Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 14:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
General
-
Target
a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe
-
Size
87KB
-
MD5
87c6053235fc9e8545d4bef7f94feda4
-
SHA1
12962584a5fd22e2d81af1cde8176f3844f8013f
-
SHA256
a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4
-
SHA512
c747564f3f805e93260c198f37b656444a7e7c716d283d4a8f479fc43319102a64c146911099b305df42fd217ed60ddf2b19023cf17f27dfba3de0c22a4b4beb
-
SSDEEP
1536:eFcx1ae9n40g9i/qo6SKH/RbUi+QLcnC/ZMaRiIu/r:eFfZQioJKmnCRMaRiTT
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2144 Logo1_.exe 3624 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe File created C:\Windows\Logo1_.exe a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe 2144 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1212 wrote to memory of 4260 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 84 PID 1212 wrote to memory of 4260 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 84 PID 1212 wrote to memory of 4260 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 84 PID 4260 wrote to memory of 916 4260 net.exe 86 PID 4260 wrote to memory of 916 4260 net.exe 86 PID 4260 wrote to memory of 916 4260 net.exe 86 PID 1212 wrote to memory of 4816 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 90 PID 1212 wrote to memory of 4816 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 90 PID 1212 wrote to memory of 4816 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 90 PID 1212 wrote to memory of 2144 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 92 PID 1212 wrote to memory of 2144 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 92 PID 1212 wrote to memory of 2144 1212 a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe 92 PID 2144 wrote to memory of 4616 2144 Logo1_.exe 94 PID 2144 wrote to memory of 4616 2144 Logo1_.exe 94 PID 2144 wrote to memory of 4616 2144 Logo1_.exe 94 PID 4816 wrote to memory of 3624 4816 cmd.exe 93 PID 4816 wrote to memory of 3624 4816 cmd.exe 93 PID 4816 wrote to memory of 3624 4816 cmd.exe 93 PID 4616 wrote to memory of 1872 4616 net.exe 96 PID 4616 wrote to memory of 1872 4616 net.exe 96 PID 4616 wrote to memory of 1872 4616 net.exe 96 PID 2144 wrote to memory of 4908 2144 Logo1_.exe 97 PID 2144 wrote to memory of 4908 2144 Logo1_.exe 97 PID 2144 wrote to memory of 4908 2144 Logo1_.exe 97 PID 4908 wrote to memory of 4080 4908 net.exe 99 PID 4908 wrote to memory of 4080 4908 net.exe 99 PID 4908 wrote to memory of 4080 4908 net.exe 99 PID 2144 wrote to memory of 3556 2144 Logo1_.exe 56 PID 2144 wrote to memory of 3556 2144 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe"C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8637.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe"C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe"4⤵
- Executes dropped EXE
PID:3624
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1872
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4080
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5e3b8ef4f691ddcc7936415e89be83583
SHA187ef1e48cb29be9f8bc8d8a7d37e58f7b78e0d6d
SHA25652044f9468d832bf9a0d32672e67cefbf8b7f5f6e13468090ed447868e5d4b02
SHA512e1b2b2f4d55cf6ebffe7dd862508436e7a2feb6ba8dc73960bb83905f33002409730b9f77de382589f5805c81075254c26d3e0887e91d1b0e48ddb319d8fff2e
-
Filesize
577KB
MD57658c9c47ef2805682a3b682465720db
SHA1f12ac645874395e5aa0b0140faecef4119554c3b
SHA256a7463ce4b4a0cb0128fef035b8069caa9d8530a3d797b6615f80acc87888de28
SHA512458b86000db315100ce26668cf8b70ad38f543751fa8a7d666fc9c611f3d3c42303400f1ed4314986e9ea7eec0c9c70db9d020f06725440df4d52dcb5e4f2b40
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD5c08994604c02bf7431e4c46295a779d5
SHA17f526582e292083589253bbc8b2cd093b2229ff2
SHA256218bfecab8804a634b05ebcedc30eab7aa8fa8ed5775495ba9545517c311f00e
SHA51213d9b746d0fe6922ecff9b5bf0ac896a63da11610341d4a7701e2a8d8fc5c0511d7bd9f4f54d3756b770998601b4f7b39b7e5c36d824dd42470fb0b499065c34
-
Filesize
722B
MD5e58bdb28cf58acdb73262f89e6230be6
SHA1c3d015616c1c8a2e4f5ecd742d30afa20d90e685
SHA25667f3f0bd3bab0e1bd78c8581ce5d0714e5670c001905dafc40cb2898ea16e7f1
SHA5128e7a532c642bc3fa312b2e07285160978844d75ae9f6d3f62da5e2fa1441c5adac0485047d8c5d126cedab7ca2697bf25385c2b07d8effb77f7e487e1054800e
-
C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe.exe
Filesize53KB
MD587912631f20ab91421228cd219922519
SHA171a90e384de55c6f5257466e53f6c0add270a01d
SHA256fcfdb5e2601430a674f599e054f65471e42cb18f8484aa8d8eb38f0c6f4e9c6d
SHA5120843a6a6a1e7e6d394db8d939e5e11ddfbed917e262dcb41fddee490d7e1657d45edd93fa2e734a6d8419b2f935ef53c0185d626a83ef1e7d53db8e261f8fc8a
-
Filesize
33KB
MD5117c9521e5d8959b1861c9511c792fea
SHA18b69af116f9b988e45371c811cbddbadcc067e44
SHA256ec905c17086effa5331a07e7805a26bbe62d94c5e90f5fa55a45c668061285de
SHA51293b85bf1c95bdb8781ff90f88faa4b8a0945067be93390b87ee7ab5830b17b257422cfcfcd87078c5004510e2b553876070813a55faaa578e0b979576a2c0eeb
-
Filesize
9B
MD55e286801abdc6ca5d3091665a72ecd7c
SHA187e0b4601ab0b05784a1059a45d72d807b0e2cbb
SHA256131ccc46b756e5373dc2f2d37625bfb980a48f2f2287585da364166cf2e709b5
SHA51251506d6adb68cca9e21fcddfe9672b91352cdb4f3c5b8c2da40219c73d2e7724776cd8701ff68449720c0aa398fe4f7665dabae2bd5147d42c5b6882c99f0bf1