Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-01-2021 08:39
Static task
static1
Behavioral task
behavioral1
Sample
NEW PURCHASE REQUIREMENT .xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
NEW PURCHASE REQUIREMENT .xlsx
Resource
win10v20201028
General
-
Target
NEW PURCHASE REQUIREMENT .xlsx
-
Size
2.1MB
-
MD5
63fc87b0bb258315f3e229d16b933768
-
SHA1
65fedd6ad7f14125a17b24831d66d31a57634ad5
-
SHA256
5a814e460fc7723ec36e5f1451a7e0349bfce280c1f935b432378d666ce95044
-
SHA512
a576575deb7143a202f1f066e3582b36a094dbd0ad6aeef0eaf8f6ee76562339627c1b5c38c38be54f32c56f7f49cf0554e524661fe8c7bede793e8f6ef70ba4
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
ServiceHost packer 8 IoCs
Detects ServiceHost packer used for .NET malware
Processes:
resource yara_rule behavioral1/memory/1628-51-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/1628-52-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/1628-53-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/1628-55-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/1628-54-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/1628-58-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/1628-57-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/1628-56-0x0000000000000000-mapping.dmp servicehost -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1292 EQNEDT32.EXE -
Executes dropped EXE 4 IoCs
Processes:
vbc.exevbc.exevlc.exevlc.exepid process 1644 vbc.exe 968 vbc.exe 1628 vlc.exe 748 vlc.exe -
Loads dropped DLL 7 IoCs
Processes:
EQNEDT32.EXEcmd.exeWerFault.exepid process 1292 EQNEDT32.EXE 1292 EQNEDT32.EXE 1948 cmd.exe 1948 cmd.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exevlc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vbc.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
vbc.exevlc.exepid process 1644 vbc.exe 1644 vbc.exe 1644 vbc.exe 1644 vbc.exe 1644 vbc.exe 1644 vbc.exe 1644 vbc.exe 1644 vbc.exe 1628 vlc.exe 1628 vlc.exe 1628 vlc.exe 1628 vlc.exe 1628 vlc.exe 1628 vlc.exe 1628 vlc.exe 1628 vlc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
vbc.exevlc.exedescription pid process target process PID 1644 set thread context of 968 1644 vbc.exe vbc.exe PID 1628 set thread context of 748 1628 vlc.exe vlc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1600 1628 WerFault.exe vlc.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1684 timeout.exe 1520 timeout.exe 904 timeout.exe 108 timeout.exe 1032 timeout.exe 1140 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1844 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
vbc.exevlc.exeWerFault.exepid process 1644 vbc.exe 1644 vbc.exe 1644 vbc.exe 1628 vlc.exe 1628 vlc.exe 1628 vlc.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevlc.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1644 vbc.exe Token: SeDebugPrivilege 1628 vlc.exe Token: SeDebugPrivilege 1600 WerFault.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEvlc.exepid process 1844 EXCEL.EXE 1844 EXCEL.EXE 1844 EXCEL.EXE 748 vlc.exe -
Suspicious use of WriteProcessMemory 90 IoCs
Processes:
EQNEDT32.EXEvbc.execmd.execmd.execmd.exevbc.exeWScript.execmd.exevlc.execmd.execmd.exedescription pid process target process PID 1292 wrote to memory of 1644 1292 EQNEDT32.EXE vbc.exe PID 1292 wrote to memory of 1644 1292 EQNEDT32.EXE vbc.exe PID 1292 wrote to memory of 1644 1292 EQNEDT32.EXE vbc.exe PID 1292 wrote to memory of 1644 1292 EQNEDT32.EXE vbc.exe PID 1644 wrote to memory of 1824 1644 vbc.exe cmd.exe PID 1644 wrote to memory of 1824 1644 vbc.exe cmd.exe PID 1644 wrote to memory of 1824 1644 vbc.exe cmd.exe PID 1644 wrote to memory of 1824 1644 vbc.exe cmd.exe PID 1824 wrote to memory of 1684 1824 cmd.exe timeout.exe PID 1824 wrote to memory of 1684 1824 cmd.exe timeout.exe PID 1824 wrote to memory of 1684 1824 cmd.exe timeout.exe PID 1824 wrote to memory of 1684 1824 cmd.exe timeout.exe PID 1644 wrote to memory of 1656 1644 vbc.exe cmd.exe PID 1644 wrote to memory of 1656 1644 vbc.exe cmd.exe PID 1644 wrote to memory of 1656 1644 vbc.exe cmd.exe PID 1644 wrote to memory of 1656 1644 vbc.exe cmd.exe PID 1656 wrote to memory of 1520 1656 cmd.exe timeout.exe PID 1656 wrote to memory of 1520 1656 cmd.exe timeout.exe PID 1656 wrote to memory of 1520 1656 cmd.exe timeout.exe PID 1656 wrote to memory of 1520 1656 cmd.exe timeout.exe PID 1644 wrote to memory of 1252 1644 vbc.exe cmd.exe PID 1644 wrote to memory of 1252 1644 vbc.exe cmd.exe PID 1644 wrote to memory of 1252 1644 vbc.exe cmd.exe PID 1644 wrote to memory of 1252 1644 vbc.exe cmd.exe PID 1252 wrote to memory of 904 1252 cmd.exe timeout.exe PID 1252 wrote to memory of 904 1252 cmd.exe timeout.exe PID 1252 wrote to memory of 904 1252 cmd.exe timeout.exe PID 1252 wrote to memory of 904 1252 cmd.exe timeout.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 968 1644 vbc.exe vbc.exe PID 968 wrote to memory of 1320 968 vbc.exe WScript.exe PID 968 wrote to memory of 1320 968 vbc.exe WScript.exe PID 968 wrote to memory of 1320 968 vbc.exe WScript.exe PID 968 wrote to memory of 1320 968 vbc.exe WScript.exe PID 1320 wrote to memory of 1948 1320 WScript.exe cmd.exe PID 1320 wrote to memory of 1948 1320 WScript.exe cmd.exe PID 1320 wrote to memory of 1948 1320 WScript.exe cmd.exe PID 1320 wrote to memory of 1948 1320 WScript.exe cmd.exe PID 1948 wrote to memory of 1628 1948 cmd.exe vlc.exe PID 1948 wrote to memory of 1628 1948 cmd.exe vlc.exe PID 1948 wrote to memory of 1628 1948 cmd.exe vlc.exe PID 1948 wrote to memory of 1628 1948 cmd.exe vlc.exe PID 1628 wrote to memory of 1688 1628 vlc.exe cmd.exe PID 1628 wrote to memory of 1688 1628 vlc.exe cmd.exe PID 1628 wrote to memory of 1688 1628 vlc.exe cmd.exe PID 1628 wrote to memory of 1688 1628 vlc.exe cmd.exe PID 1688 wrote to memory of 108 1688 cmd.exe timeout.exe PID 1688 wrote to memory of 108 1688 cmd.exe timeout.exe PID 1688 wrote to memory of 108 1688 cmd.exe timeout.exe PID 1688 wrote to memory of 108 1688 cmd.exe timeout.exe PID 1628 wrote to memory of 516 1628 vlc.exe cmd.exe PID 1628 wrote to memory of 516 1628 vlc.exe cmd.exe PID 1628 wrote to memory of 516 1628 vlc.exe cmd.exe PID 1628 wrote to memory of 516 1628 vlc.exe cmd.exe PID 516 wrote to memory of 1032 516 cmd.exe timeout.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE REQUIREMENT .xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 9207⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
C:\Users\Public\vbc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
C:\Users\Public\vbc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
C:\Users\Public\vbc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
\Users\Public\vbc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
\Users\Public\vbc.exeMD5
c256502f66dbd289955472b574432271
SHA1d7adee8673f92b59bfdaaa598ab41e04a2226ba8
SHA256facf1bd37fa739f82bc10a7a6e7436b4871af89e3c8389270673e2dbb76200e4
SHA512f6042d1bec0de3bc025c8aa525b2ad2c9f2d9fcd6c0a6446ba589b5b2ba1852621e65af69bf961bfa313df4451fb16974a406e02c0f391e30fd64c51f0a5be80
-
memory/108-36-0x0000000000000000-mapping.dmp
-
memory/472-2-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmpFilesize
2.5MB
-
memory/516-37-0x0000000000000000-mapping.dmp
-
memory/748-42-0x0000000000413FA4-mapping.dmp
-
memory/748-44-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/904-17-0x0000000000000000-mapping.dmp
-
memory/968-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/968-19-0x0000000000413FA4-mapping.dmp
-
memory/968-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1032-38-0x0000000000000000-mapping.dmp
-
memory/1140-40-0x0000000000000000-mapping.dmp
-
memory/1252-16-0x0000000000000000-mapping.dmp
-
memory/1252-39-0x0000000000000000-mapping.dmp
-
memory/1320-22-0x0000000000000000-mapping.dmp
-
memory/1320-25-0x0000000002730000-0x0000000002734000-memory.dmpFilesize
16KB
-
memory/1520-15-0x0000000000000000-mapping.dmp
-
memory/1600-46-0x0000000001FD0000-0x0000000001FE1000-memory.dmpFilesize
68KB
-
memory/1600-45-0x0000000000000000-mapping.dmp
-
memory/1628-52-0x0000000000000000-mapping.dmp
-
memory/1628-51-0x0000000000000000-mapping.dmp
-
memory/1628-56-0x0000000000000000-mapping.dmp
-
memory/1628-57-0x0000000000000000-mapping.dmp
-
memory/1628-58-0x0000000000000000-mapping.dmp
-
memory/1628-54-0x0000000000000000-mapping.dmp
-
memory/1628-55-0x0000000000000000-mapping.dmp
-
memory/1628-32-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/1628-31-0x000000006BD60000-0x000000006C44E000-memory.dmpFilesize
6.9MB
-
memory/1628-53-0x0000000000000000-mapping.dmp
-
memory/1628-29-0x0000000000000000-mapping.dmp
-
memory/1644-9-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/1644-8-0x000000006BCB0000-0x000000006C39E000-memory.dmpFilesize
6.9MB
-
memory/1644-11-0x0000000000510000-0x0000000000540000-memory.dmpFilesize
192KB
-
memory/1644-5-0x0000000000000000-mapping.dmp
-
memory/1656-14-0x0000000000000000-mapping.dmp
-
memory/1684-13-0x0000000000000000-mapping.dmp
-
memory/1688-35-0x0000000000000000-mapping.dmp
-
memory/1824-12-0x0000000000000000-mapping.dmp
-
memory/1948-24-0x0000000000000000-mapping.dmp