Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
General
-
Target
bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe
-
Size
66KB
-
MD5
a66b34f3943c5968a749643c56829207
-
SHA1
9f77478e616a919648ba451c18c2729732aee7b9
-
SHA256
bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41
-
SHA512
a2c28d6b8f31e2e94138143a562d5f5aab33033145c4ba7ac56479144850c83ccde79f987a88bf8dbdcbd126e75a32d8a658af1c6ae74daf3f23ee9c05ffac9f
-
SSDEEP
768:KjO5RroZJ76739sBWs69a7zKHOrEz+mKLtOWDh2KG6KzVSVxhMXYkUEt6HAkx5hN:Kje+Zk78UKUW92kKzs2Irj5hN
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 764 Logo1_.exe 4932 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{BB71AA0C-43C7-452F-84DC-F5E372E4052A}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe File created C:\Windows\Logo1_.exe bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe 764 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4460 wrote to memory of 952 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 84 PID 4460 wrote to memory of 952 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 84 PID 4460 wrote to memory of 952 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 84 PID 952 wrote to memory of 3448 952 net.exe 86 PID 952 wrote to memory of 3448 952 net.exe 86 PID 952 wrote to memory of 3448 952 net.exe 86 PID 4460 wrote to memory of 1812 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 90 PID 4460 wrote to memory of 1812 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 90 PID 4460 wrote to memory of 1812 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 90 PID 4460 wrote to memory of 764 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 91 PID 4460 wrote to memory of 764 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 91 PID 4460 wrote to memory of 764 4460 bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe 91 PID 764 wrote to memory of 3580 764 Logo1_.exe 92 PID 764 wrote to memory of 3580 764 Logo1_.exe 92 PID 764 wrote to memory of 3580 764 Logo1_.exe 92 PID 3580 wrote to memory of 1116 3580 net.exe 95 PID 3580 wrote to memory of 1116 3580 net.exe 95 PID 3580 wrote to memory of 1116 3580 net.exe 95 PID 1812 wrote to memory of 4932 1812 cmd.exe 96 PID 1812 wrote to memory of 4932 1812 cmd.exe 96 PID 1812 wrote to memory of 4932 1812 cmd.exe 96 PID 764 wrote to memory of 4504 764 Logo1_.exe 97 PID 764 wrote to memory of 4504 764 Logo1_.exe 97 PID 764 wrote to memory of 4504 764 Logo1_.exe 97 PID 4504 wrote to memory of 1652 4504 net.exe 99 PID 4504 wrote to memory of 1652 4504 net.exe 99 PID 4504 wrote to memory of 1652 4504 net.exe 99 PID 764 wrote to memory of 3424 764 Logo1_.exe 56 PID 764 wrote to memory of 3424 764 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe"C:\Users\Admin\AppData\Local\Temp\bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3448
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA539.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe"C:\Users\Admin\AppData\Local\Temp\bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe"4⤵
- Executes dropped EXE
PID:4932
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1116
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1652
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD52619e3c0fbc12352540cad64ececd6f0
SHA1c762f722647a803d4fd6b0dadcd592b48fb4363d
SHA256187cde823dd6b07ef0fdce5f94d6b0db1ebf34c66fbae7584cd6e57c801f1922
SHA51296124ea7bec10e32c2c0d640cc7dc13a4cf9a8606a5233859c7eab1fa3072bf760ade07c70cafda1a77679a8af91582bf9db7098f156864889bbe1d3652f5472
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD529bab5fa7dbfd951e1c8290a8f4c2ba7
SHA17b86728d64cef9686bd45f2ff6fdc818c11a1bbb
SHA256dda333d8aed86ba750f669280e458ad2fb8d8ad5700a5fe0df584a1c818c481b
SHA5125bb37bffffe297653f91e0601f17b507659bcfe78567e6e1d10506d3c3bea737e7d6374224ecc01f421cff8f74b299eba8fe3152742b2b1c228966a630de1339
-
Filesize
722B
MD5b51dee47fec4a2b2290c8d6d74ea7a78
SHA1db1f4f50fbf9ad8dd5843be0ca4dc6a63029f833
SHA25651ca932875045fdf07c0a21df71d45ff1a31d4defe4c24d909b82d195ad2b49a
SHA512a35fb0885c67ed21703f37692b5fd411c3d01f18621bb073b0ca08239876b04a338f6aacc6307891354e94297c95886ccee1efc777891750e01730254225e423
-
C:\Users\Admin\AppData\Local\Temp\bbd2504697ad6fdd890f68cb0b897f3dde8fe9f0522515c9e61d7f80eedbdf41.exe.exe
Filesize33KB
MD597ec61761e1fdfb2f1d4ea4d221a43d1
SHA1d6e1682a8dd967bdffe8c145731fb9ea1d0a3509
SHA2561f3069b596484ffa16181226b07c67ee1cb0f41d191ddde7c02f6bb75336cc52
SHA5127d34cc27dce09e2711d76f39c5f44525937ac15723aaedc303c154223f3ec42e6043374582614cc3067795781a2daf6ea8935f3f3b0a8747fa783cedf36090a9
-
Filesize
33KB
MD55910701a0a876d3bc74907c1eff1b580
SHA157ebb749a0c691ee683993fc9c456136d2afae40
SHA256d78ab6d9a8574207668d5c80b9ed294b49d97645572247c3f93e41e9d2f8682a
SHA512e03ca506d074e47bac87c2a7f111a7b41cc58ffe040c4d3bd6e78efaaa0231c6169f0e35d91c8693bf2f5f79b97ac46dfb7459aef1175db3fd811377d6a3a67c
-
Filesize
9B
MD51368e4d784ef82633de86fa6bc6e37f9
SHA177c7384e886b27647bb4f2fd364e7947e7b6abc6
SHA25657507bed6cf91d70e66bd4cc287634889ef30b648cb7c44a4edec0e2cb68b772
SHA5123cb7168e776eb564768e30eba43174014a85108ab306a7c07a1522fb42173c381a5bff9ac10944fd345dd5308061cbe2878c60d1e878f8768281c1adcf5dd85b