1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
Size 26KB
Sample260823-jpzcdsfl2x
SHA256 1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694
MD5 1ecbb8e24337bb6b82743dd68b51a359
SHA1 9aac4cb4c45590b81efa19cd9c83bc62799a7fe0
SHA512 22af46357691aced87411d1167ba4b9b4255689c6a28d851e61a200512eaf1a5545fb45b0123dc2a023bc5181aee9ae08100bf62d1c1a809143c94ac9c31c2e2
SSDEEP 768:v21ODKAaDMG8H92RwZNQSw+IlJIJJREIOABT6UYOn:ofgLdQAQfhJIJ0IOEmUYc
TLSH
T1D3C2E1C737C46595C81D17FCD7EA2683437C4825686E984324D1ACBF617D3E42C9883A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\Q:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\N:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\K:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\J:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\I:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\G:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\W:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\S:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\R:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\H:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\X:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\V:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\U:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\P:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\O:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\L:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\Z:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\T:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\M:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened (read-only)	\??\D:	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\PdfPreview\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_game_assist\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files\dotnet\host\fxr\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\he-il\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\x64\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\PdfPreview\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 4804	5960	1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe	89
PID 4804 wrote to memory of 5872	4804	net.exe	91

C:\Users\Admin\AppData\Local\Temp\1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe
"C:\Users\Admin\AppData\Local\Temp\1d218e4b343501006d308d629344637237b6db01a11b8e91df4aa05366db4694.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 97bb491cd3bbf8bc8dde7a7039a7d5a0b005a39b93eb763541222821921798da
MD5 b5b873db0ba44197be0c68c3ff332c9c
SHA1 55390b16ff28b4bc52e9f1a7f9c325768f51edc1
SHA512 6e170e23f55d5db7ff33887ddfb5d9aa2f04f605ece2dc3d2b95ef234a02eb2633ce0bd3476cca9f0339caf9b048ed64594708115b726565678da40aa847542d
SSDEEP 3072:UftffhJCuEmULhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:sVfhgujsG7/fYfLvzB+QFyn
TLSH
T1B5C38D1371D084A1E5B50D3449E0EAA19E3FFD620B449EA733C466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 170KB
SHA256 dbaf5874618c4c9febb25e7d82b7a8785f5aa516dfcf9ce4cc05914cfeb0f578
MD5 095cd1ddfa19abc117ca6d83d2d79126
SHA1 3fc8cd5221252337e15edec82a0e17f6246efddb
SHA512 b861248c2a328d4ca4f2bd123e4f052e9e55e1777788c31385304faeddd51aa8d3c35041017f8812acde12dcd93706524b06a88782cd00bd8b515999256e8a27
SSDEEP 3072:oftffhJCuEmULvJ9psmeIBcV8pQFq4XKF3QP6:4VfhgujO3psmeI+sQFqT3Qi
TLSH
T18504174AD29802E8C06E6279C7964A41B3377C2587E1D3CB52D0F53E1F766D09EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 827a0e8827f3c1db2715fc7b2c5c5a92ac3deedd294f7b40622093cb92c328eb
MD5 81aede730abb1e63bf33b30beac52b7b
SHA1 4d333794a9892481914a804d837d4cbacf943416
SHA512 0abf236adebfd10ad158acb6203f584e3384a89eedad16ef7cad224ad6d90fc525366affd43e6c006653b2f9eb903faa093112b465c78e3558896afb88588017
SSDEEP 12288:/pJgurqIOkU8AMXE9B7PElZlP41N+4PUWfo:hJlBOkUhMXcBwc04nA
TLSH
T189A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4046655672-1449839301-2197395821-1000\_desktop.ini
Size 9B
SHA256 e7a73e3169f6957e81cc3715978360652a0c0c7f11314e8d737cf084f4bd5e71
MD5 626b4f4b13f8b093beed9653cd01e961
SHA1 9d1650dabbf3eb93f23170f8d9b6d1062bca0b49
SHA512 952f4de7159785706ec276883bf9693cca6083456ef9da3e7b0d9b65f75a3c7b326d75cba0132234d1905a50f0a95392b18062360757a8ecf8ddf37f6418fcd3
MD5 SHA1 SHA512

Submit Download

memory/5960-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5960-18-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5960-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5960-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5960-68-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5960-1229-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5960-5-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5960-5026-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5960-5499-0x0000000000400000-0x0000000000434000-memory.dmp

Download