Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2024 12:08
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT_COPY20240604.cmd
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SWIFT_COPY20240604.cmd
Resource
win10v2004-20240426-en
General
-
Target
SWIFT_COPY20240604.cmd
-
Size
3.6MB
-
MD5
af9e835fc667bc0d5623fb958c85d10e
-
SHA1
38d325758725552205de9ab138cb0828c7b632bf
-
SHA256
b4e86c38b2b424b473220586c583c7da8ecb98d192581ef0ba37774911cf8351
-
SHA512
e690c98c0f265262049624576b55b3f792e8a59ba230594f24ac740924faa27a1ee8acb7e3eac511a0c181d0554b785113e31e410746ce7c948a119689cb323f
-
SSDEEP
49152:vgk00JywMTAermhoGyBDj1kwXui5zlrT2Da0QhEQ:A
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5036-28-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-30-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-32-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-29-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-31-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-33-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-36-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-35-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-52-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-82-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-83-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-91-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-90-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-87-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-88-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-86-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-85-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-84-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-81-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-80-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-79-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-77-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-75-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-73-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-72-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-68-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-66-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-64-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-61-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-59-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-57-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-89-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-55-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-54-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-78-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-76-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-50-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-74-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-71-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-70-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-48-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-69-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-67-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-46-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-65-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-44-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-63-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-62-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-45-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-60-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-58-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-43-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-56-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-42-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-41-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-53-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-40-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-51-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-39-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-49-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-47-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-38-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-37-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 behavioral2/memory/5036-34-0x0000000002930000-0x0000000003930000-memory.dmp modiloader_stage2 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE 9 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.execmd.pifpid process 1336 alpha.exe 3100 alpha.exe 3552 kn.exe 640 alpha.exe 3660 kn.exe 5036 Audio.pif 4180 alpha.exe 4944 alpha.exe 4012 cmd.pif -
Loads dropped DLL 1 IoCs
Processes:
cmd.pifpid process 4012 cmd.pif -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Audio.pifdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dkftajgk = "C:\\Users\\Public\\Dkftajgk.url" Audio.pif -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Audio.pifdxdiag.exedescription pid process target process PID 5036 set thread context of 3416 5036 Audio.pif Explorer.EXE PID 5036 set thread context of 4632 5036 Audio.pif dxdiag.exe PID 4632 set thread context of 3416 4632 dxdiag.exe Explorer.EXE PID 4632 set thread context of 2492 4632 dxdiag.exe Firefox.exe -
Processes:
dxdiag.exedescription ioc process Key created \Registry\User\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 dxdiag.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
powershell.exeAudio.pifdxdiag.exepid process 5012 powershell.exe 5012 powershell.exe 5012 powershell.exe 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 5036 Audio.pif 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Audio.pifExplorer.EXEdxdiag.exepid process 5036 Audio.pif 3416 Explorer.EXE 3416 Explorer.EXE 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe 4632 dxdiag.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 5012 powershell.exe Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3416 Explorer.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exeAudio.pifcmd.execmd.pifcmd.exeExplorer.EXEdxdiag.exedescription pid process target process PID 4260 wrote to memory of 1624 4260 cmd.exe extrac32.exe PID 4260 wrote to memory of 1624 4260 cmd.exe extrac32.exe PID 4260 wrote to memory of 1336 4260 cmd.exe alpha.exe PID 4260 wrote to memory of 1336 4260 cmd.exe alpha.exe PID 1336 wrote to memory of 2972 1336 alpha.exe extrac32.exe PID 1336 wrote to memory of 2972 1336 alpha.exe extrac32.exe PID 4260 wrote to memory of 3100 4260 cmd.exe alpha.exe PID 4260 wrote to memory of 3100 4260 cmd.exe alpha.exe PID 3100 wrote to memory of 3552 3100 alpha.exe kn.exe PID 3100 wrote to memory of 3552 3100 alpha.exe kn.exe PID 4260 wrote to memory of 640 4260 cmd.exe alpha.exe PID 4260 wrote to memory of 640 4260 cmd.exe alpha.exe PID 640 wrote to memory of 3660 640 alpha.exe kn.exe PID 640 wrote to memory of 3660 640 alpha.exe kn.exe PID 4260 wrote to memory of 5036 4260 cmd.exe Audio.pif PID 4260 wrote to memory of 5036 4260 cmd.exe Audio.pif PID 4260 wrote to memory of 5036 4260 cmd.exe Audio.pif PID 4260 wrote to memory of 4180 4260 cmd.exe alpha.exe PID 4260 wrote to memory of 4180 4260 cmd.exe alpha.exe PID 4260 wrote to memory of 4944 4260 cmd.exe alpha.exe PID 4260 wrote to memory of 4944 4260 cmd.exe alpha.exe PID 5036 wrote to memory of 4760 5036 Audio.pif cmd.exe PID 5036 wrote to memory of 4760 5036 Audio.pif cmd.exe PID 5036 wrote to memory of 4760 5036 Audio.pif cmd.exe PID 5036 wrote to memory of 5028 5036 Audio.pif cmd.exe PID 5036 wrote to memory of 5028 5036 Audio.pif cmd.exe PID 5036 wrote to memory of 5028 5036 Audio.pif cmd.exe PID 5036 wrote to memory of 3956 5036 Audio.pif cmd.exe PID 5036 wrote to memory of 3956 5036 Audio.pif cmd.exe PID 5036 wrote to memory of 3956 5036 Audio.pif cmd.exe PID 3956 wrote to memory of 4012 3956 cmd.exe cmd.pif PID 3956 wrote to memory of 4012 3956 cmd.exe cmd.pif PID 4012 wrote to memory of 3528 4012 cmd.pif cmd.exe PID 4012 wrote to memory of 3528 4012 cmd.pif cmd.exe PID 3528 wrote to memory of 5012 3528 cmd.exe powershell.exe PID 3528 wrote to memory of 5012 3528 cmd.exe powershell.exe PID 5036 wrote to memory of 3928 5036 Audio.pif extrac32.exe PID 5036 wrote to memory of 3928 5036 Audio.pif extrac32.exe PID 5036 wrote to memory of 3928 5036 Audio.pif extrac32.exe PID 3416 wrote to memory of 4632 3416 Explorer.EXE dxdiag.exe PID 3416 wrote to memory of 4632 3416 Explorer.EXE dxdiag.exe PID 3416 wrote to memory of 4632 3416 Explorer.EXE dxdiag.exe PID 4632 wrote to memory of 2492 4632 dxdiag.exe Firefox.exe PID 4632 wrote to memory of 2492 4632 dxdiag.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SWIFT_COPY20240604.cmd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe4⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\SWIFT_COPY20240604.cmd" "C:\\Users\\Public\\Audio.mp4" 93⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\SWIFT_COPY20240604.cmd" "C:\\Users\\Public\\Audio.mp4" 94⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 123⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 124⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\Audio.pifC:\Users\Public\Libraries\Audio.pif3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows "4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows \System32"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\\Windows \\System32\\cmd.pif"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows \System32\cmd.pif"C:\\Windows \\System32\\cmd.pif"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c start /min powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:'6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Audio.pif C:\\Users\\Public\\Libraries\\Dkftajgk.PIF4⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S3⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\SysWOW64\dxdiag.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k42en43j.x0k.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Public\Audio.mp4Filesize
2.5MB
MD5790bdb7907d11e3e21fd169d2bdee228
SHA1cb528c40d49fa02c2120a8c717946287cfdee9bd
SHA256c5fb2bd432c465244b7bcc770203bdbefba308c2fe71eebe2978bb4acc2e33fb
SHA51203e2da693f5c90c759a0c4cdfda62ad044dc434ffcb2837dd0661f51fa22cd8db1c0d09e571ffe6cab34fe138c099ea63c5d1bc7927a51dd839b99407627fd1f
-
C:\Users\Public\Libraries\Audio.pifFilesize
1.2MB
MD522b9dbc0fc954ce6fa18e5d330129453
SHA1aaf5407952b6b70f597e13fee275c675d7a45561
SHA2562e5fe8ee47576eb7495f08e187bcae3b5b3004b7430e2bee7b4c564b559eebed
SHA512e9eeaa21d8106780d4a2dc19b547f35acc82e67470c670745f18737f7a339c849f4e45569b6955ef6db272a19ae615d9db2fb7ce441057129c5865a10f7fc272
-
C:\Users\Public\alpha.exeFilesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
C:\Users\Public\kn.exeFilesize
1.6MB
MD5bd8d9943a9b1def98eb83e0fa48796c2
SHA170e89852f023ab7cde0173eda1208dbb580f1e4f
SHA2568de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA51295630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b
-
C:\Users\Public\kn.exeFilesize
1.2MB
MD56c60fa360ea43e0c1e7b114174ac82de
SHA1c45a06009e1156f6b11ca689f38618559733ef64
SHA25686783bc4f86daeebcd15cbb64d7872718d4cb0aa80ad1d9fd61655841b675b64
SHA5128a5791470c8c5e7b22e7766fcd12e4059ffa5d6fa8e22b682f9daa39733991f925de35c7d6df4b24dda9ad461fe582c0c7f02a425cc10f923d1d27b59b9a88d1
-
C:\Windows \System32\cmd.pifFilesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7
-
C:\Windows \System32\netutils.dllFilesize
109KB
MD53ef9e89c8bf16295c84b8c82bf5e1b50
SHA145fb8e0cd06da23564712614481265679369fee3
SHA256e0d3d0cf79d7969da536946de8a7395cab39ddfaca7ba7353aa6544d04209b2e
SHA5120d27d4fe85117003830b69575ea02b7ee67601db7d8b2e422f5f9b72735b9b3d15ab8b81b7a9f4f2b14caf1365d0137d9d437932c4640f97c883d3c7bf24a1c1
-
memory/5012-308-0x000002695CE70000-0x000002695CE92000-memory.dmpFilesize
136KB
-
memory/5036-61-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-55-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-29-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-31-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-33-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-36-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-35-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-52-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-82-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-83-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-91-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-90-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-87-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-88-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-86-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-85-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-84-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-81-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-80-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-79-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-77-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-75-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-73-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-72-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-68-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-66-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-64-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-30-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-59-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-57-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-89-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-32-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-54-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-78-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-76-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-50-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-74-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-71-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-70-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-48-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-69-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-67-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-46-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-65-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-44-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-63-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-62-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-45-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-60-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-58-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-43-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-56-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-42-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-41-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-53-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-40-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-51-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-39-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-49-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-47-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-28-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-38-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-37-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB
-
memory/5036-34-0x0000000002930000-0x0000000003930000-memory.dmpFilesize
16.0MB