Analysis
-
max time kernel
165s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 12:40
Static task
static1
Behavioral task
behavioral1
Sample
c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe
Resource
win10v2004-20220812-en
General
-
Target
c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe
-
Size
116KB
-
MD5
5d5267d68e5210c35cd6fd82cba6ab22
-
SHA1
b27b5b222bd9dcb471ecfdde387b995de1e1fb5b
-
SHA256
c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8
-
SHA512
468be95b63fb1bbe8725a63fc0380aa54dfc6f7e56c9e30b809547f61dafba7dad035eff4e1d31ee95b3500fcecfe327fc7ffe4204036604cbaf64d944cbaa34
-
SSDEEP
3072:2HejYMZvf/wfPv4B3JNVlLeqEDdHKgVx:psawf34BrrenDdqgVx
Malware Config
Signatures
-
Executes dropped EXE 11 IoCs
Processes:
c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exeiptables.exeiptablex.exeiptablex.exeiptables.exeiptables.exeiptablex.exeiptables.exeiptables.exeiptablex.exeiptablex.exepid process 4056 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe 5052 iptables.exe 3464 iptablex.exe 4792 iptablex.exe 5008 iptables.exe 4072 iptables.exe 4092 iptablex.exe 2316 iptables.exe 1412 iptables.exe 4316 iptablex.exe 1580 iptablex.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exec22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe -
Drops file in System32 directory 8 IoCs
Processes:
c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exeiptablex.exeiptables.exeiptables.exeiptablex.exec22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\iptablex.exe c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe File created \??\c:\windows\SysWOW64\iptablex.exe iptablex.exe File created \??\c:\windows\SysWOW64\iptables.exe iptables.exe File created \??\c:\windows\SysWOW64\iptables.exe iptables.exe File created \??\c:\windows\SysWOW64\iptablex.exe iptablex.exe File created \??\c:\windows\SysWOW64\iptables.exe c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe File opened for modification \??\c:\windows\SysWOW64\iptables.exe c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe File created \??\c:\windows\SysWOW64\iptablex.exe c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 20 IoCs
Processes:
iptablex.exeiptablex.exeiptables.exeiptables.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" iptablex.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" iptablex.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" iptablex.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ iptables.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" iptables.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ iptablex.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" iptablex.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" iptables.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" iptables.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" iptablex.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ iptables.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" iptablex.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" iptables.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ iptablex.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" iptablex.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" iptables.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" iptables.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" iptablex.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" iptables.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" iptables.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exec22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exeiptablex.exeiptables.exeiptablex.exeiptables.exeiptables.exeiptablex.exeiptables.exeiptables.exeiptablex.exeiptablex.exepid process 440 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe 440 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe 4056 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe 4056 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe 3464 iptablex.exe 3464 iptablex.exe 5052 iptables.exe 5052 iptables.exe 4792 iptablex.exe 5008 iptables.exe 5008 iptables.exe 4792 iptablex.exe 4072 iptables.exe 4072 iptables.exe 4092 iptablex.exe 4092 iptablex.exe 2316 iptables.exe 2316 iptables.exe 1412 iptables.exe 1412 iptables.exe 4316 iptablex.exe 4316 iptablex.exe 1580 iptablex.exe 1580 iptablex.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeiptables.exeiptablex.exeiptables.exeiptablex.exec22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exedescription pid process target process PID 440 wrote to memory of 4056 440 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe PID 440 wrote to memory of 4056 440 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe PID 440 wrote to memory of 4056 440 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe PID 5052 wrote to memory of 5008 5052 iptables.exe iptables.exe PID 5052 wrote to memory of 5008 5052 iptables.exe iptables.exe PID 5052 wrote to memory of 5008 5052 iptables.exe iptables.exe PID 3464 wrote to memory of 4792 3464 iptablex.exe iptablex.exe PID 3464 wrote to memory of 4792 3464 iptablex.exe iptablex.exe PID 3464 wrote to memory of 4792 3464 iptablex.exe iptablex.exe PID 4072 wrote to memory of 2316 4072 iptables.exe iptables.exe PID 4072 wrote to memory of 2316 4072 iptables.exe iptables.exe PID 4072 wrote to memory of 2316 4072 iptables.exe iptables.exe PID 440 wrote to memory of 1412 440 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe iptables.exe PID 440 wrote to memory of 1412 440 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe iptables.exe PID 440 wrote to memory of 1412 440 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe iptables.exe PID 4092 wrote to memory of 4316 4092 iptablex.exe iptablex.exe PID 4092 wrote to memory of 4316 4092 iptablex.exe iptablex.exe PID 4092 wrote to memory of 4316 4092 iptablex.exe iptablex.exe PID 4056 wrote to memory of 1580 4056 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe iptablex.exe PID 4056 wrote to memory of 1580 4056 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe iptablex.exe PID 4056 wrote to memory of 1580 4056 c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe iptablex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe"C:\Users\Admin\AppData\Local\Temp\c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe"C:\Users\Admin\AppData\Local\Temp\c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\SysWOW64\iptablex.exe"C:\windows\system32\iptablex.exe" rcdelc:\users\admin\appdata\local\temp\c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exebcfwred.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1580 -
C:\windows\SysWOW64\iptables.exe"C:\windows\system32\iptables.exe" rcdelc:\users\admin\appdata\local\temp\c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1412
-
\??\c:\windows\SysWOW64\iptables.exec:\windows\SysWOW64\iptables.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\windows\SysWOW64\iptables.exe"C:\windows\system32\iptables.exe" rcdelc:\windows\syswow64\iptables.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5008
-
\??\c:\windows\SysWOW64\iptablex.exec:\windows\SysWOW64\iptablex.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\windows\SysWOW64\iptablex.exe"C:\windows\system32\iptablex.exe" rcdelc:\windows\syswow64\iptablex.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4792
-
\??\c:\windows\SysWOW64\iptablex.exec:\windows\SysWOW64\iptablex.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\SysWOW64\iptablex.exe"C:\windows\system32\iptablex.exe" rcdelc:\windows\syswow64\iptablex.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4316
-
\??\c:\windows\SysWOW64\iptables.exec:\windows\SysWOW64\iptables.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\windows\SysWOW64\iptables.exe"C:\windows\system32\iptables.exe" rcdelc:\windows\syswow64\iptables.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2316
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exeFilesize
72KB
MD50e8df52f72d37da560281baba82a727c
SHA12e99381d6458c75aaf0cf2ae64fcdcc55614be49
SHA2568df33db58ea2c9ac0dcb255b582bd293782cdf908f86f3084f108cff545b4331
SHA512449f722f39a461330c05babbca8670ff553e782af9ec52ee92d23336c23d495b40306f8ba16492f564868ee2be5114456b2bf19a978b9209c481f87f9974a801
-
C:\Users\Admin\AppData\Local\Temp\c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8.exeBCfWrED.exeFilesize
72KB
MD50e8df52f72d37da560281baba82a727c
SHA12e99381d6458c75aaf0cf2ae64fcdcc55614be49
SHA2568df33db58ea2c9ac0dcb255b582bd293782cdf908f86f3084f108cff545b4331
SHA512449f722f39a461330c05babbca8670ff553e782af9ec52ee92d23336c23d495b40306f8ba16492f564868ee2be5114456b2bf19a978b9209c481f87f9974a801
-
C:\Windows\SysWOW64\iptables.exeFilesize
116KB
MD55d5267d68e5210c35cd6fd82cba6ab22
SHA1b27b5b222bd9dcb471ecfdde387b995de1e1fb5b
SHA256c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8
SHA512468be95b63fb1bbe8725a63fc0380aa54dfc6f7e56c9e30b809547f61dafba7dad035eff4e1d31ee95b3500fcecfe327fc7ffe4204036604cbaf64d944cbaa34
-
C:\Windows\SysWOW64\iptables.exeFilesize
116KB
MD55d5267d68e5210c35cd6fd82cba6ab22
SHA1b27b5b222bd9dcb471ecfdde387b995de1e1fb5b
SHA256c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8
SHA512468be95b63fb1bbe8725a63fc0380aa54dfc6f7e56c9e30b809547f61dafba7dad035eff4e1d31ee95b3500fcecfe327fc7ffe4204036604cbaf64d944cbaa34
-
C:\Windows\SysWOW64\iptables.exeFilesize
116KB
MD55d5267d68e5210c35cd6fd82cba6ab22
SHA1b27b5b222bd9dcb471ecfdde387b995de1e1fb5b
SHA256c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8
SHA512468be95b63fb1bbe8725a63fc0380aa54dfc6f7e56c9e30b809547f61dafba7dad035eff4e1d31ee95b3500fcecfe327fc7ffe4204036604cbaf64d944cbaa34
-
C:\Windows\SysWOW64\iptables.exeFilesize
116KB
MD55d5267d68e5210c35cd6fd82cba6ab22
SHA1b27b5b222bd9dcb471ecfdde387b995de1e1fb5b
SHA256c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8
SHA512468be95b63fb1bbe8725a63fc0380aa54dfc6f7e56c9e30b809547f61dafba7dad035eff4e1d31ee95b3500fcecfe327fc7ffe4204036604cbaf64d944cbaa34
-
C:\Windows\SysWOW64\iptables.exeFilesize
116KB
MD55d5267d68e5210c35cd6fd82cba6ab22
SHA1b27b5b222bd9dcb471ecfdde387b995de1e1fb5b
SHA256c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8
SHA512468be95b63fb1bbe8725a63fc0380aa54dfc6f7e56c9e30b809547f61dafba7dad035eff4e1d31ee95b3500fcecfe327fc7ffe4204036604cbaf64d944cbaa34
-
C:\Windows\SysWOW64\iptablex.exeFilesize
72KB
MD50e8df52f72d37da560281baba82a727c
SHA12e99381d6458c75aaf0cf2ae64fcdcc55614be49
SHA2568df33db58ea2c9ac0dcb255b582bd293782cdf908f86f3084f108cff545b4331
SHA512449f722f39a461330c05babbca8670ff553e782af9ec52ee92d23336c23d495b40306f8ba16492f564868ee2be5114456b2bf19a978b9209c481f87f9974a801
-
C:\Windows\SysWOW64\iptablex.exeFilesize
72KB
MD50e8df52f72d37da560281baba82a727c
SHA12e99381d6458c75aaf0cf2ae64fcdcc55614be49
SHA2568df33db58ea2c9ac0dcb255b582bd293782cdf908f86f3084f108cff545b4331
SHA512449f722f39a461330c05babbca8670ff553e782af9ec52ee92d23336c23d495b40306f8ba16492f564868ee2be5114456b2bf19a978b9209c481f87f9974a801
-
C:\Windows\SysWOW64\iptablex.exeFilesize
72KB
MD50e8df52f72d37da560281baba82a727c
SHA12e99381d6458c75aaf0cf2ae64fcdcc55614be49
SHA2568df33db58ea2c9ac0dcb255b582bd293782cdf908f86f3084f108cff545b4331
SHA512449f722f39a461330c05babbca8670ff553e782af9ec52ee92d23336c23d495b40306f8ba16492f564868ee2be5114456b2bf19a978b9209c481f87f9974a801
-
C:\Windows\SysWOW64\iptablex.exeFilesize
72KB
MD50e8df52f72d37da560281baba82a727c
SHA12e99381d6458c75aaf0cf2ae64fcdcc55614be49
SHA2568df33db58ea2c9ac0dcb255b582bd293782cdf908f86f3084f108cff545b4331
SHA512449f722f39a461330c05babbca8670ff553e782af9ec52ee92d23336c23d495b40306f8ba16492f564868ee2be5114456b2bf19a978b9209c481f87f9974a801
-
C:\Windows\SysWOW64\iptablex.exeFilesize
72KB
MD50e8df52f72d37da560281baba82a727c
SHA12e99381d6458c75aaf0cf2ae64fcdcc55614be49
SHA2568df33db58ea2c9ac0dcb255b582bd293782cdf908f86f3084f108cff545b4331
SHA512449f722f39a461330c05babbca8670ff553e782af9ec52ee92d23336c23d495b40306f8ba16492f564868ee2be5114456b2bf19a978b9209c481f87f9974a801
-
\??\c:\windows\SysWOW64\iptables.exeFilesize
116KB
MD55d5267d68e5210c35cd6fd82cba6ab22
SHA1b27b5b222bd9dcb471ecfdde387b995de1e1fb5b
SHA256c22a9814d1dfe7bd2cf75c3e15c3c8c555ed94a2db99966a39f9701301a34cb8
SHA512468be95b63fb1bbe8725a63fc0380aa54dfc6f7e56c9e30b809547f61dafba7dad035eff4e1d31ee95b3500fcecfe327fc7ffe4204036604cbaf64d944cbaa34
-
\??\c:\windows\SysWOW64\iptablex.exeFilesize
72KB
MD50e8df52f72d37da560281baba82a727c
SHA12e99381d6458c75aaf0cf2ae64fcdcc55614be49
SHA2568df33db58ea2c9ac0dcb255b582bd293782cdf908f86f3084f108cff545b4331
SHA512449f722f39a461330c05babbca8670ff553e782af9ec52ee92d23336c23d495b40306f8ba16492f564868ee2be5114456b2bf19a978b9209c481f87f9974a801
-
memory/1412-147-0x0000000000000000-mapping.dmp
-
memory/1580-151-0x0000000000000000-mapping.dmp
-
memory/2316-145-0x0000000000000000-mapping.dmp
-
memory/4056-132-0x0000000000000000-mapping.dmp
-
memory/4316-149-0x0000000000000000-mapping.dmp
-
memory/4792-139-0x0000000000000000-mapping.dmp
-
memory/5008-140-0x0000000000000000-mapping.dmp