a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe

Analysis

max time kernel
1s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.exe
Size

12.8MB
MD5

2d0330fae641aa321b8c0365a5edd1b5
SHA1

0207713e73f9e1104e1a141f4cd833261b88904e
SHA256

a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe
SHA512

0f5a1c9ab3640772d5a9e60489376f30be5d2705020770702768ef65e112d45af455fcdcc2f9539114f6eb6a7dc0bd4fcd988a2ff8a7b3233b57c5ae367a312e
SSDEEP

196608:fSlhq9kKXlH6ub1TZi5pTemYWRBVZLdSkN:6i51HZ1QxemXRBVZL

Score

9^/10

evasion upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

czrumw.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ czrumw.exe
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\QM\nb.dll acprotect

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	czrumw.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\QM\nb.dll	acprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

czrumw.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	czrumw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	czrumw.exe

Executes dropped EXE 1 IoCs

Processes:

czrumw.exe

pid process

4584 czrumw.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

czrumw.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine czrumw.exe
Loads dropped DLL 6 IoCs

Processes:

czrumw.exe

pid process

4584 czrumw.exe
4584 czrumw.exe
4584 czrumw.exe
4584 czrumw.exe
4584 czrumw.exe
4584 czrumw.exe

pid	process
4584	czrumw.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine	czrumw.exe

pid	process
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\QM\nb.dll	upx
behavioral2/memory/4584-301-0x0000000007760000-0x0000000007C8E000-memory.dmp	upx
behavioral2/memory/4584-302-0x0000000007760000-0x0000000007C8E000-memory.dmp	upx
behavioral2/memory/4584-313-0x0000000007760000-0x0000000007C8E000-memory.dmp	upx
behavioral2/memory/4584-332-0x0000000007760000-0x0000000007C8E000-memory.dmp	upx
behavioral2/memory/4584-352-0x0000000007760000-0x0000000007C8E000-memory.dmp	upx

Modifies registry class 59 IoCs

Processes:

czrumw.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.Sys\ = "QMPlugin.Sys"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9}\ = "QMPlugin.Sys"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9}\ProgID	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID\ = "QMDispatch.QMVBSRoutine"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyMacro.MyGUIMacroControlServer\CLSID\ = "{DACDED71-1201-4F76-9C30-BDA795A55678}"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\plugin\\SYS.dll"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\InprocHandler32\ = "ole32.dll"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\czrumw.exe"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InprocServer32	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.Sys	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.Sys\CLSID	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\mymacro\\qdisp.dll"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\CLSID	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMLibrary"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9}\InProcServer32\ThreadingModel = "Apartment"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID\ = "QMDispatch.QMRoutine"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9}	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\ = "QMDispatch.QMRoutine"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\InprocHandler32	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\CLSID\ = "{EBEB87A6-E151-4054-AB45-A6E094C5334B}"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\mymacro\\qdisp.dll"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9}\ProgID\ = "QMPlugin.Sys"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\mymacro\\qdisp.dll"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32\ThreadingModel = "Apartment"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InprocServer32	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32\ThreadingModel = "Apartment"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\ = "MyMacro.MyGUIMacroControlServer"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.Sys\CLSID\ = "{33414471-126E-4FC8-B430-1C6143484AA9}"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyMacro.MyGUIMacroControlServer\ = "MyMacro.MyGUIMacroControlServer"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ = "QMDispatch.QMVBSRoutine"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ = "QMDispatch.QMRoutine"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\ = "QMDispatch.QMLibrary"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ProgID	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID\ = "{241D7F03-9232-4024-8373-149860BE27C0}"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ = "QMDispatch.QMLibrary"	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32\ThreadingModel = "Apartment"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyMacro.MyGUIMacroControlServer	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\ProgID\ = "MyMacro.MyGUIMacroControlServer"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\ProgID	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\LocalServer32	czrumw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\ = "QMDispatch.QMVBSRoutine"	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyMacro.MyGUIMacroControlServer\CLSID	czrumw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9}\InProcServer32	czrumw.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

czrumw.exe

pid process

4584 czrumw.exe
4584 czrumw.exe
4584 czrumw.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

czrumw.exe

pid process

4584 czrumw.exe
4584 czrumw.exe
4584 czrumw.exe

pid	process
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe

pid	process
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.execzrumw.exe

pid	process
740	a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.exe
740	a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe
4584	czrumw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.exe

description	pid	process	target process
PID 740 wrote to memory of 4584	740	a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.exe	czrumw.exe
PID 740 wrote to memory of 4584	740	a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.exe	czrumw.exe
PID 740 wrote to memory of 4584	740	a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.exe	czrumw.exe

C:\Users\Admin\AppData\Local\Temp\a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.exe
"C:\Users\Admin\AppData\Local\Temp\a4e2f937be55cef890bf7cbd1e658d63d85ee63ea3bf7bbef66fcbe04b55affe.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Local\Temp\czrumw.exe
C:\Users\Admin\AppData\Local\Temp\czrumw.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4584

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" atl.dll /s
3⤵
PID:5084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4774DB4.tmp
Filesize
4.6MB

MD5
c3029996a9e0af5590fce8eaf6af4961

SHA1
08fe161351bc0d4079a70d8a6b4dd382780057c4

SHA256
1192e300559b58dcd7659de5a7f89c446370f671b1f54edcc686b335518cdf39

SHA512
e15427fa59350b6e91f225f9f0e9913bd8bdcf77291de378fae6bbd99a50952dcbbb7fe5e3ae428a1e93154832ab3b06089b2bd4baaa05411608c86cea5112fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\4B61.tmp
Filesize
417B

MD5
d4dc8f619ac37fb183cb25c0b26a9b0d

SHA1
abb1b89e82c2d88eb0b0f5d3cc63d425d7fc1003

SHA256
ccaad2629f1bb7d4eb3a409feb3598c893bee800cd9c1bf6f8ef914454c195a7

SHA512
0a6e00ab14e2870dc76659c11a30e1fdab61c85bfae6cab609e89bca9c74d13d16f118b8730e0cea5bc39fec8df58e21d9939312e46c81f0069810a0a52a8c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\QM\nb.dll
Filesize
4.1MB

MD5
2c685c5e7e1aaf03845d273ab5adeb6c

SHA1
dae12ddf186d6e8b49a57b49c5a215ad67ec3462

SHA256
3143d166f4f7001169ba8d79972e1b8703258e0273252b37671dc433855e2b1d

SHA512
dad75b1cd531b7068980d73ae896de39fb5be891979fc58bfbe4d127edb6b40ef7c937ecba18f87db5837571ddeaa901ea55781ed03e623b083a526620a8bf6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cfgdll.dll
Filesize
59KB

MD5
3f9711ab8cfa0cbbeaeceba7904c8700

SHA1
94085220d65eb8c572fb394ab0d19815dcf80680

SHA256
517df7f719bcc34ea934868e46c77932768ee77abccc3bccac62bf9bfeed0af5

SHA512
e595acdc6b857a6180f88ddb0bd8c50f66bd1768d129e996dcd8934e9462150d041dc79addd2251b933e1a63ccccf03070ecce8ed485ea35622af1c18c60fcc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\czrumw.exe
Filesize
4.9MB

MD5
08806e8294be0d9b355ce68e34f8c986

SHA1
aa743df179d75e5cfe291a8e990b026bf8b70d30

SHA256
2f02e3d151b686d354b526ef85295d464836752dc1ffdda64404910bcfcde699

SHA512
b0c45ba96a477e6096cdc7691fef946520186a82abdf85d0f91b6ce545a8fb95bdd0f51f4b76b7a580f11ab27a648c8466938cef42e7267d60696cdd176732e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\czrumw.exe
Filesize
4.9MB

MD5
6542e60a7a209fee59b519cd277669ee

SHA1
f5428688fd661312f297756cdcd824a40d7cbb2b

SHA256
d429da9aabc70515869dce6c203fbcc35e11cbee34e0034cb643654053699bf0

SHA512
c19c5294869b2e4e49509a08d4a4717da6ae2f8d70e6d9a9626c7a204730830137a633beda27bfa90a7323eee9495b2e410eb95148d37680ef69fd9f5ccc55c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugin\ND.DLL
Filesize
24KB

MD5
e29d9a912204844df5306ca3935b1f1c

SHA1
19ba6440827ad2ac515aeb6c8700fbb4c896e61c

SHA256
3453bb9b4550dd5a51a64c3d2d25f1b49744b05ac740c57f2dd9f89084811318

SHA512
9229d5c845eeb36cd293e8d998aca63ed14f41b43d7d11da8682ede4d24853eff19bf0801b8ab055d50c849be7cbf94b890a672d90b55eec5019cebf98925a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugin\SYS.DLL
Filesize
32KB

MD5
18c393dfa1c0f3d2da0f4acdec5d7639

SHA1
84f666216085f177bccb8fa94900ba625f7552bc

SHA256
3c3599cf74407476a92ce4ee66ed3ce00d0b3ea5326f796c191e6ed0a9a87b3a

SHA512
ba61370b69b239754ff8f4e07f456755422667340c9a27bf2ace272b0e90a0818da595b973e90cd9ca4fc502028caef078e16bc7c87b2a6a8fa465141f54b3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugin\SYS.ini
Filesize
1KB

MD5
09c6b26d1e0ff380321f586473d81098

SHA1
261ba0c9c3ddf3c9e8715ead3628212d2859bcba

SHA256
bc8eaa229e13a93be3bef498443182eb5d97551fbc5fcb1208d014b56161588f

SHA512
7700e2ab0c38f7b1a3190843f603b572f7952e4a3567855fbaf2f1085f7e5b4fcdaa97e9195a43299594a5c3b31d15232cb66d9c59a4231cc83487663ded832c

Download Submit
C:\Users\Admin\AppData\Roaming\mymacro\qdisp.dll
Filesize
43KB

MD5
7171bc500507f070355c8903e0ea6d3d

SHA1
073d479fdbd1f2af5d494e90b950098be63dee75

SHA256
3e02f67604dcc1f9e2f107e3dc04f9dcdc59431b2a9323838b61c427c63b997c

SHA512
a8162de29e73f7a198ab7b592c393c8b39e42d5f6649efeca300a90dd7c70178fca1cfcd1f721588dcff296d5245f9ebfa289c6525c7e8621c8eef3e77787622

Download Submit
memory/4584-312-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-331-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-6-0x0000000000401000-0x00000000005F0000-memory.dmp

Filesize
1.9MB

Download
memory/4584-301-0x0000000007760000-0x0000000007C8E000-memory.dmp

Filesize
5.2MB

Download
memory/4584-302-0x0000000007760000-0x0000000007C8E000-memory.dmp

Filesize
5.2MB

Download
memory/4584-313-0x0000000007760000-0x0000000007C8E000-memory.dmp

Filesize
5.2MB

Download
memory/4584-4-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-314-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-316-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-317-0x0000000000401000-0x00000000005F0000-memory.dmp

Filesize
1.9MB

Download
memory/4584-318-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-47-0x0000000005D60000-0x0000000005D6F000-memory.dmp

Filesize
60KB

Download
memory/4584-332-0x0000000007760000-0x0000000007C8E000-memory.dmp

Filesize
5.2MB

Download
memory/4584-333-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-335-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-337-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-339-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-341-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-343-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-345-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-347-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-349-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-351-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/4584-352-0x0000000007760000-0x0000000007C8E000-memory.dmp

Filesize
5.2MB

Download