Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3JJSploit_7...up.exe
windows10-2004-x64
8$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3JJSploit.exe
windows10-2004-x64
3resources/...bot.js
windows10-2004-x64
3resources/...lip.js
windows10-2004-x64
3uninstall.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 12:38
Static task
static1
Behavioral task
behavioral1
Sample
JJSploit_7.4.1_x86-setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
JJSploit.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
resources/luascripts/general/aimbot.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
resources/luascripts/general/noclip.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20240802-en
General
-
Target
JJSploit.exe
-
Size
9.8MB
-
MD5
5aa8497659e32136c48465a91e092d1a
-
SHA1
f03bd00ad306305630d647805648822b542beb60
-
SHA256
e02832385c39f13876f7416350a9d76a93b4e97648c77e073e226217802832a6
-
SHA512
abf442476c2d2646e62695bd4c3b9b56c445e0bf58b0add81a9f933227835a7ee959646ddb426a152b507b503c3df670b20e8ebb2c3a6f8fd69d023b6c128751
-
SSDEEP
196608:X0CW7PVmsuHfDpHHZ0ry9bUhLnCHpw4aGIE9XBp:X0CW794HfDpHHz1iWw4a/oXBp
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJSploit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4260 msedge.exe 4260 msedge.exe 2676 msedge.exe 2676 msedge.exe 1704 msedge.exe 1704 msedge.exe 996 identity_helper.exe 996 identity_helper.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2384 JJSploit.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 808 2384 JJSploit.exe 85 PID 2384 wrote to memory of 808 2384 JJSploit.exe 85 PID 2384 wrote to memory of 808 2384 JJSploit.exe 85 PID 2384 wrote to memory of 1124 2384 JJSploit.exe 86 PID 2384 wrote to memory of 1124 2384 JJSploit.exe 86 PID 2384 wrote to memory of 1124 2384 JJSploit.exe 86 PID 808 wrote to memory of 1372 808 cmd.exe 88 PID 808 wrote to memory of 1372 808 cmd.exe 88 PID 1124 wrote to memory of 1704 1124 cmd.exe 89 PID 1124 wrote to memory of 1704 1124 cmd.exe 89 PID 1372 wrote to memory of 4140 1372 msedge.exe 91 PID 1372 wrote to memory of 4140 1372 msedge.exe 91 PID 1704 wrote to memory of 4464 1704 msedge.exe 92 PID 1704 wrote to memory of 4464 1704 msedge.exe 92 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4348 1372 msedge.exe 93 PID 1372 wrote to memory of 4260 1372 msedge.exe 94 PID 1372 wrote to memory of 4260 1372 msedge.exe 94 PID 1704 wrote to memory of 3824 1704 msedge.exe 95 PID 1704 wrote to memory of 3824 1704 msedge.exe 95 PID 1704 wrote to memory of 3824 1704 msedge.exe 95 PID 1704 wrote to memory of 3824 1704 msedge.exe 95 PID 1704 wrote to memory of 3824 1704 msedge.exe 95 PID 1704 wrote to memory of 3824 1704 msedge.exe 95 PID 1704 wrote to memory of 3824 1704 msedge.exe 95 PID 1704 wrote to memory of 3824 1704 msedge.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\JJSploit.exe"C:\Users\Admin\AppData\Local\Temp\JJSploit.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C start https://www.youtube.com/@Omnidev_2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@Omnidev_3⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbaa1346f8,0x7ffbaa134708,0x7ffbaa1347184⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11958907570778065163,3993998959584864406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:24⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11958907570778065163,3993998959584864406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4260
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C start https://www.youtube.com/@WeAreDevsExploits2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@WeAreDevsExploits3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbaa1346f8,0x7ffbaa134708,0x7ffbaa1347184⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:24⤵PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:84⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:14⤵PID:432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:14⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:14⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:14⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:14⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:84⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:14⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:14⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:14⤵PID:5280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:14⤵PID:5288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3647352972917130054,2007229473277218367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:3392
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4548
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5614b7f2de44141db3b3af13e024ad963
SHA1d381e7eb5c631f74fed0a36d6cf5c6d199f91924
SHA256aa6d2040ef5c8375c12a7e94eec382d94ca469248b07da83f1e1af1ba497fd6f
SHA5123527f8ad05f95217c9e93e5fe90a08f50fb566130d8bf41ff09875f66dd0a9b2ad95927ce433598431a32238fc13cb9b1fd05d5d0e63136ba74238cca2692f67
-
Filesize
1KB
MD5b3d275b82bac724d4d47101dc8a40817
SHA17369d885b84c366ca0262645319b2d033b758571
SHA256986ea3f0291c7790051c6a09fcf78589145c83d2fb03cdf0d97592e3e9d4a28c
SHA512769bd496a9dd12a1ec1cd24f689bbb957e21337957135bd1ca0a2b9ce3a4cc6b14e394be0c52d9c07e416a94e217002e87b72e7da05d994998848cffa2f1ff23
-
Filesize
6KB
MD5fb3bf09b0d621458d036318411926b48
SHA1ff976acf84a19bcd249d5c6c9b4d0b5c0a73a452
SHA25659adf4769d3e9763548bdb14af258689acbb32955fd259fbfab1f0f75def7d3c
SHA5123877473c606aeac95f3e452e93c58a626bb81340e8b65689dab79877a765c78acba65e75550418300a653283d5f9c603f3202e030d1108f08adbc5d7d1efcfd9
-
Filesize
5KB
MD52370d882512481ee7c551a9c3a852cb9
SHA14b1194b3ad94fff769b226c8b4e6043fa809410c
SHA256ea39cb43004252f7d3957357de7dfeb1d56de3882b0fe5b845cc10421faae430
SHA51246a1d392ec928742980702ddb65279eaec257c824f860f0c07b515cd04a074de3f6d61f93264a456015867d624aba2a5223affa5b4bcfed717607fd13152f74d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5aa7f84fb14d4b40b42327b644c15c02a
SHA16344fa4a2b7f1cacee3cc5631fdc9b866a0668cf
SHA256fdfaee157e885f1611a5503c4a072a1c6172d4198c9e412ca5760361a45c2c70
SHA5127821adc79cab4fe2ed2e13b3077c593cef00b8d68fc10cc78c437b9d38156b783cdc8deb8b08211e41b0d35dfb4163d98259611ca3f85d8c1d60e0aab253ef65
-
Filesize
11KB
MD56c4379543dd08753c5f3ed51bed11f31
SHA14008e5991e489f6b5d39bdd77674f27baf7ff66d
SHA256d5a87d67941cf44c05abc62f6748e6b3e3bec857f56854af50614559f8376936
SHA5129cfe2581d42a40bba5df94a8cda694ee21f5db4c1c2407b58a8e86d79e6f683a1d3193ff0143dea179f9b2a18184ed1d868efb398f5ed4ef02149cb649e889de