Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2024 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe
-
Size
177KB
-
MD5
51628916327cfbc45fc7c15f2e4b5751
-
SHA1
b609c00c6fdfd75b78b149d5ab74d029233eb709
-
SHA256
998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927
-
SHA512
88511839d15701d7e851ace7bf7611329160fc2bbe8e34097f561d08f450cca139ff1bea25db0ed3e4c20ace8da78ef04e687d0a14dde3292bf29a499c4f7bd2
-
SSDEEP
3072:BofZ4ZHUIWDfByOpGjAvb3eLG2FmDDSrDVTFooWZet3:mMHqpyOpGcj3UFmDDSrDVTSBQ3
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 388 Logo1_.exe 4832 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Portable Devices\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Mail\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe File created C:\Windows\Logo1_.exe 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe 388 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3516 wrote to memory of 2916 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 84 PID 3516 wrote to memory of 2916 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 84 PID 3516 wrote to memory of 2916 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 84 PID 2916 wrote to memory of 1560 2916 net.exe 86 PID 2916 wrote to memory of 1560 2916 net.exe 86 PID 2916 wrote to memory of 1560 2916 net.exe 86 PID 3516 wrote to memory of 3344 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 90 PID 3516 wrote to memory of 3344 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 90 PID 3516 wrote to memory of 3344 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 90 PID 3516 wrote to memory of 388 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 92 PID 3516 wrote to memory of 388 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 92 PID 3516 wrote to memory of 388 3516 998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe 92 PID 388 wrote to memory of 3620 388 Logo1_.exe 93 PID 388 wrote to memory of 3620 388 Logo1_.exe 93 PID 388 wrote to memory of 3620 388 Logo1_.exe 93 PID 3344 wrote to memory of 4832 3344 cmd.exe 95 PID 3344 wrote to memory of 4832 3344 cmd.exe 95 PID 3620 wrote to memory of 1924 3620 net.exe 96 PID 3620 wrote to memory of 1924 3620 net.exe 96 PID 3620 wrote to memory of 1924 3620 net.exe 96 PID 388 wrote to memory of 2284 388 Logo1_.exe 98 PID 388 wrote to memory of 2284 388 Logo1_.exe 98 PID 388 wrote to memory of 2284 388 Logo1_.exe 98 PID 2284 wrote to memory of 3212 2284 net.exe 100 PID 2284 wrote to memory of 3212 2284 net.exe 100 PID 2284 wrote to memory of 3212 2284 net.exe 100 PID 388 wrote to memory of 3556 388 Logo1_.exe 56 PID 388 wrote to memory of 3556 388 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe"C:\Users\Admin\AppData\Local\Temp\998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA911.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe"C:\Users\Admin\AppData\Local\Temp\998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe"4⤵
- Executes dropped EXE
PID:4832
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1924
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3212
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5537368dd41198317a7283696184b2bd6
SHA19d929e83d20dece4df4d94855b7f9b4716ab2323
SHA256c0734f215ff41ffcbaf53385452c8163c410be0a36c29715a753a743988d9b7b
SHA512c3166e29561f9fe5f20a28f1a9ba3f998127a72803afba77075ac7a5c2b46d2946889c11cf1d997c8034060628393fba4a46e407ab92dec6ee3912b9b79739c6
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize643KB
MD51baf5b47d5923f9e90254fe6061b3df6
SHA1e1f7600b682764650479a5ee7aef673f41416fb2
SHA25669dd2948b37e795628ad144425a0a3680c60b3e767e5a2b9005d505047a32451
SHA5120e668dac2ec2f00022a89c0b80a41df1314723a5048e55a37bd51a9c95cb2f7f60501e8766a0650beaf60dca932cbc9c8b45a54fdf47bb021b6de5690d98062f
-
Filesize
722B
MD5a1f848aea5549f19cab33317837d34dd
SHA1b209d8878e825d16743e4a960684e6e0ef8d44cf
SHA256f32806652a806998200f9e9ce1a94ffa90bd6ef2ffbf5e8451f76e756a37378b
SHA51217bc7a3e429cc5f929ddd41dc0d5da65e49e3fa34ba1aefcaaf59b51e563f82d5de62860dbbf6fa466c53150ea372112be013ec6eaa2f8c34b6a692b1e62314a
-
C:\Users\Admin\AppData\Local\Temp\998eb7f53f0193957622c1f0975337a46095af71406f4be9963bd737a69dd927.exe.exe
Filesize143KB
MD533b4c87f18b4c49114d7a8980241657a
SHA1254c67b915e45ad8584434a4af5e06ca730baa3b
SHA256587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662
SHA51242b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9
-
Filesize
33KB
MD551a089bf74658f5774db7fb483ec0f6d
SHA1b7f66ab6b8b280bd3dfd46b33384d1873cab8d3e
SHA2564822382013f33b78fe0ee1d8a414a62b2c784a11fa7cb9bbd4c0e9251ced88ce
SHA51216d2846e4682a722ff1d2c347427736f3cdd1a9dd85f7f63b4b1f6777f3daa7e89f948bc44059e0445477a59ad1bdb9c6ba2453e81331f4fdc9b77210fc1bb3c
-
Filesize
9B
MD59810b812fea5407a7c6a6b912eab6de9
SHA1653710a103c34c6d87e85d547de48561b1579927
SHA256497dc92fb09ed6740a1e704ddf5f45daf1d330f0977aaf1142604be15753e7ef
SHA512a23126d1624a391a08931a8f98ec9c26bc5bbe75de0f111bcdbf17b5bbe9bc6e748ca58e52c96fb9ea80509d5ad1c90bf1d92e472b08b2532321106ba1aca2cd