0c9b12
SHA1948deacf95a60c3fdf17e0e4db1931a6f3fc5d38
SHA256082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7
SHA51291bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f
-
Filesize
33KB
MD5e682314b26d8f9accc07a69b51a30227
SHA15c24a48ceaa54d6dc29043b6f984d15b0f137ea8
SHA256e9231881dbb55dd716ff2b655b5c08d134abd4f00f7f24c7cf864984f07e0d39
SHA512934c44c221f9b3b1d4bf6f854cac17be65ea9b53b9844b05f9106bf7ffbe985ade37517bb97061dd302a3840a1c7b1ca16cc37e1935a28495afef44716035ccb
-
Filesize
9B
MD5fa1e1ef0fdda97877a13339b28fa95e5
SHA17e2cffca41118e7b2d62963bd940630b15b85653
SHA256968b715c081472526487d60da8968e9b3bde2dac103f69beb3f6abe6ef7bc191
SHA5123d55913a97aa89a7201342705640c1d031d19ad8aca4939219067f84e3fe118f47b4e388f490f69f605683d3854425c3de188f731886405474ae8e3d42c86f4f