f7203529a4bcc804a141f7f15715c0e257992e23235c8c1dde3e847950fe3b9d

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kversionswitchdaemon.exe
Size 477KB
Sample260727-w238bscd72
SHA256 f7203529a4bcc804a141f7f15715c0e257992e23235c8c1dde3e847950fe3b9d
MD5 da4e939c2670b15a1d6d1db1ec1a6ece
SHA1 254321507d0cb8fffc2236bafb69257ea9790821
SHA512 4b0077b48887ef6f74ce07c17d633e4870425fcd77f0a92eac78c265d76c7afe267a8c4a979cb05714a28345c4f1222981c5b3907ea752914cde72ff5c66d857
SSDEEP 12288:AN4HHBnIf436zVuuvq8g2UMTNMscKOE/3wk:k4HHxwvql2/5OQ
TLSH
T19AA46B2076BBE131E4B244F05E78EEA1647D7D282B7046DF73C42B2A6E305D15A34F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kversionswitchdaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kversionswitchdaemon.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksopdf\URL Protocol	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoapp\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoet\ = "ET Protocol"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoWPSCloudSvr\shell	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPS\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPS\shell\open\command	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPP\ = "WPP WebStartUp Protocol"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoet	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksolink\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowpp\shell\open	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowps\shell\open\command\ = "\"\\ksolaunch.exe\" /wps \"%1\""	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoet\shell	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoqing\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoqing\shell\open\command\ = "\"\\ksolaunch.exe\" /qingbangong \"%1\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowpp\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPS\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPS\shell\open\command	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoWPSCloudSvr\shell\open\command\ = "\"\\ksolaunch.exe\" /qingbangong \"%1\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupET\ = "ET WebStartUp Protocol"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPP\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoCustomProtocol\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksolink\shell\open\command	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowpp\URL Protocol	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupET\shell\open\command	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoet\URL Protocol	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoWPSCloudSvr\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoqing\shell\open	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowpp\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupET\URL Protocol	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoCustomProtocol\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoqing\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowps\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPS\shell	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowps\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoqing\ = "URL:qingbangong Protocol"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoapp\shell	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupET\DefaultIcon	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupET\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupET\DefaultIcon	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPP\DefaultIcon	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoapp	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoet\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoCustomProtocol\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoapp	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksopdf	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksopdf\shell\open\command	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPP\shell\ = "open"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPP\shell\open\command\ = "\"\\ksolaunch.exe\" /wpp \"%1\""	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksolink\shell	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoWPSCloudSvr\DefaultIcon\ = "\"\\ksolaunch.exe,4\""	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupET\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoCustomProtocol\shell	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoapp\DefaultIcon	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPS\DefaultIcon	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoCustomProtocol\shell	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPP\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowpp\DefaultIcon	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksolink\URL Protocol	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowps\shell\open\command\ = "\"\\ksolaunch.exe\" /wps \"%1\""	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\KsoWebStartupWPS\DefaultIcon	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksowps\ = "WPS Protocol"	kversionswitchdaemon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoet\shell\ = "open"	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksoet\shell\open\command	kversionswitchdaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ksolink	kversionswitchdaemon.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5876	kversionswitchdaemon.exe
5876	kversionswitchdaemon.exe
5876	kversionswitchdaemon.exe
5876	kversionswitchdaemon.exe
5876	kversionswitchdaemon.exe
5876	kversionswitchdaemon.exe
4852	kversionswitchdaemon.exe
4852	kversionswitchdaemon.exe
4852	kversionswitchdaemon.exe
4852	kversionswitchdaemon.exe
4852	kversionswitchdaemon.exe
4852	kversionswitchdaemon.exe

C:\Users\Admin\AppData\Local\Temp\kversionswitchdaemon.exe
"C:\Users\Admin\AppData\Local\Temp\kversionswitchdaemon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5876

C:\Users\Admin\AppData\Local\Temp\kversionswitchdaemon.exe
C:\Users\Admin\AppData\Local\Temp\kversionswitchdaemon.exe
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75A092F4522006A97542D6AC4F4E69D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75A092F4522006A97542D6AC4F4E69D2
Size 8KB
SHA256 9538f935f0eed930f48980e525d28d871fde5d4b47e99498a26f0d0419a83096
MD5 eabda3a429e9d3c41da9af01e0633759
SHA1 2cfeb14434e720311192601521da50b591768198
SHA512 317e85a096c8c4246d57669d9052b57ffa250a62644f5061c2aee83798baeca3b6429c1e6a6bc62e66d4fe001bd752c28a5ec3aa0d84af2dc94bbae7c50416b7
SSDEEP 192:lSyxgU3zypaKics0R81V1Qoj4ztHAcgIJFo/Hmm:lSyxb3zEaj0RuppcFDo/Gm
TLSH
T1820230902C349C5622E75F3213CEE7153CEB79DA24E6920812704B40189668F7FFB353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75A092F4522006A97542D6AC4F4E69D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75A092F4522006A97542D6AC4F4E69D2
Size 192B
SHA256 ddff5abc094b5dfeb46fc47221f8a48d47dfd30b4fe15f88c05d50a83d293758
MD5 ed4328bb049382399bc9406dfa5ed643
SHA1 23d236fa94901e4bd25e631b7c67e27fcaabb76d
SHA512 518e60c2e24d55612772e56c2fa697f9321cbb7b144f4be3017974e5b1926544ed0b20c7ed747daaf0815e4c393ba771a11a9fb28b21dcc4ab933ba3123a29f3
TLSH
T1E0C08C643BB3016AF066423E0992AE528BF8D518C68183080B7A4A589D2EE027C72E06
MD5 SHA1 SHA512 TLSH

Submit Download