Analysis
- user interaction
yes - max time kernel
64s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 20:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Windows Killer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target Windows Killer.exe
- Size 11KB
- Sample260822-zpynvstybs
- SHA256 f7750374b77faa83badf972329253c5287d33295ba01112922c031f436f4b0fe
- MD5 150b41c3b235510e7f136e6bf0a52943
- SHA1 5836c0caa76cb06ff8a4f19716229f0ddfc5c061
- SHA512 4aa97b21f1eaaa0a825ac42bdfa60cac306dbf49cd5d2b56f2e6fe15bb601d1ab9e2230ba584624c79e528aff866acb812a3bd5067412d32cd3f6e1888b293ac
- SSDEEP 192:pF3lYWPX7kh4QCaJZTKtNtmrjvaSulwkjvGD0p146PkyaJ5z9:pF3hkuaLTKtNtmrjzulwkjvAOXPh2z
- TLSH T16A32FA0067FD9B37E5BA3F7D58E2526003B1BA62D81FDF4E218C61476C9230886E2763
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\OSDATA Windows Killer.exe File created C:\Windows\SysWOW64\65affaa6-4e11-45e2-9d51-b356224a37cc.zerosection Windows Killer.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Integration\3664514c-0101-4f80-bec1-024b1647a809.zerosection Windows Killer.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\897fdfbc-0bbc-40c0-92d3-11c6951d83fb.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\90f0fb01-748c-4078-b624-1fc2c9ecec28.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\ec0d4c66-7a11-4a5b-bf80-d632910a8688.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\5f27196d-4eb6-4b0f-b297-e43c20e9b83f.zerosection Windows Killer.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\2500ed5b-77c5-43a3-af0a-76093444d690.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\181d69d7-f98f-455c-899a-5dbf680b9a74.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\c9d0b3ee-09a4-4378-bdb4-0f0469773899.zerosection Windows Killer.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\48f15053-e7de-49d1-84a7-bffc2e5202f1.zerosection Windows Killer.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\1b538f16-7e29-4b43-aeba-b0ce1ad3490f.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\e539817c-3333-45c0-8c72-b56a3e65f71d.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\f3ac0250-c9a0-485f-a88b-e104229b9889.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\b8555f92-0435-45f3-b7c8-ad51663ba57e.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\58a660a9-1b3d-4b4c-bd29-a08facb1a903.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\8b3c9e79-e285-481b-9c7d-67e06daa1158.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\336c5b14-68a6-47d1-8d04-3c71aae84964.zerosection Windows Killer.exe File created C:\Program Files\d86d118b-c779-4d39-bdc6-e8e10ac8c00f.zerosection Windows Killer.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\e5d8ecc1-a5b9-45ad-950c-62aade6fd72c.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\2720fd4b-064d-4b46-8e77-fdd7edd5d626.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\a19c31a6-7737-49c7-8fb3-6797e446817c.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\04b0c7d9-5992-4503-aa32-c89b1031b523.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\3fade69a-2f76-4854-b097-bae46270273a.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\b7067cc9-a224-4500-ab1f-2ab1ca1c9d99.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\da-dk\88c52f84-01f8-4558-93b8-989a0687cb6b.zerosection Windows Killer.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\9c75c982-2224-4a1e-bb19-6c02839e9306.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\e0c6a03a-5740-4097-8325-6524b3eea742.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\601fb9e0-9d19-4969-9369-9d0274d44c14.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\e552e35c-c96c-4e8b-8eeb-139f39e674f2.zerosection Windows Killer.exe File created C:\Program Files\Microsoft Office\PackageManifests\210fe501-8554-4ee7-8f8e-4b38d2e876c8.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\b87b9862-265e-4902-a94b-451ad6f3e06e.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\a5937b3c-e8e0-4589-9a5b-4d9ff6a4db5d.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\aaf0438a-8249-4a20-a03e-df11e93cb41d.zerosection Windows Killer.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\88c17658-6e67-4774-9b3f-b069b897b936.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\618734fd-200d-4a9e-b98c-3e32cd53768d.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\2acceaf2-2fe2-4892-8e7f-95317db9f736.zerosection Windows Killer.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\2fb1efd9-cab3-41e1-8526-f47c67655601.zerosection Windows Killer.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\eecafc93-371b-43d6-8d42-645132ed2e3a.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\099271ba-5057-4cef-8ac9-7b021e6154df.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\87bf4856-0633-49e2-93a0-7df530314ac0.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\339ca7c6-d991-4929-8631-3ffb39c107db.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\c4afc182-1ade-4246-ba76-2e4c6f4f7374.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\465a2c96-d4fc-4359-b18d-dfb850ad3c4f.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\cf411549-9ff5-4e99-a21b-c6e9f524bb78.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\bbf170b0-9643-4e00-9c25-4cafd67ede5c.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd60b520-5db9-4d00-9ab7-053eb55b58d6.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\4d5e4473-21a0-4ec7-b1a0-b001fee99bbf.zerosection Windows Killer.exe File created C:\Program Files\Microsoft Office\PackageManifests\36eaeefb-775e-495f-bf8e-40d966210c24.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\18373b5a-a1b4-4fe8-8e56-8ec3ac4281a8.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\975befc3-3e8a-479f-ac3b-6418750a506d.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\f5a48fdb-37a2-4ec2-8a05-9351aa2941b4.zerosection Windows Killer.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\58ab66e5-134a-4607-ae39-a6f72e3997e1.zerosection Windows Killer.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\e1107327-acb7-479c-ba57-11db64ff7839.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\009dfc6f-6c68-4af2-b05a-2c46e90e3834.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\97b5e2a3-5eee-42f2-b8b2-9b4ffd6f6f25.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\42f61846-e0dd-487f-af9a-4bd88772cf6e.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\7a6f0ad2-b433-4c2b-a5a0-915534bbeaa1.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\a0c92676-51f2-4740-b087-6eb2d3eadf37.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\7fab907c-4dae-4137-9524-7882b2a002ac.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ec6b74c7-d0ba-4b92-a821-9230010f3c88.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\e8329723-bb53-4ed1-956e-cc6175aba14e.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\930a7f9d-8e93-415b-abf7-3678f3816d5f.zerosection Windows Killer.exe File created C:\Program Files\7-Zip\Lang\3381b6e9-a84f-4479-84e4-125a10daa430.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\3439b295-abe1-4127-a5c2-b4099e70b5e7.zerosection Windows Killer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\2d1cb9e9-0b79-44b2-83a2-13077ef1f109.zerosection Windows Killer.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\3d550f32-9230-4073-a0d5-3a5e682b181d.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\6e9de4bb-9da4-49e2-862d-f6158256ff5f.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\EN\67c31d62-cd6e-490e-9df1-2adaa7970ffe.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\79461a4c-6201-4618-a4d8-3bbaf1f6a705.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\fr\7974504e-28dd-4de0-8d63-4bc8d3f8a503.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\fbec83a5-ca3e-4c77-b985-615208f04a88.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\17f09e41-127b-4f08-bca6-67090246d0ae.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\1b163e69-3b85-46c2-9250-705757588a2b.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fadec61f-9760-4434-870a-ad1822e31cff.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\109c93d5-ed05-4bc1-ac13-f535a695bda8.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\f8a0919d-ffa8-4a5c-9af0-be6b6848ec23.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\e561836c-3081-4b30-a55a-8a7058343227.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\50ee1251-ee57-40ee-8b36-87b99ed67430.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\c3a0b604-0ea0-4e08-9e54-bad1bee8aa61.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\de\b015bbba-5c45-4c7d-952f-47e7560039d8.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\b9c5cb75-9888-434a-8496-e2dc72226127.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\6358e9bb-f6d1-44c0-b45c-3dfb58a86948.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\ja\0cd223c6-0a7c-4dcb-a54c-8fc993a54a6e.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\05adf5cf-87a9-4e4c-9ecf-328c6efb92d2.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\918799fa-4281-4258-8738-4d65bb95a9f0.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\de\95c5412c-f808-49e3-a118-a14b835a871f.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\es\1783a168-17de-45a1-8ef1-6ee9d336dec5.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\24da256f-c43d-4568-81fb-53a490951216.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\es\383600d0-7719-4a77-9327-15f22d1e8cfc.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Policy.3.0.Microsoft.BackgroundIntelligentTransfer.Management\v4.0_10.0.0.0__31bf3856ad364e35\4fc13861-b6b7-4bc5-be23-f6b11763b3b5.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\fr\32f4e784-25e9-4893-a766-2663f42fa77b.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Policy.1.0.Microsoft.PowerShell.Security\v4.0_1.0.0.0__31bf3856ad364e35\da40f5da-376a-4dfb-a90b-58b7a87bdcfd.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\de\a2e47f77-5620-4247-8017-fb70914e2e85.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\82e1cb76-4587-4d5c-8941-1e4b5a29b832.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\b52544b7-0fdb-4804-8118-2a87b2256b2d.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\c8d03cb6-580f-4627-8764-e1e54e1d5228.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\815e7001-4864-41b4-9ea6-231d9ef35721.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\04b078ec-e44e-475b-867f-cd8f6b44e57e.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\3befdca0-1dfb-4303-a56c-559bacd8095f.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\it\ed6e0f06-271c-4125-ae0a-d9bef5ecc792.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\it\60504ab5-3e87-4ee6-88fb-3e2ba0de1300.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\97fde516-df2a-4979-84a4-8e66758b603d.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\9b81798a-0cf7-4ee0-87b0-da3b1b77f4ce.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\5342c10f-b8b8-488c-9515-943fbcc0956d.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\fr\7d277ebe-8cbb-489c-bd5a-b5fc9b874601.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\ja\fbfbcd9d-e479-40e6-92c6-d8a44ebaf7b3.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\202f5ba1-e5ce-4679-b5d8-1a2faed294c3.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\f8302fc9-bcee-40dc-b529-acd3b0799bdb.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\cc403fff-a2ac-479d-8d94-48fb39514908.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\es\80810dcb-c425-414b-90a5-b049be98b01d.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\it\dedbc130-45b3-47a9-9aad-31709714b36d.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\895670c5-b8f8-41e0-9300-b6a8a9a6ae35.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\c807f133-4239-4ec9-aa9c-fe327734405f.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\fd1ef184-5e7c-425c-b7ec-2ce4c1829fdb.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Policy.1.0.System.Management.Automation\v4.0_1.0.0.0__31bf3856ad364e35\b5a9fcc2-6396-455f-8148-56bf790fc8d4.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\5c25289a-7439-4aa1-ac2e-c3c67700f44b.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\8210ed7f-12f6-4109-9da6-8413383a8ee4.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\e0776772-4611-405d-8974-154697d24a84.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\38124214-43e9-47e9-ab35-e6bfc5697dde.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\it\411b200a-a8ba-4902-a52e-7ce651f36df2.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\e170d520-f890-4170-a8ea-b4c03db537d1.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\es\477682ab-b553-4c80-8067-bfc4000aa530.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\ja\9fb425dc-3db1-4ce7-a9c6-1bec0907d9d6.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\ja\b2b4b1b6-3374-4f75-a36d-2883a736d4d3.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\94d0629c-a1eb-4a15-a35e-029a1db9175c.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\61511d4f-b132-4e1e-bea4-dbde82bc193b.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\2318790c-a440-4a0c-a072-aa0d3da77eb4.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\e79ff887-5a77-4485-8632-6c159e77a04d.zerosection Windows Killer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\it\9bc56705-d8ce-4b00-8738-a05b6f4e5468.zerosection Windows Killer.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows Killer.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\e0c70a8f-9d23-48ee-98ae-3925be0ea3a4.zerosection
- Size 500B
- SHA256 0841ea62d9232a98182d4125fc05cc900721f0b303549d552a96bd99a451c447
- MD5 97d30e910a2a19771184464b2140a948
- SHA1 27dc898067e9a401c56a844a1b2275065ad46253
- SHA512 085a18fd2fadead1776fcfc8333fdd56d240a3579ee83057226953848c2838811b595fab333028b572cd78a81af6f6f00e5e35ee830745b07dbc1cde08cba940
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\76fa4599-ad3d-4a0d-b529-ab4ae187dd99.zerosection
- Size 5B
- SHA256 e7042ac7d09c7bc41c8cfa5749e41858f6980643bc0db1a83cc793d3e24d3f77
- MD5 dcddb75469b4b4875094e14561e573d8
- SHA1 6934105ad50010b814c933314b1da6841431bc8b
- SHA512 a7de78f5b4d7b66b6424f7ee3503095a97d3a432dcc3834d14431b3afed198e73a32d3d92a813747d0691326c5c677159a1184deb5912eeaf3af9fa6fc9ec70b
- MD5 SHA1 SHA512