Analysis
-
max time kernel
126s -
max time network
128s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 06:09
Static task
static1
Behavioral task
behavioral1
Sample
AL JUNEIDI LIST.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
AL JUNEIDI LIST.xlsx
Resource
win10v20201028
General
-
Target
AL JUNEIDI LIST.xlsx
-
Size
2.4MB
-
MD5
60540d14ce3fad98f702136cd2a4c28b
-
SHA1
86da698cf83d97aae2c778d772998b61192a72e4
-
SHA256
23747e944ff608bffb823f5282f7214e932dd24897aef0c7618c7b7741d61304
-
SHA512
a1007f161432ca1d4c3b39fb920c6699e2ecc076d843bc35a01bd9345964b0fd853c046638a6aef461d6f6796642285a3f0628cc309e39f0ee0ee925b2529536
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
armyscheme3@yandex.com - Password:
browse9ja
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1976-22-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1976-23-0x00000000004375DE-mapping.dmp family_agenttesla behavioral1/memory/1976-26-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 1984 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
regasm.exeregasm.exepid process 1068 regasm.exe 1976 regasm.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 1984 EQNEDT32.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regasm.exedescription pid process target process PID 1068 set thread context of 1976 1068 regasm.exe regasm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1AE26F2C-AA5D-4971-9D1F-B21DFD9226E7}\2.0\0 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{1AE26F2C-AA5D-4971-9D1F-B21DFD9226E7}\2.0\0 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{1AE26F2C-AA5D-4971-9D1F-B21DFD9226E7}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Excel8.0\\MSForms.exd" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1AE26F2C-AA5D-4971-9D1F-B21DFD9226E7} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{1AE26F2C-AA5D-4971-9D1F-B21DFD9226E7}\2.0\ = "Microsoft Forms 2.0 Object Library" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{1AE26F2C-AA5D-4971-9D1F-B21DFD9226E7}\2.0 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2004 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
regasm.exeregasm.exepid process 1068 regasm.exe 1068 regasm.exe 1976 regasm.exe 1976 regasm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
regasm.exeregasm.exedescription pid process Token: SeDebugPrivilege 1068 regasm.exe Token: SeDebugPrivilege 1976 regasm.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
EQNEDT32.EXEregasm.exedescription pid process target process PID 1984 wrote to memory of 1068 1984 EQNEDT32.EXE regasm.exe PID 1984 wrote to memory of 1068 1984 EQNEDT32.EXE regasm.exe PID 1984 wrote to memory of 1068 1984 EQNEDT32.EXE regasm.exe PID 1984 wrote to memory of 1068 1984 EQNEDT32.EXE regasm.exe PID 1068 wrote to memory of 1600 1068 regasm.exe schtasks.exe PID 1068 wrote to memory of 1600 1068 regasm.exe schtasks.exe PID 1068 wrote to memory of 1600 1068 regasm.exe schtasks.exe PID 1068 wrote to memory of 1600 1068 regasm.exe schtasks.exe PID 1068 wrote to memory of 1976 1068 regasm.exe regasm.exe PID 1068 wrote to memory of 1976 1068 regasm.exe regasm.exe PID 1068 wrote to memory of 1976 1068 regasm.exe regasm.exe PID 1068 wrote to memory of 1976 1068 regasm.exe regasm.exe PID 1068 wrote to memory of 1976 1068 regasm.exe regasm.exe PID 1068 wrote to memory of 1976 1068 regasm.exe regasm.exe PID 1068 wrote to memory of 1976 1068 regasm.exe regasm.exe PID 1068 wrote to memory of 1976 1068 regasm.exe regasm.exe PID 1068 wrote to memory of 1976 1068 regasm.exe regasm.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\AL JUNEIDI LIST.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\regasm.exe"C:\Users\Public\regasm.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKAeWEikAShZpp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF1ED.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Public\regasm.exe"C:\Users\Public\regasm.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF1ED.tmpMD5
f83721f0c1a374d8ca35922f0c81f09c
SHA135e82915c171464c31d151991a197b03f04c4b52
SHA256d2b745ad95549e74e3ae348de7aedf41426cf89d96bda482fea2d37352eb24f6
SHA512a7c1477d474c2e303ad3d0d43e16309917f1803f9977c7a8efa5a92cf2f2506a203a81b2f39aa03f6bccef37017b2806f28f2584bbcb7aafa38ee93ecf732b53
-
C:\Users\Public\regasm.exeMD5
01158bfc4ce6cb2c5a3cdbf661f13f8b
SHA14d18044e5cfa5ebb9b397dd742648db870b1f32a
SHA2564ee443331bdebfdfffa8f7fe75c1434504a900dc792561390f27c3f9f0c8bc09
SHA512d07d372e5399fdf8d95117d7d8f33cf3afd75abdc8c7bf812eecb18f73ac25d30e599af11403b9621072435c18db812a1ea0577792345bbf9c9381d0a213b98e
-
C:\Users\Public\regasm.exeMD5
01158bfc4ce6cb2c5a3cdbf661f13f8b
SHA14d18044e5cfa5ebb9b397dd742648db870b1f32a
SHA2564ee443331bdebfdfffa8f7fe75c1434504a900dc792561390f27c3f9f0c8bc09
SHA512d07d372e5399fdf8d95117d7d8f33cf3afd75abdc8c7bf812eecb18f73ac25d30e599af11403b9621072435c18db812a1ea0577792345bbf9c9381d0a213b98e
-
C:\Users\Public\regasm.exeMD5
01158bfc4ce6cb2c5a3cdbf661f13f8b
SHA14d18044e5cfa5ebb9b397dd742648db870b1f32a
SHA2564ee443331bdebfdfffa8f7fe75c1434504a900dc792561390f27c3f9f0c8bc09
SHA512d07d372e5399fdf8d95117d7d8f33cf3afd75abdc8c7bf812eecb18f73ac25d30e599af11403b9621072435c18db812a1ea0577792345bbf9c9381d0a213b98e
-
\Users\Public\regasm.exeMD5
01158bfc4ce6cb2c5a3cdbf661f13f8b
SHA14d18044e5cfa5ebb9b397dd742648db870b1f32a
SHA2564ee443331bdebfdfffa8f7fe75c1434504a900dc792561390f27c3f9f0c8bc09
SHA512d07d372e5399fdf8d95117d7d8f33cf3afd75abdc8c7bf812eecb18f73ac25d30e599af11403b9621072435c18db812a1ea0577792345bbf9c9381d0a213b98e
-
memory/1068-8-0x0000000000000000-mapping.dmp
-
memory/1068-15-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/1068-19-0x0000000005CA0000-0x0000000005CDB000-memory.dmpFilesize
236KB
-
memory/1068-18-0x0000000005060000-0x00000000050D4000-memory.dmpFilesize
464KB
-
memory/1068-11-0x000000006C070000-0x000000006C75E000-memory.dmpFilesize
6.9MB
-
memory/1068-17-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1068-13-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1068-16-0x0000000002020000-0x0000000002024000-memory.dmpFilesize
16KB
-
memory/1600-20-0x0000000000000000-mapping.dmp
-
memory/1776-6-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmpFilesize
2.5MB
-
memory/1976-25-0x000000006C070000-0x000000006C75E000-memory.dmpFilesize
6.9MB
-
memory/1976-28-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/1976-26-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1976-22-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1976-23-0x00000000004375DE-mapping.dmp
-
memory/1984-5-0x0000000075EA1000-0x0000000075EA3000-memory.dmpFilesize
8KB
-
memory/2004-12-0x0000000005F10000-0x0000000005F12000-memory.dmpFilesize
8KB
-
memory/2004-3-0x0000000070FA1000-0x0000000070FA3000-memory.dmpFilesize
8KB
-
memory/2004-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2004-2-0x000000002F721000-0x000000002F724000-memory.dmpFilesize
12KB