Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    40s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/02/2023, 01:11 UTC

General

  • Target

    e746622d49fbb761eff8dae70917972a07eecff7.exe

  • Size

    16.1MB

  • MD5

    731201d8444298a09d8271f1fbb00b61

  • SHA1

    e746622d49fbb761eff8dae70917972a07eecff7

  • SHA256

    cdb9fbfb428ef0175e4b033d5a07f141d6baa5d7d86236b5850d289b56930616

  • SHA512

    a75536e57aa0a4d706b55b720e6647e4484e9d5b9d45773ff7057ac8740e332d14aa9a3a565770c06d7d67f8b2a87ace8161fd7dcb0c0e6b03d16be9f80c0254

  • SSDEEP

    393216:pMC1ACP7g3EJst+m4hKKaOK3mh0/RM6FdV:B/7gZ1Q3aOCR/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 44 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e746622d49fbb761eff8dae70917972a07eecff7.exe
    "C:\Users\Admin\AppData\Local\Temp\e746622d49fbb761eff8dae70917972a07eecff7.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\appAutoUpdate.exe
      "C:\Users\Admin\AppData\Roaming\Code VBA Examiner\appAutoUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1288

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\LIBEAY32.dll

    Filesize

    1.2MB

    MD5

    2c4aee80c87af1aa5a297b2afbd5f35e

    SHA1

    0a4c89d0484418f4efdf444311eec9d1f86b307b

    SHA256

    0c75b48201829766b2b7aaba3e3d42a791ff6d3d17ddfee42bbe42ae20acfde0

    SHA512

    0aaf831b0e65cbcd37c62a1e515f0d2fb2a2e257bd87f5a00df618bcd90761bba722ba234db98c8c8cbb0177d7b27c603605728ccb3cb862b5344b18e0f0d91d

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\MSVCP140.dll

    Filesize

    428KB

    MD5

    fdd04dbbcf321eee5f4dd67266f476b0

    SHA1

    65ffdfe2664a29a41fcf5039229ccecad5b825b9

    SHA256

    21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

    SHA512

    04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\Qt5Core.dll

    Filesize

    4.5MB

    MD5

    293bd22258209132cf35337827e6e0bd

    SHA1

    5529cb7ff7fe5edde9e557810aa4fe7419ceec82

    SHA256

    fa700c2a81bf2f22d0feb74a287ca906ce4376d14a0922b0c1382672bc29ab38

    SHA512

    49ce7123a0c02570484780e3c374b5a60e1fb85c9c47f486ba2c3fbabe933546e4912ad55d3d793e7020ea3405b4fccb2bd6f946e80d486f9d299ae09b733850

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\Qt5Network.dll

    Filesize

    845KB

    MD5

    c5f3c3b214396224f50d1cb67cde2e69

    SHA1

    7873b6da40616f301c36bd58e5e70524bb96c076

    SHA256

    1e69f798afc35ef64250d2cb1cdf1cf5756385975fa74470450ed8e608872388

    SHA512

    ec67921960e7af895b12aae8bbc933f13695656ab7e381850f8a48e4d31a4bff3a7145458a6c1058b0fc4cfd2b3e1129efdde5334f36a762a62b5b58d880c5e8

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\Qt5Xml.dll

    Filesize

    159KB

    MD5

    df3dc0b4449ea3e87bdb77e3ce1e7470

    SHA1

    3648d4f10a21821f63b6d5bb23f36b1e62e5d9c1

    SHA256

    ef00e3df3bea4181e913d22e7a7017c8eb4d8e0e4ac9ac45436d7cdf30808141

    SHA512

    5d3c95dcfa0672376427cb9fecab15cdce10f2d7843a2cde7a44ddb7f8d47ace91a07ad879ede19b5831f3fc3d4bd11ba99b237536c15447adc667c1c477b302

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\SDL2.dll

    Filesize

    1.1MB

    MD5

    d60643229ea9b319f4de76ba47f0e138

    SHA1

    8811a3d790915e4bbe9deb1d9c7fa499a2679408

    SHA256

    eab38202aa56c843c561c6a5009efc8ef4468f547f55c562341be38ea512951c

    SHA512

    95095958378e4c2e0e3924c5245d8fc6f788b926e8e751d40c55dba0ad1c4ed66379fe8dc148a8c39618eeb75e94cba1b3859462051a249f09cd7b483ba45ccd

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\SSLEAY32.dll

    Filesize

    295KB

    MD5

    f600dee1e1242343c05b1d94c18540bb

    SHA1

    c47c2ac1a865c5afbe9e1ace852a72621576119e

    SHA256

    2f7d415c7018aaa8f676c94db3908d5040a00da2ce4e3fc8269ccf53e86ac9eb

    SHA512

    744259566f4e581885297a551920953fc69451e11e79e49a5b0251bb12cbaa56254bb5a49046620f60ef6de350d9039d1b82638e7e516760315aa8a9fdefd761

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\VCRUNTIME140.dll

    Filesize

    77KB

    MD5

    ba65db6bfef78a96aee7e29f1449bf8a

    SHA1

    06c7beb9fd1f33051b0e77087350903c652f4b77

    SHA256

    141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493

    SHA512

    ca63eeac10ef55d7e2e55479b25cf394e58aef1422951f361f762ab667f72a3454f55afc04e967e8cdd20cf3eebe97083e0438ea941916a09e7d091818ea830e

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-file-l1-2-0.dll

    Filesize

    11KB

    MD5

    86279521328398e87699d248628eb13a

    SHA1

    e4d4c39bda90635f1f5c2fc58b1304e2daac9caf

    SHA256

    3c9b67616fd0ceb3dd92e605918b08556683ebab5537aa76dff300fbd54b0337

    SHA512

    2cc328955611ad8369ff9facf9c1aabe99a20c3ded2977ad86c69e0f54acd78fa6f572ed688625c8c63016826a10b3578e3c186ef2b39c4bf393ab5e399913a6

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-file-l2-1-0.dll

    Filesize

    11KB

    MD5

    422adad24e8da100f85bf3de86b5f302

    SHA1

    7004b3ed8663b5890cd25e1a7899a766be912728

    SHA256

    e04642684dc7376839c570bc11e9b46cae14420f1a85f7562fd2c4d656a22956

    SHA512

    e689ecb1a1cb1e7735cb6a961fd054d87bcad01acf76950b14a3bf4e08ddb7a8d31805c203374ee081a4ec13c40b25b3dc83b3895b9bfbd9c135673e98e6ee63

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    13KB

    MD5

    602a35b140d9d68d7b3e488896158365

    SHA1

    f1ba615abb54ff786ddbc74dffffd56394bfc892

    SHA256

    43b98f74476c86107c8317749f54a107e2955696e4f79d3d02683dd7034d1d52

    SHA512

    4388947f90838cae8b5f8137c9ed2a099028b4341da8c574d536c6ad096bad0e217e105f0367750c70e3d3ca4857255b674955c71ecff0fda9c47a4b1951b8b6

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    11KB

    MD5

    a07afa26ab56a8d3b8b16591a1962005

    SHA1

    2b6f3143487f747911ee20f039f1ffb1381858ac

    SHA256

    6be230837149dc2a8c7772142a674c3f90930a55da7f91d791942d8276d5440b

    SHA512

    b77b277d10cf6b8d209679684ead55b4347caef3213acdccdee35b5d4fe0e3fc136daf057830512c5473c4653a8d66357927c4b7d204c07d7508f792299d7fe9

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-synch-l1-2-0.dll

    Filesize

    11KB

    MD5

    ed215daa7493bf93c5eadef178a261e0

    SHA1

    b20c8dc7ba00f98a326f5f4fd55329b72f8e5699

    SHA256

    8b7c8fc657e0dab0f2506001ca4bb76e675ffd18a2b4d9c1e03b876e008a7a26

    SHA512

    3ed052eada11c3dc44f81f330bd2a2526170515bc6a90281872a93ee49f9add8c9ad36b9a9e9185e251d664c1694d06625e0148e113addc32e53d705d2655f03

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    11KB

    MD5

    a9c7db516186c8e367fed757e238c61a

    SHA1

    1318d6496e7146e773aca85be6d0e9b87a09e284

    SHA256

    ded52bac23633a03341969c5b98b0d94d24fa3284c1ddd0c489e453b39cec659

    SHA512

    6aad003287afe86abccf34f6b15338c0c7380f4837805d919064a26380d2f3f7698515f927c148e618c12f0943d3621184bebc70a8b07eed64ad88689fbcc5cb

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    15KB

    MD5

    c6385b316bb04ca36d76b077eeb9a61e

    SHA1

    fc376f68798fecd41fb1c936eed1bce3f2ee6bef

    SHA256

    060636cfc58587b4344a6d0ff4f44dd77266f2bbdb877cb50cb1b44a7e3969bc

    SHA512

    bddf0f34bedb17ecf1d270a0613f27d174ae04f920192d7d1af6c15245175318b29691e748c36e2ce0a3027495b2f5a0bb688ae16095fad9dcd8c283b6d1b1d4

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    12KB

    MD5

    cf5f256e8cd76ba85e6c3047f078814a

    SHA1

    b7cde77313ceaae76a46c1111b33b3d8f47c4214

    SHA256

    9382fc8d5cbcc23c5d05e6f48f4188af3f96efbbdc5a7ec05b37e252440ecfc1

    SHA512

    856eff4fff1d11a725af9c3e5ceac6d02a89297a16e97edec171839aa12c468fc37d60ec5df06d507cee695f71b7fbd4bc0ba51b7934d886e66a43b249e62da5

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    11KB

    MD5

    60ffdc3ef20b127e3fd14a0719328c34

    SHA1

    b510833350328f79a79fa464ea9d5e9455643659

    SHA256

    43c9ea4ddecf2f34852559cf0b40b5261e6701d3743ab219f48d43a312707ad9

    SHA512

    caef6ee08c9f6fabecef1f0be37ab34e2d4dc22f15a775b2f0dcacda1f0fcdf2259399e6fbab85f0f00e8e4b03d77fe88b85b901a9ba2f775a50f2da724da26e

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    21KB

    MD5

    78dfcb76dc8b42411dbc682f78f5c6eb

    SHA1

    e50f6719fee44c70518cf8442737a688b5f45e62

    SHA256

    8673dd898f899de831fc3052c8b8254b7b85ee7f2b9b6c422736668689c9b14f

    SHA512

    968bb3bc952f4057f74c9c8825fcc2db34b9c56166ee39db3bab3d4ecf51fb65af250a8a65340274a1a0c0eed73b6c8962df5d2fce586c1ef4e19706edd5e6e1

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    15KB

    MD5

    8bd7a27e6ca969d3eb46086d411ce05d

    SHA1

    3bbf6f55853b1487debca58d7cb5c877d0abd517

    SHA256

    8edc95578b8c9ca93a65907e428fa2b57fef8370b902912689332bc61094904c

    SHA512

    fee8359398efe6a995a214d4e47de43aba12d33bb9cb1de18659d332d94ef83a4a77618b6caa9f455b0c6da4c10ab459209d483b9e778d9b522771ca692ca454

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    17KB

    MD5

    f681a45c47ebb2c56c1465677ec33ff3

    SHA1

    06bf7798c51325cf1806e14dea56ff98b05b7846

    SHA256

    3a03d727d291be57057587227273af410eda935438d8a0a165ec63ae772809af

    SHA512

    eeb05f1af7e1c714c658e9aa06e8c6dbeeb5f2e8dcf3fdb7b9b408018e41402d83893472114e0cf6d3a9a3bf54ec45c4f7a4840a09570d190277aa3514681ab8

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    17KB

    MD5

    00446e48d60abf044acc72b46d5c3afb

    SHA1

    0ccc0c5034ac063e1d4af851b0de1f4ea99aff97

    SHA256

    82d26998b4b3c26dbc1c1fff9d6106109a081205081d3c0669e59d20d918bc5a

    SHA512

    69114f0efb3c853bffb55c15e5ad1b7919057a676056d57634a6a39916e232cde2dcdc49ea0f9751ddea6550ffa58f84b1f8918b3c9fd7e88c8b8f7eb4afeaf2

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    13KB

    MD5

    376b4a7a02f20ed3aede05039ec3daf0

    SHA1

    c9149b37f85cfc724bedc0ecd543d95280055de1

    SHA256

    b0b8fc7de3641c3f23d30a4792c8584db33db6133ee29135c70bb504e80e4a2c

    SHA512

    ff7fba7cd8c9b55c1c87104d7d9074ef0eed524b02480ecf2c80e5cd489c568e1ed63bc62699a03272cab3dcbf20e6437e1f47ce112bcb3336d27ed2790430c5

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    11KB

    MD5

    6376bf5bac3f0208f0a5d11415ccd444

    SHA1

    c3fe96e51c3f3e622dcedd2ddf8d23f9442361b8

    SHA256

    e36763df57cd26ec2b4d52e27de51a4ca6f18caf86cbac8307bf4817705f9a0e

    SHA512

    9614e423c850bdb584f18555825214d42106966b1ee71e75ba7407591aa5de407b43909ce972e1923df82e9a0e953597fe19646296962194ebeb1579493d91c2

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\appAutoUpdate.exe

    Filesize

    724KB

    MD5

    bd27db520fc5b84bdde116701338e561

    SHA1

    fe52c23197a661c03af85e124f31e60bfd019fe6

    SHA256

    161946d013bc1efdbaa7a9f7a0cc64af06f880a2c0050097f8c490a3dfe1cd96

    SHA512

    4e8c93c3effecd59e0b2aef9079e2ddd4bfa9f06eaeed429b52547a827a5847fcfc2d7b626cbc15e72db265255f6e6559ad784c6ca89a1a3e99156d5b0f93c9e

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\fftw3.dll

    Filesize

    842KB

    MD5

    d7fdbc8549b82d25e757ca9becc446b6

    SHA1

    c957a2bc431a361680f6ba42e27d25afbb908498

    SHA256

    c3b595633eb076138d10a26bbff932669a7dec27c216efa02f0dd6764a8ff472

    SHA512

    1bb90cbe2e1db7c7956eb382e74b51e83f2f2e218d4bc219927c534980a856caca0dc578523493619e9921f3ee28084185d7d042d3f1e59e6e4e12baa17b91d9

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\lognet.dll

    Filesize

    170KB

    MD5

    3f1c8dfe58ef24cffc90988e905f8161

    SHA1

    7d26e165d1ebf692260797a811b3237300e7f31f

    SHA256

    89c458c242bc708fdb7f8efa210fb59b60d477c45bdc4183929c7e2f3d631ffb

    SHA512

    028536d5aa57cc45352cc309be4a4bf1773f71236add501e7951ba132901b3cf63bdb42a1ba6e6d94390ed03d92c2bd38a38bfcc4959c9a04b84a3c5abf617c9

  • C:\Users\Admin\AppData\Roaming\Code VBA Examiner\ucrtbase.DLL

    Filesize

    880KB

    MD5

    5dafe0bfb955e780b3d50da4524b752f

    SHA1

    91c0d9fabe748d373215ba21b90278671b5f8957

    SHA256

    6255112c9978c07a05c6feaee01cf4be74b2920dc7017fbc1a42f8f5d23c20f9

    SHA512

    37fd37f3ad87838f596d1e8e497fe66d1a1c4128625ab456ec850179dd1e1f33cf4945d0faaf6cdbd1ed586ecfb7ff3e7cf10a88a823cc5eb06c2fc4fa16bff3

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR1F64.tmp

    Filesize

    43KB

    MD5

    c5dc46c377c927c8e91b18cde57cf0fc

    SHA1

    22ce8600d4dbaf9af6eded556d390212274911d1

    SHA256

    a53f9dbbe62911ddc088a10bc8d10b5d8b30ed999438e788b6bfe24f0ba6e2b8

    SHA512

    f208b88f84b9fea0fc184926551eb60f843e997390ceed7cfde5ff7bb7c6b6bcd47a0d5021a92064e57e6b400bbbe21cec93fa2358728a29c35d2bc147cc1432

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR1FE2.tmp

    Filesize

    288KB

    MD5

    122a3741699fb5c0950273245c9dea15

    SHA1

    811f9149e3310a8e6521da156f92f3aaab012145

    SHA256

    f675eba3b22e0a2238ec4961d99de3bacca0ab553ab26eecb49800a12a9371ab

    SHA512

    567c480f70fdc78769ae45bf83b6632f7ab380ebeb00689028d39ff03840c8b778149a3fafe1dab2ac77a1fd17a23b09f58774b1c5e791bfd33b99528225eccc

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR208E.tmp

    Filesize

    35KB

    MD5

    08ad4cd2a940379f1dcdbdb9884a1375

    SHA1

    c302b7589ba4f05c6429e7f89ad0cb84dd9dfbac

    SHA256

    78827e2b1ef0aad4f8b1b42d0964064819aa22bfcd537ebaacb30d817edc06d8

    SHA512

    f37bd071994c31b361090a149999e8b2d4a7839f19ea63e1d4563aada1371be37f2bfcc474e24de95ff77ca4124a39580c9f711e2fbe54265713ab76f631835a

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR20ED.tmp

    Filesize

    121KB

    MD5

    f5cec0e851d679bc6cfe5923c8cdd5c8

    SHA1

    5eee0f3192e2656d0891e363a5d69f61f457b186

    SHA256

    ac0976f2a6f221045d0fd22bb32bab0c8439d186acd118ad0faa2d69cbd2840e

    SHA512

    226f47164392ee339412f8ee5dad3faf40e26c52e2ae039826323ea0ef66d23776b1e972cd6f817e7dea1da0f87f20d3b6c7380fd8e891ec21a2f13dfc4915f8

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR211D.tmp

    Filesize

    532KB

    MD5

    a6f7a08b0676f0564a51b5c47973e635

    SHA1

    d56f5f9e2580b81717317da6582da9d379426d5b

    SHA256

    5dd27e845af9333ad7b907a37ab3d239b75be6ccc1f51ef4b21e59b037ce778c

    SHA512

    1101813034db327af1c16d069a4dfa91ab97ee8188f9ed1a6da9d25558866e7e9af59102e58127e64441d3e4a768b2ad788fd0e5a16db994a14637bfbade2954

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR218B.tmp

    Filesize

    72KB

    MD5

    c04970b55bcf614f24ca75b1de641ae2

    SHA1

    52b182caef513ed1c36f28eb45cedb257fa8ce40

    SHA256

    5ddee4aab3cf33e505f52199d64809125b26de04fb9970ca589cd8619c859d80

    SHA512

    a5f2660e336bf74a1936fb2e1c724220d862632907f5fd690b365009ac3e1bf35fa6689071f3da4049e495f340ff83f8438b79079ef1f248b9dcaedbdd5d3e40

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR21BB.tmp

    Filesize

    14KB

    MD5

    77fe66d74901495f4b41a5918acd02ff

    SHA1

    ce5bbd53152cd5b03df8bcc232a1aea36a012764

    SHA256

    b017168c69ef40115141813e47122391602e1af28af342c56495b09f1c3c7522

    SHA512

    cc6e323d0076577a0a04dbe2c33d90dc616cb5ec3637d3df67cbf169766ca2e6de567fcff4f32938fd6118d98e4796642a3010b7264f0ae247fa8f0fe079bd70

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR2286.tmp

    Filesize

    14KB

    MD5

    d74aadd701bfacc474c431acab7b9265

    SHA1

    8a2b424d1f949430ddc1faddee3e9ccb79c95de2

    SHA256

    f1029f5cca3dabfeffe2c9db6ad84a9ff0f64f5b2fb85cb6ab348740f756e07d

    SHA512

    0ef85e311fb4843997fd5f87f0a2eec9715e26eae76bfb7bb701d8c043720aeaf7f4825d25187bf35e0a9f00def15ed071120128805445f1330c07c3e0ea5ced

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR23DF.tmp

    Filesize

    74KB

    MD5

    924b90c3d9e645dfad53f61ea4e91942

    SHA1

    65d397199ff191e5078095036e49f08376f9ae4e

    SHA256

    41788435f245133ec5511111e2c5d52f7515e359876180067e0b5ba85c729322

    SHA512

    76833708828c8f3fad941abeea158317aff98cf0691b5d5dfa4bca15279cdad1cc23a771258e4de41cf12a58f7033a3ee08b0b5eb834d22be568ea98b183ccd9

  • \Users\Admin\AppData\Local\Temp\BRL00000680\BR241E.tmp

    Filesize

    102KB

    MD5

    77c853090012e97f6ce9212e66ef8a5e

    SHA1

    69425ae525ceff28c14e4855c002db432421ca92

    SHA256

    122debc552cb9a54704c3bb4a363b2494df16f0797642e0dee84712282d4df21

    SHA512

    17b62a1defc291a8af7b7e701ca7ab1a0d72605c6595a52c89b8e94c4a49e2d037931371e9966ac66dc764e968dca3728633e81545d8ba6aba09d8f39a6f914c

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\Qt5Core.dll

    Filesize

    4.5MB

    MD5

    293bd22258209132cf35337827e6e0bd

    SHA1

    5529cb7ff7fe5edde9e557810aa4fe7419ceec82

    SHA256

    fa700c2a81bf2f22d0feb74a287ca906ce4376d14a0922b0c1382672bc29ab38

    SHA512

    49ce7123a0c02570484780e3c374b5a60e1fb85c9c47f486ba2c3fbabe933546e4912ad55d3d793e7020ea3405b4fccb2bd6f946e80d486f9d299ae09b733850

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\Qt5Network.dll

    Filesize

    845KB

    MD5

    c5f3c3b214396224f50d1cb67cde2e69

    SHA1

    7873b6da40616f301c36bd58e5e70524bb96c076

    SHA256

    1e69f798afc35ef64250d2cb1cdf1cf5756385975fa74470450ed8e608872388

    SHA512

    ec67921960e7af895b12aae8bbc933f13695656ab7e381850f8a48e4d31a4bff3a7145458a6c1058b0fc4cfd2b3e1129efdde5334f36a762a62b5b58d880c5e8

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\Qt5Xml.dll

    Filesize

    159KB

    MD5

    df3dc0b4449ea3e87bdb77e3ce1e7470

    SHA1

    3648d4f10a21821f63b6d5bb23f36b1e62e5d9c1

    SHA256

    ef00e3df3bea4181e913d22e7a7017c8eb4d8e0e4ac9ac45436d7cdf30808141

    SHA512

    5d3c95dcfa0672376427cb9fecab15cdce10f2d7843a2cde7a44ddb7f8d47ace91a07ad879ede19b5831f3fc3d4bd11ba99b237536c15447adc667c1c477b302

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\SDL2.dll

    Filesize

    1.1MB

    MD5

    d60643229ea9b319f4de76ba47f0e138

    SHA1

    8811a3d790915e4bbe9deb1d9c7fa499a2679408

    SHA256

    eab38202aa56c843c561c6a5009efc8ef4468f547f55c562341be38ea512951c

    SHA512

    95095958378e4c2e0e3924c5245d8fc6f788b926e8e751d40c55dba0ad1c4ed66379fe8dc148a8c39618eeb75e94cba1b3859462051a249f09cd7b483ba45ccd

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-file-l1-2-0.dll

    Filesize

    11KB

    MD5

    86279521328398e87699d248628eb13a

    SHA1

    e4d4c39bda90635f1f5c2fc58b1304e2daac9caf

    SHA256

    3c9b67616fd0ceb3dd92e605918b08556683ebab5537aa76dff300fbd54b0337

    SHA512

    2cc328955611ad8369ff9facf9c1aabe99a20c3ded2977ad86c69e0f54acd78fa6f572ed688625c8c63016826a10b3578e3c186ef2b39c4bf393ab5e399913a6

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-file-l2-1-0.dll

    Filesize

    11KB

    MD5

    422adad24e8da100f85bf3de86b5f302

    SHA1

    7004b3ed8663b5890cd25e1a7899a766be912728

    SHA256

    e04642684dc7376839c570bc11e9b46cae14420f1a85f7562fd2c4d656a22956

    SHA512

    e689ecb1a1cb1e7735cb6a961fd054d87bcad01acf76950b14a3bf4e08ddb7a8d31805c203374ee081a4ec13c40b25b3dc83b3895b9bfbd9c135673e98e6ee63

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    13KB

    MD5

    602a35b140d9d68d7b3e488896158365

    SHA1

    f1ba615abb54ff786ddbc74dffffd56394bfc892

    SHA256

    43b98f74476c86107c8317749f54a107e2955696e4f79d3d02683dd7034d1d52

    SHA512

    4388947f90838cae8b5f8137c9ed2a099028b4341da8c574d536c6ad096bad0e217e105f0367750c70e3d3ca4857255b674955c71ecff0fda9c47a4b1951b8b6

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    11KB

    MD5

    a07afa26ab56a8d3b8b16591a1962005

    SHA1

    2b6f3143487f747911ee20f039f1ffb1381858ac

    SHA256

    6be230837149dc2a8c7772142a674c3f90930a55da7f91d791942d8276d5440b

    SHA512

    b77b277d10cf6b8d209679684ead55b4347caef3213acdccdee35b5d4fe0e3fc136daf057830512c5473c4653a8d66357927c4b7d204c07d7508f792299d7fe9

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-synch-l1-2-0.dll

    Filesize

    11KB

    MD5

    ed215daa7493bf93c5eadef178a261e0

    SHA1

    b20c8dc7ba00f98a326f5f4fd55329b72f8e5699

    SHA256

    8b7c8fc657e0dab0f2506001ca4bb76e675ffd18a2b4d9c1e03b876e008a7a26

    SHA512

    3ed052eada11c3dc44f81f330bd2a2526170515bc6a90281872a93ee49f9add8c9ad36b9a9e9185e251d664c1694d06625e0148e113addc32e53d705d2655f03

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    11KB

    MD5

    a9c7db516186c8e367fed757e238c61a

    SHA1

    1318d6496e7146e773aca85be6d0e9b87a09e284

    SHA256

    ded52bac23633a03341969c5b98b0d94d24fa3284c1ddd0c489e453b39cec659

    SHA512

    6aad003287afe86abccf34f6b15338c0c7380f4837805d919064a26380d2f3f7698515f927c148e618c12f0943d3621184bebc70a8b07eed64ad88689fbcc5cb

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    15KB

    MD5

    c6385b316bb04ca36d76b077eeb9a61e

    SHA1

    fc376f68798fecd41fb1c936eed1bce3f2ee6bef

    SHA256

    060636cfc58587b4344a6d0ff4f44dd77266f2bbdb877cb50cb1b44a7e3969bc

    SHA512

    bddf0f34bedb17ecf1d270a0613f27d174ae04f920192d7d1af6c15245175318b29691e748c36e2ce0a3027495b2f5a0bb688ae16095fad9dcd8c283b6d1b1d4

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    12KB

    MD5

    cf5f256e8cd76ba85e6c3047f078814a

    SHA1

    b7cde77313ceaae76a46c1111b33b3d8f47c4214

    SHA256

    9382fc8d5cbcc23c5d05e6f48f4188af3f96efbbdc5a7ec05b37e252440ecfc1

    SHA512

    856eff4fff1d11a725af9c3e5ceac6d02a89297a16e97edec171839aa12c468fc37d60ec5df06d507cee695f71b7fbd4bc0ba51b7934d886e66a43b249e62da5

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    11KB

    MD5

    60ffdc3ef20b127e3fd14a0719328c34

    SHA1

    b510833350328f79a79fa464ea9d5e9455643659

    SHA256

    43c9ea4ddecf2f34852559cf0b40b5261e6701d3743ab219f48d43a312707ad9

    SHA512

    caef6ee08c9f6fabecef1f0be37ab34e2d4dc22f15a775b2f0dcacda1f0fcdf2259399e6fbab85f0f00e8e4b03d77fe88b85b901a9ba2f775a50f2da724da26e

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    21KB

    MD5

    78dfcb76dc8b42411dbc682f78f5c6eb

    SHA1

    e50f6719fee44c70518cf8442737a688b5f45e62

    SHA256

    8673dd898f899de831fc3052c8b8254b7b85ee7f2b9b6c422736668689c9b14f

    SHA512

    968bb3bc952f4057f74c9c8825fcc2db34b9c56166ee39db3bab3d4ecf51fb65af250a8a65340274a1a0c0eed73b6c8962df5d2fce586c1ef4e19706edd5e6e1

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    15KB

    MD5

    8bd7a27e6ca969d3eb46086d411ce05d

    SHA1

    3bbf6f55853b1487debca58d7cb5c877d0abd517

    SHA256

    8edc95578b8c9ca93a65907e428fa2b57fef8370b902912689332bc61094904c

    SHA512

    fee8359398efe6a995a214d4e47de43aba12d33bb9cb1de18659d332d94ef83a4a77618b6caa9f455b0c6da4c10ab459209d483b9e778d9b522771ca692ca454

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    17KB

    MD5

    f681a45c47ebb2c56c1465677ec33ff3

    SHA1

    06bf7798c51325cf1806e14dea56ff98b05b7846

    SHA256

    3a03d727d291be57057587227273af410eda935438d8a0a165ec63ae772809af

    SHA512

    eeb05f1af7e1c714c658e9aa06e8c6dbeeb5f2e8dcf3fdb7b9b408018e41402d83893472114e0cf6d3a9a3bf54ec45c4f7a4840a09570d190277aa3514681ab8

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    17KB

    MD5

    00446e48d60abf044acc72b46d5c3afb

    SHA1

    0ccc0c5034ac063e1d4af851b0de1f4ea99aff97

    SHA256

    82d26998b4b3c26dbc1c1fff9d6106109a081205081d3c0669e59d20d918bc5a

    SHA512

    69114f0efb3c853bffb55c15e5ad1b7919057a676056d57634a6a39916e232cde2dcdc49ea0f9751ddea6550ffa58f84b1f8918b3c9fd7e88c8b8f7eb4afeaf2

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    13KB

    MD5

    376b4a7a02f20ed3aede05039ec3daf0

    SHA1

    c9149b37f85cfc724bedc0ecd543d95280055de1

    SHA256

    b0b8fc7de3641c3f23d30a4792c8584db33db6133ee29135c70bb504e80e4a2c

    SHA512

    ff7fba7cd8c9b55c1c87104d7d9074ef0eed524b02480ecf2c80e5cd489c568e1ed63bc62699a03272cab3dcbf20e6437e1f47ce112bcb3336d27ed2790430c5

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    11KB

    MD5

    6376bf5bac3f0208f0a5d11415ccd444

    SHA1

    c3fe96e51c3f3e622dcedd2ddf8d23f9442361b8

    SHA256

    e36763df57cd26ec2b4d52e27de51a4ca6f18caf86cbac8307bf4817705f9a0e

    SHA512

    9614e423c850bdb584f18555825214d42106966b1ee71e75ba7407591aa5de407b43909ce972e1923df82e9a0e953597fe19646296962194ebeb1579493d91c2

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\appAutoUpdate.exe

    Filesize

    724KB

    MD5

    bd27db520fc5b84bdde116701338e561

    SHA1

    fe52c23197a661c03af85e124f31e60bfd019fe6

    SHA256

    161946d013bc1efdbaa7a9f7a0cc64af06f880a2c0050097f8c490a3dfe1cd96

    SHA512

    4e8c93c3effecd59e0b2aef9079e2ddd4bfa9f06eaeed429b52547a827a5847fcfc2d7b626cbc15e72db265255f6e6559ad784c6ca89a1a3e99156d5b0f93c9e

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\fftw3.dll

    Filesize

    842KB

    MD5

    d7fdbc8549b82d25e757ca9becc446b6

    SHA1

    c957a2bc431a361680f6ba42e27d25afbb908498

    SHA256

    c3b595633eb076138d10a26bbff932669a7dec27c216efa02f0dd6764a8ff472

    SHA512

    1bb90cbe2e1db7c7956eb382e74b51e83f2f2e218d4bc219927c534980a856caca0dc578523493619e9921f3ee28084185d7d042d3f1e59e6e4e12baa17b91d9

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\libeay32.dll

    Filesize

    1.2MB

    MD5

    2c4aee80c87af1aa5a297b2afbd5f35e

    SHA1

    0a4c89d0484418f4efdf444311eec9d1f86b307b

    SHA256

    0c75b48201829766b2b7aaba3e3d42a791ff6d3d17ddfee42bbe42ae20acfde0

    SHA512

    0aaf831b0e65cbcd37c62a1e515f0d2fb2a2e257bd87f5a00df618bcd90761bba722ba234db98c8c8cbb0177d7b27c603605728ccb3cb862b5344b18e0f0d91d

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\lognet.dll

    Filesize

    170KB

    MD5

    3f1c8dfe58ef24cffc90988e905f8161

    SHA1

    7d26e165d1ebf692260797a811b3237300e7f31f

    SHA256

    89c458c242bc708fdb7f8efa210fb59b60d477c45bdc4183929c7e2f3d631ffb

    SHA512

    028536d5aa57cc45352cc309be4a4bf1773f71236add501e7951ba132901b3cf63bdb42a1ba6e6d94390ed03d92c2bd38a38bfcc4959c9a04b84a3c5abf617c9

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\msvcp140.dll

    Filesize

    428KB

    MD5

    fdd04dbbcf321eee5f4dd67266f476b0

    SHA1

    65ffdfe2664a29a41fcf5039229ccecad5b825b9

    SHA256

    21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

    SHA512

    04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\ssleay32.dll

    Filesize

    295KB

    MD5

    f600dee1e1242343c05b1d94c18540bb

    SHA1

    c47c2ac1a865c5afbe9e1ace852a72621576119e

    SHA256

    2f7d415c7018aaa8f676c94db3908d5040a00da2ce4e3fc8269ccf53e86ac9eb

    SHA512

    744259566f4e581885297a551920953fc69451e11e79e49a5b0251bb12cbaa56254bb5a49046620f60ef6de350d9039d1b82638e7e516760315aa8a9fdefd761

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\ucrtbase.dll

    Filesize

    880KB

    MD5

    5dafe0bfb955e780b3d50da4524b752f

    SHA1

    91c0d9fabe748d373215ba21b90278671b5f8957

    SHA256

    6255112c9978c07a05c6feaee01cf4be74b2920dc7017fbc1a42f8f5d23c20f9

    SHA512

    37fd37f3ad87838f596d1e8e497fe66d1a1c4128625ab456ec850179dd1e1f33cf4945d0faaf6cdbd1ed586ecfb7ff3e7cf10a88a823cc5eb06c2fc4fa16bff3

  • \Users\Admin\AppData\Roaming\Code VBA Examiner\vcruntime140.dll

    Filesize

    77KB

    MD5

    ba65db6bfef78a96aee7e29f1449bf8a

    SHA1

    06c7beb9fd1f33051b0e77087350903c652f4b77

    SHA256

    141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493

    SHA512

    ca63eeac10ef55d7e2e55479b25cf394e58aef1422951f361f762ab667f72a3454f55afc04e967e8cdd20cf3eebe97083e0438ea941916a09e7d091818ea830e

  • memory/1664-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

    Filesize

    8KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.