Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe
-
Size
76KB
-
MD5
783b7ef48c143c666f9fcb4dd739dcab
-
SHA1
2bad918412e368abded112374f73e740801824ea
-
SHA256
aef2c9cd0e13058d9df670b898c3f2b85467c403dac2eeb4ac73cc33efa7ec26
-
SHA512
0c44116ea662bc195e3362641aee93e17264eea52ce7599ec8894cec620d95ba7a93c9695dcd37af20f91af23ddd7ad2a8e9a71ec6fd3bbdcdd31f19ee981c3d
-
SSDEEP
1536:fweqbQV6iz9dbIgc//////ChYg4c3LaOywAfd3PDcCgqjw0JVfPsxz2wjV:f6U6ynkgc//////C6c+OyDBTtvcB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2240 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2656 SETUP.EXE -
Loads dropped DLL 4 IoCs
pid Process 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 2656 SETUP.EXE 2656 SETUP.EXE 2656 SETUP.EXE -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2824 sc.exe 2736 sc.exe 2864 sc.exe 2700 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SETUP.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Kills process with taskkill 8 IoCs
pid Process 2760 taskkill.exe 2560 taskkill.exe 2116 taskkill.exe 2672 taskkill.exe 2056 taskkill.exe 2880 taskkill.exe 2832 taskkill.exe 2764 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe Token: SeDebugPrivilege 2832 taskkill.exe Token: SeDebugPrivilege 2764 taskkill.exe Token: SeDebugPrivilege 2880 taskkill.exe Token: SeDebugPrivilege 2760 taskkill.exe Token: SeDebugPrivilege 2116 taskkill.exe Token: SeDebugPrivilege 2560 taskkill.exe Token: SeDebugPrivilege 2056 taskkill.exe Token: SeDebugPrivilege 2672 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2252 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 30 PID 3016 wrote to memory of 2252 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 30 PID 3016 wrote to memory of 2252 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 30 PID 3016 wrote to memory of 2252 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 30 PID 3016 wrote to memory of 1820 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 31 PID 3016 wrote to memory of 1820 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 31 PID 3016 wrote to memory of 1820 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 31 PID 3016 wrote to memory of 1820 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 31 PID 3016 wrote to memory of 2160 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 32 PID 3016 wrote to memory of 2160 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 32 PID 3016 wrote to memory of 2160 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 32 PID 3016 wrote to memory of 2160 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 32 PID 3016 wrote to memory of 2700 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 33 PID 3016 wrote to memory of 2700 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 33 PID 3016 wrote to memory of 2700 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 33 PID 3016 wrote to memory of 2700 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 33 PID 3016 wrote to memory of 2760 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 35 PID 3016 wrote to memory of 2760 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 35 PID 3016 wrote to memory of 2760 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 35 PID 3016 wrote to memory of 2760 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 35 PID 3016 wrote to memory of 2764 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 36 PID 3016 wrote to memory of 2764 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 36 PID 3016 wrote to memory of 2764 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 36 PID 3016 wrote to memory of 2764 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 36 PID 3016 wrote to memory of 2824 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 37 PID 3016 wrote to memory of 2824 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 37 PID 3016 wrote to memory of 2824 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 37 PID 3016 wrote to memory of 2824 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 37 PID 3016 wrote to memory of 2832 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 38 PID 3016 wrote to memory of 2832 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 38 PID 3016 wrote to memory of 2832 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 38 PID 3016 wrote to memory of 2832 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 38 PID 3016 wrote to memory of 2880 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 39 PID 3016 wrote to memory of 2880 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 39 PID 3016 wrote to memory of 2880 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 39 PID 3016 wrote to memory of 2880 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 39 PID 3016 wrote to memory of 2660 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 42 PID 3016 wrote to memory of 2660 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 42 PID 3016 wrote to memory of 2660 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 42 PID 3016 wrote to memory of 2660 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 42 PID 3016 wrote to memory of 2788 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 43 PID 3016 wrote to memory of 2788 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 43 PID 3016 wrote to memory of 2788 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 43 PID 3016 wrote to memory of 2788 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 43 PID 3016 wrote to memory of 2796 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 44 PID 3016 wrote to memory of 2796 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 44 PID 3016 wrote to memory of 2796 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 44 PID 3016 wrote to memory of 2796 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 44 PID 3016 wrote to memory of 2736 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 45 PID 3016 wrote to memory of 2736 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 45 PID 3016 wrote to memory of 2736 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 45 PID 3016 wrote to memory of 2736 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 45 PID 3016 wrote to memory of 2560 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 46 PID 3016 wrote to memory of 2560 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 46 PID 3016 wrote to memory of 2560 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 46 PID 3016 wrote to memory of 2560 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 46 PID 3016 wrote to memory of 2116 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 47 PID 3016 wrote to memory of 2116 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 47 PID 3016 wrote to memory of 2116 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 47 PID 3016 wrote to memory of 2116 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 47 PID 3016 wrote to memory of 2864 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 48 PID 3016 wrote to memory of 2864 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 48 PID 3016 wrote to memory of 2864 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 48 PID 3016 wrote to memory of 2864 3016 783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\783b7ef48c143c666f9fcb4dd739dcab_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\net.exenet stop "Security Center"2⤵
- System Location Discovery: System Language Discovery
PID:2252 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"3⤵
- System Location Discovery: System Language Discovery
PID:2336
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Windows Firewall/Internet Connection Sharing (ICS)2⤵
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)3⤵
- System Location Discovery: System Language Discovery
PID:848
-
-
-
C:\Windows\SysWOW64\Net.exeNet stop System Restore Service2⤵
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop System Restore Service3⤵
- System Location Discovery: System Language Discovery
PID:2268
-
-
-
C:\Windows\SysWOW64\sc.exesc config ekrn start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2700
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im ekrn.exe /f2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im egui.exe /f2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
C:\Windows\SysWOW64\sc.exesc config NOD32krn start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2824
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im nod32krn.exe /f2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im nod32kui.exe /f2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\SysWOW64\net.exenet stop "Security Center"2⤵
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"3⤵
- System Location Discovery: System Language Discovery
PID:1448
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Windows Firewall/Internet Connection Sharing (ICS)2⤵
- System Location Discovery: System Language Discovery
PID:2788 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)3⤵
- System Location Discovery: System Language Discovery
PID:1620
-
-
-
C:\Windows\SysWOW64\Net.exeNet stop System Restore Service2⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop System Restore Service3⤵
- System Location Discovery: System Language Discovery
PID:308
-
-
-
C:\Windows\SysWOW64\sc.exesc config ekrn start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im ekrn.exe /f2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im egui.exe /f2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
C:\Windows\SysWOW64\sc.exesc config NOD32krn start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2864
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im nod32krn.exe /f2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im nod32kui.exe /f2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\SETUP.EXEC:\Users\Admin\AppData\Local\Temp\SETUP.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Windows\SysWOW64\cmd.execmd /c c:\_uninsep.bat3⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Windows\SysWOW64\cmd.execmd /c c:\_uninsep.bat3⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del C:\NTDUBECT.EXE2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128B
MD5518f996fb53ecd3d3748db8708c21908
SHA14c8834441fdcb4898d9d0607e9a9dfd2477a8bfa
SHA2563770f9b5c752a17164ac0a8d361b01862ab186c2732cb659ce2519280bec79d4
SHA5127ac8e8066ceefebf7dfd83ce877461a45ae0b1802883ae7b319c5b756cc65a4a58814370d381ec97338a9c18f49bf7966430f6d72ff2e27d6b844a56edfab6c4
-
Filesize
10KB
MD52b6d4988f6ee560e6b55c2e0f60b9edc
SHA147d74390150386fdd2a6afc90c49bd4f00dffda2
SHA256d7be7452d1ab413ce22504f85dd043b256b56e624543753001d11c2e437fdbe3
SHA512bb06039f27ec3fbb3d0ff020a219e8f4a0ea4e3db0472f673a9eea683a85cf365ad1ddbee7279a972395769fc9b4be4c3db701a3470de819480ba9e286871af3