Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
3113c057abc2bc8815ade3e4b58299c1
-
SHA1
42cffb1729d57b6da72a97042105d1ae53d5fd7f
-
SHA256
84e16e5329c9d815487aa7816343e8ce69a79f32cb5a9e91cf72be634445a4a3
-
SHA512
ff7cd55707c8b25a886e1bb374d231a60fef58e670c5880a525bdba10fe6bfc0e492542048a5b64688d7095cae2e6b2adec7882a4512e1e0096e844568b9a19b
-
SSDEEP
24576:frJKUK/juqkncxnfS//2oYP+ENxuIW/Rjl/lVlP64htKQtsVELVDiicYQRebMyHz:f1Kb/juqgcxfSE+HIuRjl/lVlP64htKB
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1044 crp9F3E.exe 1872 hpet.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hahpjplbmicfkmoccokbjejahjjpnena\1.2_0\manifest.json hpet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crp9F3E.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpet.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page Before = "http://go.microsoft.com/fwlink/p/?LinkId=255141" hpet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page Before = "http://go.microsoft.com/fwlink/?LinkId=54896" hpet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://search.b1.org/?bsrc=hmior&chid=c162341" hpet.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://search.b1.org/?bsrc=hmior&chid=c162341" hpet.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1872 hpet.exe 1872 hpet.exe 1872 hpet.exe 1872 hpet.exe 1872 hpet.exe 1872 hpet.exe 1872 hpet.exe 1872 hpet.exe 1872 hpet.exe 1872 hpet.exe 1704 msedge.exe 1704 msedge.exe 2676 msedge.exe 2676 msedge.exe 400 identity_helper.exe 400 identity_helper.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 1044 crp9F3E.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 384 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 1044 crp9F3E.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 1044 crp9F3E.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe 1044 crp9F3E.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1044 crp9F3E.exe 1044 crp9F3E.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 384 wrote to memory of 1044 384 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe 86 PID 384 wrote to memory of 1044 384 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe 86 PID 384 wrote to memory of 1044 384 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe 86 PID 384 wrote to memory of 1872 384 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe 87 PID 384 wrote to memory of 1872 384 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe 87 PID 384 wrote to memory of 1872 384 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe 87 PID 384 wrote to memory of 2676 384 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe 91 PID 384 wrote to memory of 2676 384 3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe 91 PID 2676 wrote to memory of 3604 2676 msedge.exe 92 PID 2676 wrote to memory of 3604 2676 msedge.exe 92 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 2344 2676 msedge.exe 93 PID 2676 wrote to memory of 1704 2676 msedge.exe 94 PID 2676 wrote to memory of 1704 2676 msedge.exe 94 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95 PID 2676 wrote to memory of 3596 2676 msedge.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3113c057abc2bc8815ade3e4b58299c1_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\crp9F3E.exe/S /notray2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1044
-
-
C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe-home -home2 -hie -hff -hgc -spff -et -channel 1623412⤵
- Executes dropped EXE
- Drops Chrome extension
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.4shared.com/mp3/zm9gkCbm/04-musketeers_-_.html?ref=downloadhelpererror2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5d0b46f8,0x7ffb5d0b4708,0x7ffb5d0b47183⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:23⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:83⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:13⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:13⤵PID:2128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:83⤵PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:13⤵PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:13⤵PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:13⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:13⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,6919153720692794937,11842639409301788780,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2348
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3564
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2380
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
6KB
MD563fb5cafbcff762c455896688ef0b834
SHA1b22d860962508b464f15bf3067d227e7ff640bb6
SHA25617e04f10cb0e8027153d8703c67a50a51eb66529b01374cb29321bd15c9498b3
SHA5127e5d449a4db33bc002cfbce86dfc7040e1b1081a8b185eafd84bc421c17ea16167a18c4e649cd380bcebd26f133296f12de5462a48a9402e06362ce7c0d0ee89
-
Filesize
6KB
MD5999579e54883c674f84f3afa40fdd481
SHA14568b5e6f45c823452ede1d9c1cc819e0d56a5a6
SHA256d6aef514313f9440bd5e7b283ea12b07bc8ee9d55493fbe38dc2dc986f4338ec
SHA51201af4c79ca490795cc44690f2f77e93d9b80e0ad57ffea00c8d23385d7a51a449b7a3158ad4194eafc642059b956c5d4b1935ec35e35340aa557ae289389fc3d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5bde4702f94903c9663a00bd0a9c57d1a
SHA101040cfc3966b9022a89ea22dc2f5d5a2e2dc76d
SHA256371f9d29ac22871d2976ce5591adb81cd2332a806e4603bf5c4e03327c34f530
SHA5125ed314ac0f2f0167a176332a987e2e8c0ca5d3bb70db2fc51c164548879101216f4ed6e1e53a533e415e97be521d0d7abe416a3462fb2d1e06fd155cd64f30a5
-
Filesize
806KB
MD5661cf9c90eb099fb7b6a394dd8cde2e4
SHA13704e119ea16a3c336f63dc808176a22fbb8582a
SHA2561570e0efe0cb98623913d942cf40f2eb5b10458f49842097125c6d6d8604cd07
SHA51213c26a514c2022a10b42566a527ef98adaaa9932ffd07612ccdeb371888c037be3b429c956ecb7705699a2b6e3463758735332c9e26ea5f4493a91f30dfb4761
-
Filesize
331KB
MD5a3e93460c26e27a69594dc44eb58e678
SHA1a615a8a12aa4e01c2197f4f0d78605a75979a048
SHA2563a81cefbc928fe136056257b8b57733164f2d1fa9d944dc02897b31b171335c6
SHA51239d17b7190f3ff5b3bc3170c8e21d7bba5c32c0f55bd372af2e848ff1ef1392083218a562f3361fdc2db95e4133a19c4ec1cab3e982174d76b8276358dac6530