f646652723994218114d688def2e56f990a8efb100871b691b41ae4c41582176

Analysis

max time kernel
150s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/instsvc.bat
Size 2KB
Sample240605-2e4s8sag81
SHA256 b1f3b4370fa8e86d8d86a7ee5dbaccaff73f6fc2f04b5ff43205751d1c152918
MD5 21e90735471f64b9b71b37c7d8492574
SHA1 05a2effac79c01bcb1f3798b11b542c63588d51c
SHA512 f746d1fb930a77b36a3ffe8823abfcb8e7d81dbcd49e719e33ec82535a7464e4a0cb8df6b6ec5309e2bc7dab3dd21b02041bf88b668dad03c3578be1d2c7e053
MD5 SHA1 SHA512

Score

8^/10

discovery evasion upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 18 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1712	netsh.exe
2100	netsh.exe
5048	netsh.exe
4616	netsh.exe
4820	netsh.exe
5080	netsh.exe
3720	netsh.exe
744	netsh.exe
1340	netsh.exe
5044	netsh.exe
5036	netsh.exe
3232	netsh.exe
4608	netsh.exe
4976	netsh.exe
3008	netsh.exe
4360	netsh.exe
5052	netsh.exe
2400	netsh.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4320	icacls.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/3144-0-0x0000000000400000-0x000000000050A000-memory.dmp	upx
behavioral4/memory/3144-37-0x0000000000400000-0x000000000050A000-memory.dmp	upx
behavioral4/memory/3012-74-0x0000000000400000-0x000000000050A000-memory.dmp	upx
behavioral4/memory/3012-890-0x0000000000400000-0x000000000050A000-memory.dmp	upx

Runs net.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1712	1724	cmd.exe	84
PID 1724 wrote to memory of 1712	1724	cmd.exe	84
PID 1724 wrote to memory of 5080	1724	cmd.exe	85
PID 1724 wrote to memory of 5080	1724	cmd.exe	85
PID 1724 wrote to memory of 5044	1724	cmd.exe	86
PID 1724 wrote to memory of 5044	1724	cmd.exe	86
PID 1724 wrote to memory of 3008	1724	cmd.exe	87
PID 1724 wrote to memory of 3008	1724	cmd.exe	87
PID 1724 wrote to memory of 2100	1724	cmd.exe	88
PID 1724 wrote to memory of 2100	1724	cmd.exe	88
PID 1724 wrote to memory of 3720	1724	cmd.exe	89
PID 1724 wrote to memory of 3720	1724	cmd.exe	89
PID 1724 wrote to memory of 4360	1724	cmd.exe	92
PID 1724 wrote to memory of 4360	1724	cmd.exe	92
PID 1724 wrote to memory of 5052	1724	cmd.exe	93
PID 1724 wrote to memory of 5052	1724	cmd.exe	93
PID 1724 wrote to memory of 2400	1724	cmd.exe	96
PID 1724 wrote to memory of 2400	1724	cmd.exe	96
PID 1724 wrote to memory of 5048	1724	cmd.exe	97
PID 1724 wrote to memory of 5048	1724	cmd.exe	97
PID 1724 wrote to memory of 4616	1724	cmd.exe	98
PID 1724 wrote to memory of 4616	1724	cmd.exe	98
PID 1724 wrote to memory of 4820	1724	cmd.exe	99
PID 1724 wrote to memory of 4820	1724	cmd.exe	99
PID 1724 wrote to memory of 5036	1724	cmd.exe	100
PID 1724 wrote to memory of 5036	1724	cmd.exe	100
PID 1724 wrote to memory of 3232	1724	cmd.exe	101
PID 1724 wrote to memory of 3232	1724	cmd.exe	101
PID 1724 wrote to memory of 4608	1724	cmd.exe	102
PID 1724 wrote to memory of 4608	1724	cmd.exe	102
PID 1724 wrote to memory of 4976	1724	cmd.exe	104
PID 1724 wrote to memory of 4976	1724	cmd.exe	104
PID 1724 wrote to memory of 744	1724	cmd.exe	105
PID 1724 wrote to memory of 744	1724	cmd.exe	105
PID 1724 wrote to memory of 1340	1724	cmd.exe	106
PID 1724 wrote to memory of 1340	1724	cmd.exe	106
PID 1724 wrote to memory of 3144	1724	cmd.exe	107
PID 1724 wrote to memory of 3144	1724	cmd.exe	107
PID 1724 wrote to memory of 3144	1724	cmd.exe	107
PID 1724 wrote to memory of 1908	1724	cmd.exe	108
PID 1724 wrote to memory of 1908	1724	cmd.exe	108
PID 1908 wrote to memory of 4272	1908	net.exe	109
PID 1908 wrote to memory of 4272	1908	net.exe	109
PID 3012 wrote to memory of 2732	3012	nxwrapper.exe	111
PID 3012 wrote to memory of 2732	3012	nxwrapper.exe	111
PID 3012 wrote to memory of 2732	3012	nxwrapper.exe	111
PID 3012 wrote to memory of 4204	3012	nxwrapper.exe	113
PID 3012 wrote to memory of 4204	3012	nxwrapper.exe	113
PID 3012 wrote to memory of 4204	3012	nxwrapper.exe	113
PID 4204 wrote to memory of 1680	4204	cmd.exe	115
PID 4204 wrote to memory of 1680	4204	cmd.exe	115
PID 1680 wrote to memory of 4320	1680	java.exe	116
PID 1680 wrote to memory of 4320	1680	java.exe	116
PID 1680 wrote to memory of 2960	1680	java.exe	118
PID 1680 wrote to memory of 2960	1680	java.exe	118

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bin\instsvc.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_53_in
  2⤵
  - Modifies Windows Firewall
  PID:1712
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_80_in
  2⤵
  - Modifies Windows Firewall
  PID:5080
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_443_in
  2⤵
  - Modifies Windows Firewall
  PID:5044
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19002_in
  2⤵
  - Modifies Windows Firewall
  PID:3008
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19003_in
  2⤵
  - Modifies Windows Firewall
  PID:2100
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19004_in
  2⤵
  - Modifies Windows Firewall
  PID:3720
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19003_out
  2⤵
  - Modifies Windows Firewall
  PID:4360
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_19004_out
  2⤵
  - Modifies Windows Firewall
  PID:5052
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=NxFilter_1813_in
  2⤵
  - Modifies Windows Firewall
  PID:2400
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_53_in protocol=UDP dir=in localport=53 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:5048
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_80_in protocol=TCP dir=in localport=80 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:4616
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_443_in protocol=TCP dir=in localport=443 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:4820
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19002_in protocol=TCP dir=in localport=19002 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:5036
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19003_in protocol=TCP dir=in localport=19003 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:3232
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19004_in protocol=TCP dir=in localport=19004 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:4608
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19003_out protocol=TCP dir=out remoteport=19003 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:4976
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_19004_out protocol=TCP dir=out remoteport=19004 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:744
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=NxFilter_1813_in protocol=UDP dir=in localport=1813 action=allow
  2⤵
  - Modifies Windows Firewall
  PID:1340
- C:\Users\Admin\AppData\Local\Temp\nxwrapper.exe
  nxwrapper.exe --startup=auto install
  2⤵
  PID:3144
- C:\Windows\system32\net.exe
  net start NxFilter
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start NxFilter
    3⤵
    PID:4272

C:\Users\Admin\AppData\Local\Temp\nxwrapper.exe
"C:\Users\Admin\AppData\Local\Temp\nxwrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %PATH%
  2⤵
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:/Users/Admin/AppData/Local/Temp/bin/startup.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -Djava.net.preferIPv4Stack=true -Xmx768m -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.Main
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      4⤵
      Modifies file permissions
      PID:4320
  - - C:\Windows\System32\hostname.exe
      hostname
      4⤵
      PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 2386d15c79b84cda7016a964d83f240309aed6a8ce0c328c1659202430d1055f
MD5 0127f6f62ea596c5d8ae1a993d3c4ba7
SHA1 0d9b96e23f72a8b00ba2d2b6d873380e956b69ed
SHA512 4fbd9064182bf1b6fa5c908b16df7e71c11678161370d9c73def53dd83f17aba1f76a58804986be4d15f5d5064ee0b643bf2fb8ab1e333657502d515926fd3a1
MD5 SHA1 SHA512

Submit Download

log4j.properties

Path C:\Users\Admin\AppData\Local\Temp\conf\log4j.properties
Size 565B
SHA256 9626eae07344b24ec72a8f03c0880aa3ea8dde7c151662c073af7a75af23a515
MD5 2cb6dc24f14acc5be37bb612f5438f09
SHA1 6c926e0ade43880a36ba2e26cf5b517e7721ac7e
SHA512 b1e581ee0d5acddc48c2ed6a677cc843b4fd471d671a436e58959b722252f18bd1e97d2d69342213820dd847cb458e29d9c1719e8b8d4c157f50520d53901ba4
MD5 SHA1 SHA512

Submit Download

blacklist.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\blacklist.lock.db
Size 103B
SHA256 9ee84e97202df9347df710e29d2283ec36a3cab87c5211f6965bec874e330926
MD5 951756b0ac28d5d55473f0a6bf25c970
SHA1 5de7b38d55fe681f8d75a9c13d1f397314ffcd2a
SHA512 4fc1a6f09ae824509d7c3322fe53b528552886aabcd7586d20e2e5e1c9c44fd411ba215e21c34a893058098af368dae06d915b67b5d4ef1e436c8e0d86636768
MD5 SHA1 SHA512

Submit Download

blacklist.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\blacklist.lock.db
Size 103B
SHA256 f41bda40e8494a770a51816fc9a807f9ebfd0234f86e0c6093f4f8d7470acaee
MD5 a6cfc451e5712190bc6d38879bd5d4e8
SHA1 51a8fda278001a39466c5250665c33cdd59c6fcc
SHA512 feb3f4b391281a2d33fc35803ba05fbf4595745ff0e8968bc7124213d838debeaa0c62b2b09937f11fc3251078587a34fc6fa10fb31620efc76e5181fbdce040
MD5 SHA1 SHA512

Submit Download

config.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\config.lock.db
Size 103B
SHA256 315d2657e7413e3f570ca09771417fa96c2542a4be727e5e86d18624b1272963
MD5 290c08d8768ba339ba07f8a8f3e9085a
SHA1 7bea941f41ed18a9803d674462b4af3a7d999259
SHA512 0150fcdcc5a9869430230d6cc5469d95f7f15dfbac203b9a161609e3db0ca9b4c4ee894752506500cecc8239a0e72b651f97051469b056bffb71dfa9bbffbf3f
MD5 SHA1 SHA512

Submit Download

config.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\config.lock.db
Size 103B
SHA256 66643f8df851601048846f9d368bf6e72f8bdd6720f2c7e6f32fd4b6229d6af8
MD5 e1d91c41d9b00214974dd66673698d2b
SHA1 f0bd465f8ce6449d9d92139b103b330716e28aeb
SHA512 07877676ccc2913230f40fb8e363028b3978cfd7e153268ae2357a94203ce40910be01a6fda86fe8340c2b9dbca8caa4cd7302514b7dbe6f7a0ecd2551e3f153
MD5 SHA1 SHA512

Submit Download

config.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\config.lock.db
Size 103B
SHA256 1aabc75b45c849ae0f500dedc397eae0d9c65b400fea09d840ddc610c2049dd1
MD5 9676bcf90d7fe4eccd3afece5ee221d9
SHA1 b352268a6dc46ee05e848df9d983b8eb7b4639ca
SHA512 5cb6803d07831be53bf1f1727cc76091f6461370b921493ffe2c0423a7c969bc038e5f92184e58f5dff12956b85f27e04e2e8537c81c18e32d3f76fb6b252a98
MD5 SHA1 SHA512

Submit Download

jahaslist.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\jahaslist.lock.db
Size 103B
SHA256 2f944dea5523e4a63a52993bf6110ffa6136d4f8c21ffbc1b4388c73fb8eba95
MD5 8e563dd1cc1f454ec41eeddf962dcdca
SHA1 ce527369b39ab761606231a0a15922e8f392d35e
SHA512 d3748c946f0b3808b617506ffbccb8507dff29ff61765ba86bc26766482ac170559455a9b36c0cb960de07950ceaf6655ebdaa253f2a94a2e4368e8c86d65d5d
MD5 SHA1 SHA512

Submit Download

jahaslist.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\jahaslist.lock.db
Size 103B
SHA256 61778e2ed9cdc066247b6033f83e92b382dd0b0ee2d547297193fa6715424fa2
MD5 94ad11ff8b5435f6c9b9e27eede5e1ee
SHA1 ae357885ea8e9f0201b792d92f19039315194f08
SHA512 0d0142be9c12f15b5ddc84730d3609a5fbdf5e7e827a04a8edf1667bfaae2b6f497e26b157acbf482945d293ac8550124238f290da84ecf7a2ad2dcad78228d9
MD5 SHA1 SHA512

Submit Download

jahaslist.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\jahaslist.lock.db
Size 103B
SHA256 a62467653be4408faa1bb50d232519a83f01f7c33ea0b7993b001a2c1f9c8aef
MD5 c45a891b257c114545c8197707f3a756
SHA1 8787199f0d9b282f305b641dee651bc79702d4c2
SHA512 819fab4663fbd67d0753e978257d375370dd1610ddf3f7def23abbb91f715373c7c5d5d2668fb02016cc99c77d1b1890444c1a6b4e1a47ef3557e60417c5f73c
MD5 SHA1 SHA512

Submit Download

komcache.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\komcache.lock.db
Size 103B
SHA256 51601075359ce1c437ccde52955b011f23df9479e80fa4f33946f9ef91d44644
MD5 998bbbd84bf928964af122f341270d96
SHA1 225c9a7537197266d44b49d918b626478b164411
SHA512 aa3b76615c2537399a97c4c19ff9fe6c9a535e37174e0465cc61a37994fc69aa98baaa51df58696d55ec025c245abd34eec3923606a46653f21e76a981b3a55f
MD5 SHA1 SHA512

Submit Download

komcache.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\komcache.lock.db
Size 103B
SHA256 f1870ef1e72c26363add17a643913883aeefbd29bed65848c1891b2c3bac1aac
MD5 67bbca4f278de7f9a074e9426b4d8c2b
SHA1 891d0e5e39315cfb2e9a44634d1a7827fefbcf35
SHA512 bef0ecfaf375acfb1862410ae47bca88701713fae8abe3ebb16c5b5e356c08ef5e88f0623d838c57e81855c121b2a5e8fc78c924ed682efacb6e5562584415ab
MD5 SHA1 SHA512

Submit Download

komcache.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\komcache.lock.db
Size 103B
SHA256 d3a457c2ae9f41c4b092a6c2cb42222ee5e627962125bd36749f151f45edb9b9
MD5 cfc1339e5bb677fe4b6e41a31e3ba879
SHA1 4e5d1729a2f3afc225cffd4437ce94d8da7446a4
SHA512 b5828be3ef6117dccd6322f1d36ff001a879d35c6e692e6e1b8fc6c473e0e8e142cbab0ef91937566c65a3b669faf530fa17d744be9399bfd24c8b3246ef498c
MD5 SHA1 SHA512

Submit Download

local.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\local.lock.db
Size 103B
SHA256 978f44877b78bed6f2d28dd6456c70b9c4695c46d752e11fe2c12b1d4c775e6b
MD5 3b83d3064fedde5fee3540a431422c8a
SHA1 781d80818b0fd3bf7cb2f8825a8e0f1b48c743d5
SHA512 d427f8ba91313b957c83f502c472ac5ffa4f429f1dea9539bcd1e82fd35dd1ecb56a3ebe0ed33671f21153cc1c8c4d60acc8a8b8a374e36c4ac20647dd2eb463
MD5 SHA1 SHA512

Submit Download

local.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\local.lock.db
Size 103B
SHA256 ffb75a943a307e1e1c0f10def1681736640106b953cc31ba4d3127f7d74b015b
MD5 3c558aaa36921ed7d73dd9cd490e1554
SHA1 1c0967cc3e0e7ccf75d931f2b7739d712fd22958
SHA512 b92678b88e43865dbf4f292252a17ebe78b76f1499d983086c22fa131ca6af69ae33b817691a49acd72ca2ceaf65a49ef3e1da1bdef1a1ad4e497a95c51ede34
MD5 SHA1 SHA512

Submit Download

local.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\local.lock.db
Size 103B
SHA256 711e7bcd4e19508e799c004b93380ae2a6b075cec4f9f927ff4ba9e33b91c1d3
MD5 18a2b80341794f664265b2ee4f9ec10b
SHA1 6fbd97e99d7c664006222eda4b0454b6e8c5015a
SHA512 07a9b94f912cd489d3a908ff284238fd4b61f3a18fff31a8427d4aabda0485f68260d76656321a74302261f65280052b8d0da7405f8757ad525d719684c3df9f
MD5 SHA1 SHA512

Submit Download

pstcache.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\pstcache.lock.db
Size 103B
SHA256 f086c1122d96fd9f0441d8d0f3c9f2fa367efee1553ceb95be781f65d181b0c0
MD5 a9cc16af4d9d13133c8a38ce4b8eb8f1
SHA1 2147620bbbb8db61af38a2b553b67f2a0b7bad77
SHA512 4310dbee048027192d93ceb7dfda42e61fc0c6ea3c51eaa6866d43672b0991feb0437074b39f58822a9ebbf1d5e144c5633d0cc42b8eadd9b18ba50da7bca763
MD5 SHA1 SHA512

Submit Download

pstcache.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\pstcache.lock.db
Size 103B
SHA256 62bde7caba3efc61416f81669db38b8f3393cc4865086cceb2b73cbfb3574fdf
MD5 e2aad5ef0320e9076abe4d88a6d54d10
SHA1 2ba1025f14dd385a9e1db2b4a974c5cbb0f677b5
SHA512 cbcee6fb078709a59bd7f09b14913c9125c1877a5948bab3c64a122814b7996aeb0d0e7d11280aafead689275f68c80b7633679b23ad9487653f4d3f4cc8a457
MD5 SHA1 SHA512

Submit Download

pstcache.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\pstcache.lock.db
Size 103B
SHA256 6b5c2279cae192bb3b7a6d69d4eb0b26a2e274a36a47b5af3ee0324c4f500508
MD5 f7e4cb70640793d60f7b697bb84b9f2c
SHA1 21e62f1564d03c1b7299d96d69062add128b5cd2
SHA512 da9092c2343ec20d2fed5827e386c16381ef9b691c260488db3860b2e3eef31ecc01f927002bfd72b7089a70df91ff4032248a2ab565e1d81e573df4bc5107c6
MD5 SHA1 SHA512

Submit Download

traffic.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\traffic.lock.db
Size 103B
SHA256 f7a58cc74430edd006bdc025872b52c6f1e656779169f779cf4d5f4eed7508d7
MD5 bb13402e25172e34836ac2e4281e4524
SHA1 a5a8947f8eb67b5272d988854353856e2c9d2f2b
SHA512 abec7b53423c37e0196b46284bdfe731be910f48ee00e711c33bef164a101318815ab37607bda4c2097cfe7e151ea68f65cecc926af04201e041bebc33cea383
MD5 SHA1 SHA512

Submit Download

traffic.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\traffic.lock.db
Size 103B
SHA256 c85c9961d08d81e6496cd69b1a284d3642a6189505cb07f63b4e0eccae354ae0
MD5 9a5400e2ec6a5f03bb062fcca7577e08
SHA1 7270864b283bccd3145667d390a2981aeac9b589
SHA512 baee5e1a989f52a469b0a02a6977c6e0c65503ade1a4b5f84abc3f6e5e97b517b41b1764968ba58e2316fce61f6502959629e02cadd6a45293a76df7eab731df
MD5 SHA1 SHA512

Submit Download

traffic.lock.db

Path C:\Users\Admin\AppData\Local\Temp\db\traffic.lock.db
Size 103B
SHA256 686065b293bd009bae70a3d615ccabf08d0e641f46d6aa9eb810bee41528fe35
MD5 d601e43f9337f33d62d011313f5dad49
SHA1 635f2864e7ba06e9e904496e17df889b0df32036
SHA512 f0328694789f569909ca1dcb39b1a3ebb750464b4aeac6b527a6d0453f80f794970c666e5c2a9fa56373d26bb827f0d5f94956d38576bf1dd48420be0e3c70a5
MD5 SHA1 SHA512

Submit Download

memory/3012-57-0x000000001E8C0000-0x000000001E8DA000-memory.dmp

Download

memory/3012-890-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3012-74-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3144-24-0x000000001E9B0000-0x000000001E9B7000-memory.dmp

Download

memory/3144-16-0x000000001ECB0000-0x000000001ECBD000-memory.dmp

Download

memory/3144-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3144-12-0x000000001E7D0000-0x000000001E7D9000-memory.dmp

Download

memory/3144-28-0x000000001E1E0000-0x000000001E1EE000-memory.dmp

Download

memory/3144-34-0x000000001E1D0000-0x000000001E1DC000-memory.dmp

Download

memory/3144-31-0x0000000010000000-0x0000000010016000-memory.dmp

Download

memory/3144-20-0x000000001E8C0000-0x000000001E8DA000-memory.dmp

Download

memory/3144-8-0x000000001E7A0000-0x000000001E7BE000-memory.dmp

Download

memory/3144-2-0x000000001E000000-0x000000001E0F1000-memory.dmp

Download

memory/3144-5-0x000000001E1B0000-0x000000001E1BF000-memory.dmp

Download

memory/3144-37-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads