netwire | 1b6d07883242bc16fa0f2ecdbb7fd6abae89f244f66c1a32d9fd8b3f3c3d3661

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe
Size

831KB
MD5

484014cfcb70a39296ca04415f71a750
SHA1

f6437e2a1834dd687316821df0dca7c3e523f36b
SHA256

1b6d07883242bc16fa0f2ecdbb7fd6abae89f244f66c1a32d9fd8b3f3c3d3661
SHA512

0fa2e906065e2731e12c1880c2b321d3082f6157eefc2f138f4907389b8d9b789505a83d9a204152139b9283ea6328e8e83c254ec8379eb024649aee0c7d4302
SSDEEP

12288:OYk+mQo8BdbrQ0Fl92VT7twWQldCMoAODEcl3/8fuboF5Q:OY5mstrfb+7tBqsMwEclPegoF5

Score

10^/10

netwire botnet rat stealer upx

Malware Config

Extracted

Family

netwire

185.140.53.212:3380

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/2224-11-0x0000000000400000-0x0000000000423000-memory.dmp	netwire
behavioral1/memory/2224-14-0x0000000000400000-0x0000000000423000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-6-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2224-10-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2224-11-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2224-14-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\.Identifier	svchost.exe
File opened for modification	C:\Windows\SysWOW64\.Identifier	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2856 set thread context of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe
2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2408	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2408	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2408	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2408	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	28
PID 2856 wrote to memory of 772	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	30
PID 2856 wrote to memory of 772	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	30
PID 2856 wrote to memory of 772	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	30
PID 2856 wrote to memory of 772	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	30
PID 2856 wrote to memory of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2224	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	32
PID 2856 wrote to memory of 1296	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	33
PID 2856 wrote to memory of 1296	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	33
PID 2856 wrote to memory of 1296	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	33
PID 2856 wrote to memory of 1296	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	33
PID 2856 wrote to memory of 2660	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2660	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2660	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2660	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2692	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	37
PID 2856 wrote to memory of 2692	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	37
PID 2856 wrote to memory of 2692	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	37
PID 2856 wrote to memory of 2692	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	37
PID 2856 wrote to memory of 2732	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2732	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2732	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2732	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2780	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	41
PID 2856 wrote to memory of 2780	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	41
PID 2856 wrote to memory of 2780	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	41
PID 2856 wrote to memory of 2780	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	41
PID 2856 wrote to memory of 2480	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	43
PID 2856 wrote to memory of 2480	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	43
PID 2856 wrote to memory of 2480	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	43
PID 2856 wrote to memory of 2480	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	43
PID 2856 wrote to memory of 2508	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	45
PID 2856 wrote to memory of 2508	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	45
PID 2856 wrote to memory of 2508	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	45
PID 2856 wrote to memory of 2508	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	45
PID 2856 wrote to memory of 2456	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	47
PID 2856 wrote to memory of 2456	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	47
PID 2856 wrote to memory of 2456	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	47
PID 2856 wrote to memory of 2456	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	47
PID 2856 wrote to memory of 2200	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	49
PID 2856 wrote to memory of 2200	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	49
PID 2856 wrote to memory of 2200	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	49
PID 2856 wrote to memory of 2200	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	49
PID 2856 wrote to memory of 2884	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	51
PID 2856 wrote to memory of 2884	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	51
PID 2856 wrote to memory of 2884	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	51
PID 2856 wrote to memory of 2884	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	51
PID 2856 wrote to memory of 2892	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	53
PID 2856 wrote to memory of 2892	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	53
PID 2856 wrote to memory of 2892	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	53
PID 2856 wrote to memory of 2892	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	53
PID 2856 wrote to memory of 2320	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	55
PID 2856 wrote to memory of 2320	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	55
PID 2856 wrote to memory of 2320	2856	484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe	55

C:\Users\Admin\AppData\Local\Temp\484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:772
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\484014cfcb70a39296ca04415f71a750_JaffaCakes118.exe "
  2⤵
  - Drops file in System32 directory
  PID:2224
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1296
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2480
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2456
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2200
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2884
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:332
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2000
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:344
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1028
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2120
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2812
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:384
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:324
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2404
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:584
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:844
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1192
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1652
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:704
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3052
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:948
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2180
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2804
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1512
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2628
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2464
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2192
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1892
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2872
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2960
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:628
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:880
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1760
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1252
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:344
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1584
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2300
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2064
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1428
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:780
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1004
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1380
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3012
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1548
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1772
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:864
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1044
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2080
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1572
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1028
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2804
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2764
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1808
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2496
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2448
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2516
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2752
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2456
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1156
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:868
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:304
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2680
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1420
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1580
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:344
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1428
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1644
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:608
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1908
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1544
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3000
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1192
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:912
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:932
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:704
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2088
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:864
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1846417707.xml

Filesize
1KB

MD5
e27c5bfd7a9b6a50325cb3dd45df0adc

SHA1
dc986b46c1fa4587d46baa4baa2fc9c86dc5d387

SHA256
50f3b17199c2fa931bdf12e5f166fa30501e2682f63614292c99949cb0153732

SHA512
8de4cf38d102e7599ade4e9d876287a6d01194423dbe48b60a60dbf11313c3a585fcef8ece2cc44a3d896df6605e2ef8d131e8ca2e4c94d10f4e3ce058bead47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update.txt

Filesize
94B

MD5
a47ad731208af0f276d7a8802bab01f5

SHA1
faf347c81b594085a009399d3883fa8a20eee319

SHA256
d661a2aee5e6e64f31a8dbd94817b450dcfe1f9df4190ea1b5848ad549fc6102

SHA512
c7093b87ee357da43aca38e5e4b110bff70eee75fbd3ba53e4039487dccb784b84e2f551ddaf19d30d1c6e8547dd532101be9e3cc48f00b6109ab5da775f5f30

Download Submit
memory/2224-6-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2224-10-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2224-11-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2224-14-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2856-0-0x0000000074B61000-0x0000000074B62000-memory.dmp

Filesize
4KB

Download
memory/2856-1-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/2856-2-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/2856-46-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download