Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 14:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
General
- Target 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe
- Size 92KB
- Sample240603-r2pygsba88
- SHA256 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb
- MD5 7cd708f5fdda5c897a8979c4012603a8
- SHA1 10fc2086f27c648ec6acde53523565f9071517dd
- SHA512 0df8b5badd1de01214b66e401a840be88fe68f101e2f2e59be2c4f6ea254a637d6c960b4d5f3fd723de6d075aa7f8a3ea6e3bfd108cb0ffeac5ff56060e8cc4f
- SSDEEP 1536:6gcx1aeg1v9OQZVUKM6+kKpdyapmebn4ddJZeY86iLflLJYEIs67rxo:6gf9lOzKM5pMLK4ddJMY86ipmns6S
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 4076 Logo1_.exe 4260 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kab\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe File created C:\Windows\Logo1_.exe 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe 4076 Logo1_.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4360 wrote to memory of 1592 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 86 PID 4360 wrote to memory of 1592 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 86 PID 4360 wrote to memory of 1592 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 86 PID 1592 wrote to memory of 4004 1592 net.exe 88 PID 1592 wrote to memory of 4004 1592 net.exe 88 PID 1592 wrote to memory of 4004 1592 net.exe 88 PID 4360 wrote to memory of 1008 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 92 PID 4360 wrote to memory of 1008 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 92 PID 4360 wrote to memory of 1008 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 92 PID 4360 wrote to memory of 4076 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 93 PID 4360 wrote to memory of 4076 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 93 PID 4360 wrote to memory of 4076 4360 32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe 93 PID 4076 wrote to memory of 3732 4076 Logo1_.exe 95 PID 4076 wrote to memory of 3732 4076 Logo1_.exe 95 PID 4076 wrote to memory of 3732 4076 Logo1_.exe 95 PID 1008 wrote to memory of 4260 1008 cmd.exe 96 PID 1008 wrote to memory of 4260 1008 cmd.exe 96 PID 3732 wrote to memory of 4748 3732 net.exe 98 PID 3732 wrote to memory of 4748 3732 net.exe 98 PID 3732 wrote to memory of 4748 3732 net.exe 98 PID 4076 wrote to memory of 1636 4076 Logo1_.exe 99 PID 4076 wrote to memory of 1636 4076 Logo1_.exe 99 PID 4076 wrote to memory of 1636 4076 Logo1_.exe 99 PID 1636 wrote to memory of 3316 1636 net.exe 101 PID 1636 wrote to memory of 3316 1636 net.exe 101 PID 1636 wrote to memory of 3316 1636 net.exe 101 PID 4076 wrote to memory of 3488 4076 Logo1_.exe 56 PID 4076 wrote to memory of 3488 4076 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe"C:\Users\Admin\AppData\Local\Temp\32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AD0.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe"C:\Users\Admin\AppData\Local\Temp\32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe"4⤵
- Executes dropped EXE
PID:4260
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4748
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3316
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 577KB
- SHA256 b7fef75f8492b4117af80b0968ef4b769e83d58f92c1d103239a106d91689007
- MD5 49c3209b5ddfe05fc167e61053968a7a
- SHA1 34a49c3f868b51ff2fb4b19fcf21c5c0faa0ba9b
- SHA512 9641b6672a2fb6f13d97b0bb60290f576288b7c995500cf3b21a5bbcb58de0db04ace91276769d764b95092c1053ad75a5c7256a22089d40c6a843ed98128e33
- SSDEEP 6144:f1NM5pHE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:f1upk7a3iwbihym2g7XO3LWUQfh4Co
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
- Size 643KB
- SHA256 a31829ad88d68b47eea131646207d5b3b53468a9bdd665365f608b6ce186b8ba
- MD5 ab26006fce082246aa3ffd6ff4cbcf89
- SHA1 f8686e05d1aeb169e13c8d3889b01dd3988d5124
- SHA512 0b7f2d8dab9c10a6619970c6e0568380d79951ec942f79bc035b8c93ebe8b23d925e42b62e22aaacce6ff981fbd719526aa797031b50a036e7e6f5aef0728df5
- SSDEEP 12288:D51upk5mWukhI2jFMSjysAS9X/GsfTDYrGiqNLBryHi3H2g78C9Qz1DnmQ:N1Ak5mWpI2jFM5sFzfTpi4LsHof7T9sH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a6AD0.bat
- Size 722B
- SHA256 13b44f1f6f80cde3763186556c4611ac31aa7d54da04ecceb1153133471ff711
- MD5 5e57cf650c32c1166eb82f213074a35c
- SHA1 7a8ac5ba6f5a7d7bf1a292dbf3927143024002e3
- SHA512 28014d65d7ebb87f4daf54c874f6e463d8a5673efa1ca63036bfbcc68e7b00aeb8496f94367b1f164ce99a7e9886e6390428b9d69b4d11be04820dee0cf3f00b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\32893ef0eb6cd4a41c8f550e0a63f7303cde1ef1a0272fb4ef78296f1c3368eb.exe.exe
- Size 59KB
- SHA256 ff4ac75c02247000da084de006c214d3dd3583867bd3533ba788e22734c7a2bf
- MD5 dfc18f7068913dde25742b856788d7ca
- SHA1 cbaa23f782c2ddcd7c9ff024fd0b096952a2b387
- SHA512 d0c7ec1dae41a803325b51c12490c355ed779d297daa35247889950491e52427810132f0829fc7ffa3022f1a106f4e4ba78ed612223395313a6f267e9ab24945
- SSDEEP 768:43CapmeTX3SU4jJvugjHEeJoAAsAug2eXVO86iLflLk+xKEIs6Yig10AMxkEE:4yapmebn4ddJZeY86iLflLJYEIs67rxo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 33KB
- SHA256 4cfe7ef820ad159971bf6e87a816e11feae81964e3f656a212d84a74c43f4006
- MD5 7b70e6dab95d1383e221bd720217a020
- SHA1 4d248bfe66b232b60235c064bbead86a7f7b19e3
- SHA512 f28ce6f14fec3910892929610e1c66f84546d7b7059b605a584734ff2d0a2393b7a6141aba9d8a39911464406a73ab427c4d143e8ab84923dbf11394dbb0e632
- SSDEEP 768:6UmrpQFJFKZj1PVs9Ag1vzu4OQZce0Ote9Q77Q6WFelKpa:6gcx1aeg1v9OQZVUKM6+kKp
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\_desktop.ini
- Size 8B
- SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
- MD5 a6f28952c332969f9e6d9f7d1a449737
- SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
- SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
- MD5 SHA1 SHA512