Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 07:25
Static task
static1
Behavioral task
behavioral1
Sample
PO 047428.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PO 047428.xlsx
Resource
win10v20201028
General
-
Target
PO 047428.xlsx
-
Size
1.8MB
-
MD5
9c9f5772262a507296c5a3a718ab77e1
-
SHA1
08477969175e1feb27a09258ad42e3c409816324
-
SHA256
08c6f3c35f89f3ddd37764ab2bf87c4b10d20b8314e8c77dc07de286a0e5d560
-
SHA512
f21350a02ea34a58e31529b91f1794946367d54fdbeda8351362be3bd869820eb896bbeab606363d8b3339d81b87b661b94506c25c004dd35f6bb3f085db9eb5
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1968 EQNEDT32.EXE -
Executes dropped EXE 16 IoCs
Processes:
vbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exepid process 776 vbc.exe 648 vbc.exe 1644 vbc.exe 1600 vbc.exe 2012 vbc.exe 528 vbc.exe 820 vbc.exe 1060 vbc.exe 1816 vbc.exe 1972 vbc.exe 996 vbc.exe 564 vbc.exe 436 vbc.exe 1828 vbc.exe 1504 vbc.exe 1596 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1968 EQNEDT32.EXE 1968 EQNEDT32.EXE 1968 EQNEDT32.EXE 1968 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1728 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1728 EXCEL.EXE 1728 EXCEL.EXE 1728 EXCEL.EXE -
Suspicious use of WriteProcessMemory 72 IoCs
Processes:
EQNEDT32.EXEvbc.execmd.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exedescription pid process target process PID 1968 wrote to memory of 776 1968 EQNEDT32.EXE vbc.exe PID 1968 wrote to memory of 776 1968 EQNEDT32.EXE vbc.exe PID 1968 wrote to memory of 776 1968 EQNEDT32.EXE vbc.exe PID 1968 wrote to memory of 776 1968 EQNEDT32.EXE vbc.exe PID 776 wrote to memory of 1464 776 vbc.exe cmd.exe PID 776 wrote to memory of 1464 776 vbc.exe cmd.exe PID 776 wrote to memory of 1464 776 vbc.exe cmd.exe PID 776 wrote to memory of 1464 776 vbc.exe cmd.exe PID 776 wrote to memory of 648 776 vbc.exe vbc.exe PID 776 wrote to memory of 648 776 vbc.exe vbc.exe PID 776 wrote to memory of 648 776 vbc.exe vbc.exe PID 776 wrote to memory of 648 776 vbc.exe vbc.exe PID 1464 wrote to memory of 1548 1464 cmd.exe schtasks.exe PID 1464 wrote to memory of 1548 1464 cmd.exe schtasks.exe PID 1464 wrote to memory of 1548 1464 cmd.exe schtasks.exe PID 1464 wrote to memory of 1548 1464 cmd.exe schtasks.exe PID 648 wrote to memory of 1644 648 vbc.exe vbc.exe PID 648 wrote to memory of 1644 648 vbc.exe vbc.exe PID 648 wrote to memory of 1644 648 vbc.exe vbc.exe PID 648 wrote to memory of 1644 648 vbc.exe vbc.exe PID 1644 wrote to memory of 1600 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 1600 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 1600 1644 vbc.exe vbc.exe PID 1644 wrote to memory of 1600 1644 vbc.exe vbc.exe PID 1600 wrote to memory of 2012 1600 vbc.exe vbc.exe PID 1600 wrote to memory of 2012 1600 vbc.exe vbc.exe PID 1600 wrote to memory of 2012 1600 vbc.exe vbc.exe PID 1600 wrote to memory of 2012 1600 vbc.exe vbc.exe PID 2012 wrote to memory of 528 2012 vbc.exe vbc.exe PID 2012 wrote to memory of 528 2012 vbc.exe vbc.exe PID 2012 wrote to memory of 528 2012 vbc.exe vbc.exe PID 2012 wrote to memory of 528 2012 vbc.exe vbc.exe PID 528 wrote to memory of 820 528 vbc.exe vbc.exe PID 528 wrote to memory of 820 528 vbc.exe vbc.exe PID 528 wrote to memory of 820 528 vbc.exe vbc.exe PID 528 wrote to memory of 820 528 vbc.exe vbc.exe PID 820 wrote to memory of 1060 820 vbc.exe vbc.exe PID 820 wrote to memory of 1060 820 vbc.exe vbc.exe PID 820 wrote to memory of 1060 820 vbc.exe vbc.exe PID 820 wrote to memory of 1060 820 vbc.exe vbc.exe PID 1060 wrote to memory of 1816 1060 vbc.exe vbc.exe PID 1060 wrote to memory of 1816 1060 vbc.exe vbc.exe PID 1060 wrote to memory of 1816 1060 vbc.exe vbc.exe PID 1060 wrote to memory of 1816 1060 vbc.exe vbc.exe PID 1816 wrote to memory of 1972 1816 vbc.exe vbc.exe PID 1816 wrote to memory of 1972 1816 vbc.exe vbc.exe PID 1816 wrote to memory of 1972 1816 vbc.exe vbc.exe PID 1816 wrote to memory of 1972 1816 vbc.exe vbc.exe PID 1972 wrote to memory of 996 1972 vbc.exe vbc.exe PID 1972 wrote to memory of 996 1972 vbc.exe vbc.exe PID 1972 wrote to memory of 996 1972 vbc.exe vbc.exe PID 1972 wrote to memory of 996 1972 vbc.exe vbc.exe PID 996 wrote to memory of 564 996 vbc.exe vbc.exe PID 996 wrote to memory of 564 996 vbc.exe vbc.exe PID 996 wrote to memory of 564 996 vbc.exe vbc.exe PID 996 wrote to memory of 564 996 vbc.exe vbc.exe PID 564 wrote to memory of 436 564 vbc.exe vbc.exe PID 564 wrote to memory of 436 564 vbc.exe vbc.exe PID 564 wrote to memory of 436 564 vbc.exe vbc.exe PID 564 wrote to memory of 436 564 vbc.exe vbc.exe PID 436 wrote to memory of 1828 436 vbc.exe vbc.exe PID 436 wrote to memory of 1828 436 vbc.exe vbc.exe PID 436 wrote to memory of 1828 436 vbc.exe vbc.exe PID 436 wrote to memory of 1828 436 vbc.exe vbc.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PO 047428.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1728
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN start /XML "C:\Users\Admin\AppData\Local\Temp\75485bf249a64428a958453421129ae0.xml"3⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN start /XML "C:\Users\Admin\AppData\Local\Temp\75485bf249a64428a958453421129ae0.xml"4⤵
- Creates scheduled task(s)
PID:1548 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"15⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"16⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"17⤵
- Executes dropped EXE
PID:1596
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\75485bf249a64428a958453421129ae0.xmlMD5
d0cdbca87f9b3271d0718f1ad2736e61
SHA1c5cb86aab1862461733b247a28d2cff4bb292dab
SHA256db6d1754460a2335299f21b7a5b1fdce57fd80513aae1328b9b8325e0ec44861
SHA512cf179279c015abd0731aab9338c9b6d6bdce1142e5871a480fb77d51d69aa045ff6a6a553189743f447fdf29ef6ec31a08cc600475bfd98d10c87af86b9c0b65
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
C:\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
\Users\Public\vbc.exeMD5
f2651b458654fc1799efe0c9ab71fdbf
SHA1acb40c16a5163ccaa66a5a86084005d696fd590a
SHA2563513df7406eef953434f0c75bcdf33c112ee42d6f81edb1928d1e008b691d703
SHA51219e1a21a15391eb6d77248d3bb4d0bc8ce3685b718a674eea627166b59e9edc3be69cc99eae1885c054a5f52eaa3a130383cd3757247b08b544eb97677ce55f2
-
memory/436-51-0x0000000000000000-mapping.dmp
-
memory/528-30-0x0000000000000000-mapping.dmp
-
memory/564-48-0x0000000000000000-mapping.dmp
-
memory/648-16-0x0000000000000000-mapping.dmp
-
memory/776-11-0x0000000000000000-mapping.dmp
-
memory/820-33-0x0000000000000000-mapping.dmp
-
memory/996-45-0x0000000000000000-mapping.dmp
-
memory/1060-36-0x0000000000000000-mapping.dmp
-
memory/1464-15-0x0000000000000000-mapping.dmp
-
memory/1504-57-0x0000000000000000-mapping.dmp
-
memory/1548-18-0x0000000000000000-mapping.dmp
-
memory/1596-60-0x0000000000000000-mapping.dmp
-
memory/1596-63-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1596-64-0x000000001B010000-0x000000001B011000-memory.dmpFilesize
4KB
-
memory/1600-24-0x0000000000000000-mapping.dmp
-
memory/1644-21-0x0000000000000000-mapping.dmp
-
memory/1724-6-0x000007FEF6400000-0x000007FEF667A000-memory.dmpFilesize
2.5MB
-
memory/1728-2-0x000000002F9A1000-0x000000002F9A4000-memory.dmpFilesize
12KB
-
memory/1728-3-0x0000000071611000-0x0000000071613000-memory.dmpFilesize
8KB
-
memory/1728-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1816-39-0x0000000000000000-mapping.dmp
-
memory/1828-54-0x0000000000000000-mapping.dmp
-
memory/1968-5-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1972-42-0x0000000000000000-mapping.dmp
-
memory/2012-27-0x0000000000000000-mapping.dmp