Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
33db7812804...18.exe
windows7-x64
73db7812804...18.exe
windows10-2004-x64
7$PLUGINSDI...RL.dll
windows7-x64
3$PLUGINSDI...RL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
3db78128049e25309474111aa36684c1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3db78128049e25309474111aa36684c1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BrandingURL.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BrandingURL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
General
-
Target
3db78128049e25309474111aa36684c1_JaffaCakes118.exe
-
Size
488KB
-
MD5
3db78128049e25309474111aa36684c1
-
SHA1
f24dfb961b104caae6845c8d215be64540f37420
-
SHA256
a5dda9a6508e2f730d74d21ad8b4a0677f927a4ba8acfdf3afaab58980fc5452
-
SHA512
25e00c8cbd61b9a6dd45773dd9208bc8450ebf772cd2788594781287436344e4fd258f22ae7c5d2b947c17bd3c210adc8d2339a6f40985cfd14bcac46e07657c
-
SSDEEP
6144:qe34R2pXczh36dqXEVTrnCRZG/t7FTBqTzP7n7O7L6K2Bfo7pi:02Szh36VVTGf0ZTsnz7O7L6ju7pi
Malware Config
Signatures
-
Loads dropped DLL 13 IoCs
pid Process 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3db78128049e25309474111aa36684c1_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1732 msedge.exe 1732 msedge.exe 4916 msedge.exe 4916 msedge.exe 1984 identity_helper.exe 1984 identity_helper.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 4916 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 86 PID 4712 wrote to memory of 4916 4712 3db78128049e25309474111aa36684c1_JaffaCakes118.exe 86 PID 4916 wrote to memory of 3864 4916 msedge.exe 87 PID 4916 wrote to memory of 3864 4916 msedge.exe 87 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 4628 4916 msedge.exe 88 PID 4916 wrote to memory of 1732 4916 msedge.exe 89 PID 4916 wrote to memory of 1732 4916 msedge.exe 89 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90 PID 4916 wrote to memory of 4696 4916 msedge.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\3db78128049e25309474111aa36684c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3db78128049e25309474111aa36684c1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pf.toggle.com/s/2/7/27495-248663-panda-antivirus-firewall.exe?iv=2012100720&t=17287927582⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93e5d46f8,0x7ff93e5d4708,0x7ff93e5d47183⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:23⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:83⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:13⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:13⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:13⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:83⤵PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:13⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:13⤵PID:1168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:13⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:13⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2764 /prefetch:13⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:13⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16289770333158921323,1718346457698456126,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5680 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3608
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1676
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e443ee4336fcf13c698b8ab5f3c173d0
SHA19bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA25679e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
-
Filesize
152B
MD556a4f78e21616a6e19da57228569489b
SHA121bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
-
Filesize
6KB
MD5031d575ccdebc0f001cbb4280faf4435
SHA13022fb1b3f93549e1a2f4354c8a5cc6b2dba31c4
SHA25634979089870ec203b2fd2195081729a57ab8744745c08925be2e41b89a5d2a86
SHA51231c0fbfec7d6822fbc7f7f6f2780a6b21d14441b140643ff1619702ce87f44919ee0ce40a16030de002508786360868a7d551a1495e876f253b14a3abbefea52
-
Filesize
6KB
MD5dec5b7165252510664df2ade6956ffb9
SHA108ac05683f0229ec6e426b0fdd01e402a6966484
SHA256ca2142d0a5a4b674f351d151dc166bf85f849b62c5f1e823e9092dfbc86d1fd0
SHA512f1e598f7e76414b05182254d2aab039706b79274bd2a4f483dee81f8ea3b17e9379e03d427915ad54590cc47acbcc06aec9dad86314e4939ee0e876ffd0107e4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d07aa2d05cc581933eddd4f6f4b1df91
SHA15ec6bfea269f24a767af0a3fe8db7ed3d7fb4fa7
SHA2562e15e44abf06f7727a23affc2d46944450846f5d3677b6b4f3a5fda7ed13c64a
SHA512faba5d3a143c6e354a55402271aa069127b78d5536907f006ad5beb71d5545b153914325af93c9c3ba8f003279f8799fa1cca1a46beebcdcb9493dc3f71b16e8
-
Filesize
4KB
MD571c46b663baa92ad941388d082af97e7
SHA15a9fcce065366a526d75cc5ded9aade7cadd6421
SHA256bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
SHA5125965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
5KB
MD59384f4007c492d4fa040924f31c00166
SHA1aba37faef30d7c445584c688a0b5638f5db31c7b
SHA25660a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA51268f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
17KB
MD509caf01bc8d88eeb733abc161acff659
SHA1b8c2126d641f88628c632dd2259686da3776a6da
SHA2563555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
SHA512ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
412B
MD5bb4f3904a34b2b5d1a6426231bd342f4
SHA187eaf2b2d4f0928c6f9f46c6069a39710c058ce8
SHA256c4a0baee293bccf8067f690d3d8d1817dd0f163c1cba270ea76612b79c8480ad
SHA51209ea37d1b7ad736efc011fe40c69a9be7a64d4a3e0b1091c4e16716abce354c447df25abc72d7de32e6a5a8179281357c8604fae19593b82eec0178f83664f38
-
Filesize
1KB
MD5dbd9c23f7eecfa76afd6792a38ed098d
SHA10b0d918c6c1ef13e14311214fc335edea6394c36
SHA2568dd1f5b8c8ff1256493699785229d4fc90590f99d22caf7e97be5cb5c8c3dd4e
SHA51294bb62689f976e81ddceb2a206f238877abbdfcc9cbdac2fe44d4108fd26a8a41b0b57f958027b661305dbc0b940d3f9ec9b117bb691aab8fd3d2f7a04ac0f07
-
Filesize
940B
MD5b66e7fdd84c4e2db3580a9602ae8ddc7
SHA1e037728865af4babe5cf45e227ba5c89b644f963
SHA25601378dfc6a99d4341a56d597ab584eb13d46629c73c6cec1e4f02ff449f5823a
SHA512994d65cb43e3b02b00cfbf3050307f9462ef6011cd97dc660defec97de6a22846ca91ebe3df9f71c5735f105eaf7686988f6ec761fde131816aaa4aaf883bcb2