Analysis
-
max time kernel
99s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
29-06-2022 16:02
Static task
static1
Behavioral task
behavioral1
Sample
Vape_v4.08/Vape_v4.08/Kangaroo Patcher.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Vape_v4.08/Vape_v4.08/Kangaroo Patcher.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Vape_v4.08/Vape_v4.08/Vape_v4.08.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Vape_v4.08/Vape_v4.08/Vape_v4.08.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Vape_v4.08/dumper/mitm_server.py
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Vape_v4.08/dumper/mitm_server.py
Resource
win10v2004-20220414-en
General
-
Target
Vape_v4.08/dumper/mitm_server.py
-
Size
4KB
-
MD5
fb2ea3294517bab463df4273e7c6bcd6
-
SHA1
1a5eb75bff26c1d8a8cfefa57a8ea7fe366b7546
-
SHA256
bc130c050da31bc55f7d6aa1c7a7e0817f289fa0eaf72ffa253cbaa10c45aff7
-
SHA512
ef56b9000dca93f34a5badb94299f27cd0cca267decf9c99b60dfe7b60d5df748900da7a422882a80f0a26a552bcb0588298096aa56d80c2026e190da862dfa7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 18 IoCs
Processes:
OpenWith.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\.py OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\.py\ = "py_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\辑黉Ȁ耀.py OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\村⇟赕输黇Ё耀 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\py_auto_file\shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\py_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\辐黈Ψ踀\ = "py_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\py_auto_file\shell\edit OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\辑黉Ȁ耀.py\ = "py_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\py_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\py_auto_file\shell\open OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\py_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\py_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\辐黈Ψ踀 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\村⇟赕输黇Ё耀\ = "py_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\py_auto_file\shell\open\command OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 4532 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exepid process 2544 chrome.exe 2544 chrome.exe 1692 chrome.exe 1692 chrome.exe 4296 chrome.exe 4296 chrome.exe 3388 chrome.exe 3388 chrome.exe 4228 chrome.exe 4228 chrome.exe 2820 chrome.exe 2820 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OpenWith.exepid process 4244 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
chrome.exepid process 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
chrome.exepid process 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe 1692 chrome.exe -
Suspicious use of SetWindowsHookEx 29 IoCs
Processes:
OpenWith.exepid process 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe 4244 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
OpenWith.exechrome.exedescription pid process target process PID 4244 wrote to memory of 4532 4244 OpenWith.exe NOTEPAD.EXE PID 4244 wrote to memory of 4532 4244 OpenWith.exe NOTEPAD.EXE PID 1692 wrote to memory of 5076 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 5076 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 4088 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 2544 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 2544 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe PID 1692 wrote to memory of 1980 1692 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Vape_v4.08\dumper\mitm_server.py1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Vape_v4.08\dumper\mitm_server.py2⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0e964f50,0x7ffe0e964f60,0x7ffe0e964f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2320 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4464 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3124 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4472 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3928 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,11017409508614966075,17705231143341300647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_1692_PDSOBEWGTQDLGQAOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4532-130-0x0000000000000000-mapping.dmp