b0a480c9a1e292b18a55b8d79bc3efccdb2936510226b0f313d14df8ac67627f

Analysis

max time kernel
150s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
24-01-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

msi1217YD.msi
Size

112.2MB
MD5

73de0e9331c6fa90bc0b78d1fd8371e7
SHA1

df579476fbcb6b0848b73fcf52c7879461d838a8
SHA256

b0a480c9a1e292b18a55b8d79bc3efccdb2936510226b0f313d14df8ac67627f
SHA512

57e985d3044e2597cf5c22207694c95268aff713c3d80a70332e54607a3fe8ec07a451593c65a55cb2c4228c830fab9d3be86141222784834b845b7738014e73
SSDEEP

3145728:4B4swQOP2kt4/iUOsdQidkLgvEtRxGH2/ril:4BxOhS/iUZ7dNE1GW/ril

Score

7^/10

vmprotect

Malware Config

Signatures

Executes dropped EXE 6 IoCs

Processes:

MSIDF09.tmpWinRAR.exeRarExtInstaller.exetiak.exehelp360.exeYloux.exe

pid process

1284 MSIDF09.tmp
1452 WinRAR.exe
4440 RarExtInstaller.exe
2996 tiak.exe
4256 help360.exe
4592 Yloux.exe
Loads dropped DLL 9 IoCs

Processes:

MsiExec.exeMsiExec.exe

pid process

3884 MsiExec.exe
3884 MsiExec.exe
3884 MsiExec.exe
3884 MsiExec.exe
3884 MsiExec.exe
3884 MsiExec.exe
3884 MsiExec.exe
2836 MsiExec.exe
2836 MsiExec.exe

pid	process
1284	MSIDF09.tmp
1452	WinRAR.exe
4440	RarExtInstaller.exe
2996	tiak.exe
4256	help360.exe
4592	Yloux.exe

pid	process
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe

VMProtect packed file 10 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe	vmprotect
C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe	vmprotect
behavioral4/memory/2996-134-0x0000000000400000-0x00000000017E3000-memory.dmp	vmprotect
behavioral4/memory/2996-137-0x0000000000400000-0x00000000017E3000-memory.dmp	vmprotect
C:\tkhkel\help360.exe	vmprotect
C:\tkhkel\help360.exe	vmprotect
behavioral4/memory/4256-146-0x0000000001000000-0x0000000001892000-memory.dmp	vmprotect
behavioral4/memory/4256-145-0x0000000001000000-0x0000000001892000-memory.dmp	vmprotect
behavioral4/memory/2996-148-0x0000000000400000-0x00000000017E3000-memory.dmp	vmprotect
behavioral4/memory/4256-168-0x0000000001000000-0x0000000001892000-memory.dmp	vmprotect

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exeYloux.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	Yloux.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	Yloux.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	Yloux.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	Yloux.exe
File opened (read-only)	\??\O:	Yloux.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	Yloux.exe
File opened (read-only)	\??\W:	Yloux.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	Yloux.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	Yloux.exe
File opened (read-only)	\??\Q:	Yloux.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	Yloux.exe
File opened (read-only)	\??\I:	Yloux.exe
File opened (read-only)	\??\M:	Yloux.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	Yloux.exe
File opened (read-only)	\??\Z:	Yloux.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	Yloux.exe
File opened (read-only)	\??\U:	Yloux.exe
File opened (read-only)	\??\Y:	Yloux.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	Yloux.exe
File opened (read-only)	\??\X:	Yloux.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Windows directory 20 IoCs

Processes:

msiexec.exehelp360.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSID293.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB924AD74C1AFBE1D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9030E425F9AF52C7.TMP	msiexec.exe
File created	C:\windows\Runn\1.bin	help360.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7A5.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d11d.msi	msiexec.exe
File created	C:\windows\Runn\DuiLib_u.dll	help360.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF09.tmp	msiexec.exe
File created	C:\windows\Runn\sqlite3.dll	help360.exe
File created	C:\windows\Runn\Yloux.exe	help360.exe
File created	C:\Windows\Installer\e57d11b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d11b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID205.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E6C2C2A4-976C-456E-8B31-3C8498ED1505}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF67EE7F1FF0C6F62E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0EC4CECF4C26D01C.TMP	msiexec.exe
File created	C:\windows\Runn\WindowsTask.exe	help360.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b3208ec6c7545fa70000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b3208ec60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b3208ec6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db3208ec6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b3208ec600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe

Modifies registry class 24 IoCs

Processes:

msiexec.execmd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4A2C2C6EC679E654B813C34889DE5150\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\595B0A00A3775C64C9749273228677A9\4A2C2C6EC679E654B813C34889DE5150	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\PackageCode = "977FBAA989737D34C8F68182943D8C3B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\595B0A00A3775C64C9749273228677A9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\ProductName = "youdaysxghew"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\SourceList\PackageName = "msi1217YD.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4A2C2C6EC679E654B813C34889DE5150	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4A2C2C6EC679E654B813C34889DE5150\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\Local Settings	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1500 PING.EXE

pid	process
1500	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exetiak.exehelp360.exeYloux.exe

pid	process
2012	msiexec.exe
2012	msiexec.exe
2996	tiak.exe
2996	tiak.exe
2996	tiak.exe
2996	tiak.exe
4256	help360.exe
4256	help360.exe
4256	help360.exe
4256	help360.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe
4592	Yloux.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2620	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2620	msiexec.exe
Token: SeSecurityPrivilege	2012	msiexec.exe
Token: SeCreateTokenPrivilege	2620	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2620	msiexec.exe
Token: SeLockMemoryPrivilege	2620	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2620	msiexec.exe
Token: SeMachineAccountPrivilege	2620	msiexec.exe
Token: SeTcbPrivilege	2620	msiexec.exe
Token: SeSecurityPrivilege	2620	msiexec.exe
Token: SeTakeOwnershipPrivilege	2620	msiexec.exe
Token: SeLoadDriverPrivilege	2620	msiexec.exe
Token: SeSystemProfilePrivilege	2620	msiexec.exe
Token: SeSystemtimePrivilege	2620	msiexec.exe
Token: SeProfSingleProcessPrivilege	2620	msiexec.exe
Token: SeIncBasePriorityPrivilege	2620	msiexec.exe
Token: SeCreatePagefilePrivilege	2620	msiexec.exe
Token: SeCreatePermanentPrivilege	2620	msiexec.exe
Token: SeBackupPrivilege	2620	msiexec.exe
Token: SeRestorePrivilege	2620	msiexec.exe
Token: SeShutdownPrivilege	2620	msiexec.exe
Token: SeDebugPrivilege	2620	msiexec.exe
Token: SeAuditPrivilege	2620	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2620	msiexec.exe
Token: SeChangeNotifyPrivilege	2620	msiexec.exe
Token: SeRemoteShutdownPrivilege	2620	msiexec.exe
Token: SeUndockPrivilege	2620	msiexec.exe
Token: SeSyncAgentPrivilege	2620	msiexec.exe
Token: SeEnableDelegationPrivilege	2620	msiexec.exe
Token: SeManageVolumePrivilege	2620	msiexec.exe
Token: SeImpersonatePrivilege	2620	msiexec.exe
Token: SeCreateGlobalPrivilege	2620	msiexec.exe
Token: SeCreateTokenPrivilege	2620	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2620	msiexec.exe
Token: SeLockMemoryPrivilege	2620	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2620	msiexec.exe
Token: SeMachineAccountPrivilege	2620	msiexec.exe
Token: SeTcbPrivilege	2620	msiexec.exe
Token: SeSecurityPrivilege	2620	msiexec.exe
Token: SeTakeOwnershipPrivilege	2620	msiexec.exe
Token: SeLoadDriverPrivilege	2620	msiexec.exe
Token: SeSystemProfilePrivilege	2620	msiexec.exe
Token: SeSystemtimePrivilege	2620	msiexec.exe
Token: SeProfSingleProcessPrivilege	2620	msiexec.exe
Token: SeIncBasePriorityPrivilege	2620	msiexec.exe
Token: SeCreatePagefilePrivilege	2620	msiexec.exe
Token: SeCreatePermanentPrivilege	2620	msiexec.exe
Token: SeBackupPrivilege	2620	msiexec.exe
Token: SeRestorePrivilege	2620	msiexec.exe
Token: SeShutdownPrivilege	2620	msiexec.exe
Token: SeDebugPrivilege	2620	msiexec.exe
Token: SeAuditPrivilege	2620	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2620	msiexec.exe
Token: SeChangeNotifyPrivilege	2620	msiexec.exe
Token: SeRemoteShutdownPrivilege	2620	msiexec.exe
Token: SeUndockPrivilege	2620	msiexec.exe
Token: SeSyncAgentPrivilege	2620	msiexec.exe
Token: SeEnableDelegationPrivilege	2620	msiexec.exe
Token: SeManageVolumePrivilege	2620	msiexec.exe
Token: SeImpersonatePrivilege	2620	msiexec.exe
Token: SeCreateGlobalPrivilege	2620	msiexec.exe
Token: SeCreateTokenPrivilege	2620	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2620	msiexec.exe
Token: SeLockMemoryPrivilege	2620	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

msiexec.exeWinRAR.exe

pid process

2620 msiexec.exe
1452 WinRAR.exe
1452 WinRAR.exe
1452 WinRAR.exe
1452 WinRAR.exe
1452 WinRAR.exe
1452 WinRAR.exe
2620 msiexec.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

WinRAR.exe

pid process

1452 WinRAR.exe
1452 WinRAR.exe
1452 WinRAR.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

tiak.exeYloux.exe

pid process

2996 tiak.exe
2996 tiak.exe
4592 Yloux.exe

pid	process
2620	msiexec.exe
1452	WinRAR.exe
1452	WinRAR.exe
1452	WinRAR.exe
1452	WinRAR.exe
1452	WinRAR.exe
1452	WinRAR.exe
2620	msiexec.exe

pid	process
1452	WinRAR.exe
1452	WinRAR.exe
1452	WinRAR.exe

pid	process
2996	tiak.exe
2996	tiak.exe
4592	Yloux.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

msiexec.exeMSIDF09.tmpcmd.exeWinRAR.exeWScript.exetiak.execmd.exehelp360.exe

description	pid	process	target process
PID 2012 wrote to memory of 3884	2012	msiexec.exe	MsiExec.exe
PID 2012 wrote to memory of 3884	2012	msiexec.exe	MsiExec.exe
PID 2012 wrote to memory of 3884	2012	msiexec.exe	MsiExec.exe
PID 2012 wrote to memory of 3200	2012	msiexec.exe	srtasks.exe
PID 2012 wrote to memory of 3200	2012	msiexec.exe	srtasks.exe
PID 2012 wrote to memory of 2836	2012	msiexec.exe	MsiExec.exe
PID 2012 wrote to memory of 2836	2012	msiexec.exe	MsiExec.exe
PID 2012 wrote to memory of 2836	2012	msiexec.exe	MsiExec.exe
PID 2012 wrote to memory of 1284	2012	msiexec.exe	MSIDF09.tmp
PID 2012 wrote to memory of 1284	2012	msiexec.exe	MSIDF09.tmp
PID 2012 wrote to memory of 1284	2012	msiexec.exe	MSIDF09.tmp
PID 1284 wrote to memory of 796	1284	MSIDF09.tmp	cmd.exe
PID 1284 wrote to memory of 796	1284	MSIDF09.tmp	cmd.exe
PID 1284 wrote to memory of 796	1284	MSIDF09.tmp	cmd.exe
PID 796 wrote to memory of 1452	796	cmd.exe	WinRAR.exe
PID 796 wrote to memory of 1452	796	cmd.exe	WinRAR.exe
PID 796 wrote to memory of 5028	796	cmd.exe	WScript.exe
PID 796 wrote to memory of 5028	796	cmd.exe	WScript.exe
PID 796 wrote to memory of 5028	796	cmd.exe	WScript.exe
PID 1452 wrote to memory of 4440	1452	WinRAR.exe	RarExtInstaller.exe
PID 1452 wrote to memory of 4440	1452	WinRAR.exe	RarExtInstaller.exe
PID 5028 wrote to memory of 2820	5028	WScript.exe	cmd.exe
PID 5028 wrote to memory of 2820	5028	WScript.exe	cmd.exe
PID 5028 wrote to memory of 2820	5028	WScript.exe	cmd.exe
PID 5028 wrote to memory of 2996	5028	WScript.exe	tiak.exe
PID 5028 wrote to memory of 2996	5028	WScript.exe	tiak.exe
PID 5028 wrote to memory of 2996	5028	WScript.exe	tiak.exe
PID 2996 wrote to memory of 4256	2996	tiak.exe	help360.exe
PID 2996 wrote to memory of 4256	2996	tiak.exe	help360.exe
PID 2996 wrote to memory of 4256	2996	tiak.exe	help360.exe
PID 2996 wrote to memory of 2564	2996	tiak.exe	iexplore.exe
PID 2996 wrote to memory of 2564	2996	tiak.exe	iexplore.exe
PID 2996 wrote to memory of 784	2996	tiak.exe	cmd.exe
PID 2996 wrote to memory of 784	2996	tiak.exe	cmd.exe
PID 2996 wrote to memory of 784	2996	tiak.exe	cmd.exe
PID 784 wrote to memory of 1500	784	cmd.exe	PING.EXE
PID 784 wrote to memory of 1500	784	cmd.exe	PING.EXE
PID 784 wrote to memory of 1500	784	cmd.exe	PING.EXE
PID 4256 wrote to memory of 4592	4256	help360.exe	Yloux.exe
PID 4256 wrote to memory of 4592	4256	help360.exe	Yloux.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\msi1217YD.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2620

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CF5E4BB14512A2AB11BCC623628945DB C
  2⤵
  - Loads dropped DLL
  PID:3884
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3200
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F6170BCE32FC46D0B3D51834362B1CB
  2⤵
  - Loads dropped DLL
  PID:2836
- C:\Windows\Installer\MSIDF09.tmp
  "C:\Windows\Installer\MSIDF09.tmp" /EnforcedRunAsAdmin /RunAsAdmin "C:\Users\Admin\AppData\Roaming\YOUDAO\217.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Roaming\YOUDAO\217.bat" "
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Users\Admin\AppData\Roaming\YOUDAO\WinRAR.exe
      C:\Users\Admin\AppData\Roaming\YOUDAO\WinRAR.exe x -p7758523s -ibck 1.zip tiak.exe
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Users\Admin\AppData\Roaming\YOUDAO\RarExtInstaller.exe
        
        "C:\Users\Admin\AppData\Roaming\YOUDAO\RarExtInstaller.exe" -install
        5⤵
        Executes dropped EXE
        
        PID:4440
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\YOUDAO\3.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c del %cd%\66.bat
        5⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe
        
        "C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2996
      - C:\tkhkel\help360.exe
        
        C:\tkhkel\help360.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\windows\Runn\Yloux.exe
        
        "C:\windows\Runn\Yloux.exe"
        7⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4592
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://sms-activate.ru/cn/getNumber
        6⤵
        Modifies Internet Explorer settings
        
        PID:2564
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 5 &del "C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        7⤵
        Runs ping.exe
        
        PID:1500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57d11c.rbs

Filesize
420KB

MD5
04d502d3c34a6d2e3c2117619785935c

SHA1
f5794321ac737246376ce9fbb1c10730557752d9

SHA256
7a6a1ecd2d16f3f0f71e23205f8d399ef2c3848ede7d2091a487777798ab6cc8

SHA512
20c88bb14893479faf8d913855ca0dcbbde7e42b30a0e95c6893aae06c8e524d57d6dcf4767883a3b5260716f1751ffac9dbc4cb1006efdcd90d5411924b04a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8964.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Roaming\YOUDAO\1.zip

Filesize
10.5MB

MD5
f676271690b54795a07e5cf179e52764

SHA1
7814cfa9c90f520f13089e6d2e80c78145079618

SHA256
4f2266fd08bdb07faf29c61eb51db85e53e8cb9cfdc885115d38e28e147ab2a5

SHA512
1c7c2203b442d08816756c2bd7cd7775d5a37d9cbf9e46380a3282dac4a886c424b2dd7bceec10d9f39fa98d3eb3b23fe61c3e15b6712292ce8d9e4cebe15909

Download Submit
C:\Users\Admin\AppData\Roaming\YOUDAO\217.bat

Filesize
91B

MD5
cb242c95a12c2107f242a0f1620216e1

SHA1
899cf47f75e292d4a3696b23df68e19b090c0218

SHA256
429376ad0492dd8b4e03dc113888cbce866b5e9b6c3e72c82c6ee3fc006f6e6f

SHA512
42d56db973fa3c9f7c414d4a9f4bffe28e089ad542556ae054a0b15f264c4060d3777064461920a0fd864a57bea715f71daf5c858f6c66d960587ade3b457e4c

Download Submit
C:\Users\Admin\AppData\Roaming\YOUDAO\3.vbs

Filesize
439B

MD5
ff1eac510e2fb9c00a39ee817826be7b

SHA1
36485d145164c922d8c4ff92fa879bdba1a9ad5e

SHA256
e96ecf797d784b8bab8d70a264f1fd6ca6b679a477af4bf6887f6635f8d42bcd

SHA512
d44f4cc8445371636c9a728817a4d8321220968ff70955c3dec0a7521b1741972aa92a1190a1e0b4d08770ef0e806a84226836d8ca0ff20d21355a96cc214d2f

Download Submit
C:\Users\Admin\AppData\Roaming\YOUDAO\RarExt.dll

Filesize
616KB

MD5
9b06731ee83e501c39a758c554dba159

SHA1
042f43cd2f99767cdbdf23eaf1775288f981d868

SHA256
d4a9d0be3da3073bc1d9dd770bd86fb58222bb61a1882d5059a6c07fba8be924

SHA512
d9448d69a00c727c3b025f093da9f184906430dfd93ae2d81c29d2ce8ee5dfb8adf3340557982ef9e8d59b4d012f024ff6e39b225c1386041c0afe0f15780a62

Download Submit
C:\Users\Admin\AppData\Roaming\YOUDAO\RarExtInstaller.exe

Filesize
176KB

MD5
9ceaaadfb9303cfee55475b014084ae6

SHA1
32ae5c8d9bac5d164e6b30d56d83063c6b370c80

SHA256
eb0a02fe41ff087051d90aebda7ce9c56737fd20896e80503e08a4633c16f600

SHA512
7947941e45d0e997da24711dcd7d7a7c1357a14bf7b2acf50e6177872fe6d7c1305cd7bd0d68bcb9a5edd29a8e94e5c5a292cfaa8229281696d41218f4ba8e37

Download Submit
C:\Users\Admin\AppData\Roaming\YOUDAO\RarExtPackage.msix

Filesize
22KB

MD5
8930103e0ca45afe89ca8efeb220eb2b

SHA1
930749a346dc3d47520451a0c92edc62ae8f00f8

SHA256
5a28814263254683282bc5bd0ca6ecf35b2ffe3c2e27cefdc2e1a61afb5a8e6f

SHA512
aad319aaece4b7b888e1580025cc584c4249fb0f65023a039885c4dc786644afc2cf53d3de50e09543fbf4605b82121d5f3068643d5feae89a8844018c1081a9

Download Submit
C:\Users\Admin\AppData\Roaming\YOUDAO\WinRAR.exe

Filesize
2.3MB

MD5
c343e5e43e2657c82bc0ed9b80c7ffdf

SHA1
a56bab6f439e105bafa212a8ac907ef6019adfe7

SHA256
57b7698d4caa84cb4f6cf043cd4930ee018956337f40fbc138af21f9c2c06d3a

SHA512
2e1394f27e106c0a1290dd38d5244803c88ee1f7eb14095b0ef3f74909e95e4d8265076eef60fedf9fdb0cbe7f549702af6c5092de7c03902ef56ee6db972d58

Download Submit
C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe

Filesize
7.1MB

MD5
ce6e175f5e478f7eaf45889e73e8a138

SHA1
71a3b5dea4c388bdeb90146f0b34eec52d45627c

SHA256
11ddc708690775f20bbe7e5826ce161bf0bd8d9fc48ece0e88ca1053abb4817f

SHA512
896a45d5e4f54e0d4f5ee5fb3e15dc5b78a16b910f6b65aad9e61502644f2afcd64d6401e8d53d07b1e84dfffa03c223d7cce114de2053d703f07dadfcc9ea8f

Download Submit
C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe

Filesize
7.2MB

MD5
e334c537ac8ec3f6a6fc7107fa392380

SHA1
0611edadecb35e5eb9b57d5c68e027db51af6ecc

SHA256
df85b3de4556de805e222bcf877d2535a15cceee754b9952582466833da9b19b

SHA512
5a6f4ba673cc8dd194708215f25204469e95411c7422ba6abaac890b2f7b39ac5bc4e11200677c17869d132e1fb8c653490d5d797ec2b7938071fd6dd57ac289

Download Submit
C:\Windows\Installer\MSIDF09.tmp

Filesize
409KB

MD5
f7e1ad874fba884ceabfdb0f8edf74bb

SHA1
dcd89a248a6e3d85bb3f7eae624a41cef9704654

SHA256
bbce37f9e20f5bc59ab45dc49c985d115b13bb214561ddb874118fd91fb52ce8

SHA512
5e59de04305aff37703e928a594b9114fb728e3285c09aae7706339d9f9ee77652271de5899738e8410d13224838efb3e30f5ab4e149c21458d3c971010dd209

Download Submit
C:\Windows\Installer\e57d11b.msi

Filesize
61.1MB

MD5
e74fa66c286deff6232ff446216cc470

SHA1
b64ad132cd9d2d0380c52f53879dcc9dcc895e4a

SHA256
46c4566dcc48c174fe7bc3529d090e2425ca72b7d0d3d388ba8204f2631ae49f

SHA512
7ce91721094a0d8a05c2885c7068b8c0d02e58664f7eec50ab689d9eff28df676b356ef9dedcb12e1fd92ee08a5f97f814f07e6e6c342c637dbd9a8c8ccacb9c

Download Submit
C:\Windows\Runn\Yloux.exe

Filesize
2.5MB

MD5
81590a0dbb3cbc448bafb2161619d2e9

SHA1
0cf224e66413fd7aa32ce4c590fd1f062b60308d

SHA256
f03112820d76d5d8a53615e032e1bf35565d37bca72ca52464d2b5fe13538d40

SHA512
a92d8f7ab0c243fcb87113d46b1b1bdc2cef4421d517608a9b8ee1d1d74703bed2b5c6fd8a366792d27f03a59ad9aa1a61109ea94c52b14b06605048da032013

Download Submit
C:\Windows\Runn\Yloux.exe

Filesize
3.0MB

MD5
9289c4d7ce63082a6b104b49382273c9

SHA1
541187577d7fdea110b8868f2f059d4c2c34b9fc

SHA256
875e0934d086e6bb3cc03d65d3ef60a7b2f69b966e64de015541db5748d376db

SHA512
c3807c8a4e1d5aef81b19eb3df5ce54494264d75c191c6b4387902b133a2b934864706f59e927e9b1bb96712270863ca02137b49f695b10281f227fe6710628e

Download Submit
C:\tkhkel\help360.exe

Filesize
2.6MB

MD5
54f23836a37e9b1ccb7293e78d380f6b

SHA1
770c1c20f2c269d94ab68e4158f46d47540d75b7

SHA256
778173ce9df37c9b2dbeeefc8e7c201d935d38c0f017d5909edbf30cd84f3b5b

SHA512
31963bb8b74404d740086b08d178778152b2e4de5010650bdfc722870c5212a35ba0f31e55a12070e4a7380f9bba88d8a76611abe0baef6d91596e1a65dc680a

Download Submit
C:\tkhkel\help360.exe

Filesize
2.7MB

MD5
a7aa3b45fcde9c907c21315d382faab8

SHA1
5e6fb3adb517089f09f57cf09ec77b073b49a177

SHA256
fb03d18aed866276d2a8b63610978ee7ac7eb6d2fbc9e352879f881b1e9d1b10

SHA512
ea434325e06ed6b27730b3e10a0711c9f396a2eaa88a819e8db3e213724e8b49933b3329d2dfdd49277ed7819c9e4c430c017c7864c94e353e15216060559805

Download Submit
C:\windows\Runn\1.bin

Filesize
176KB

MD5
3d7d682f44b0b12b5518d3e9c6c11d2a

SHA1
23869cb52e797c0f5c64364af8c78c49c71b9c27

SHA256
702eb45ead6494f36944f5d16e5aef30de138c6d16fdf92eedd098fb59fa5347

SHA512
6295f519308b8ccd4ce6cea1058340dc25fdba5414a44c8c952437dc2cdea42b783e476ded8c855d0423895c1e8d0667eda817d956322d78ceeb5e10139af550

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
6.7MB

MD5
584f2206cd07b1ead19f4b25ec252422

SHA1
f5398f0cb9646e0a62685fbaa0c8355a4bbb01a2

SHA256
ff8619691201493d929e5ef02012a616c3df255863b4efa2059d950315a5329e

SHA512
f401d20435617846444afd5a833a957fbad33c441f2b64f3b47a78c5bb47939b6e3e06f20cd3f7c59c0bb6ae75d0d75aa1f710746f83db767002d34377e122cf

Download Submit
\??\Volume{c68e20b3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6986901f-801c-42a7-869d-f2e45c9f18d8}_OnDiskSnapshotProp

Filesize
6KB

MD5
85ee5d94aca1c877a5b022cda7c4c264

SHA1
32d3882ebf4859604caded6137106c729dd0377e

SHA256
141b8806fd53e040e3ad7248adf5550cf9025b963dd77d73781a5d987d870627

SHA512
eaa761ba3399089ba544521f6053998976b9cf83d6cf8bb7b5806334472f28afcc7de521d6f22b088a7ff7355928176fabc33e16268ffba572bfb612695a7fb9

Download Submit
memory/2996-130-0x0000000003690000-0x0000000003691000-memory.dmp

Filesize
4KB

Download
memory/2996-135-0x00000000036D0000-0x00000000036D1000-memory.dmp

Filesize
4KB

Download
memory/2996-137-0x0000000000400000-0x00000000017E3000-memory.dmp

Filesize
19.9MB

Download
memory/2996-132-0x00000000036B0000-0x00000000036B1000-memory.dmp

Filesize
4KB

Download
memory/2996-133-0x00000000036C0000-0x00000000036C1000-memory.dmp

Filesize
4KB

Download
memory/2996-134-0x0000000000400000-0x00000000017E3000-memory.dmp

Filesize
19.9MB

Download
memory/2996-128-0x0000000001A60000-0x0000000001A61000-memory.dmp

Filesize
4KB

Download
memory/2996-131-0x00000000036A0000-0x00000000036A1000-memory.dmp

Filesize
4KB

Download
memory/2996-148-0x0000000000400000-0x00000000017E3000-memory.dmp

Filesize
19.9MB

Download
memory/2996-129-0x0000000003660000-0x0000000003661000-memory.dmp

Filesize
4KB

Download
memory/4256-146-0x0000000001000000-0x0000000001892000-memory.dmp

Filesize
8.6MB

Download
memory/4256-150-0x0000000010000000-0x0000000010604000-memory.dmp

Filesize
6.0MB

Download
memory/4256-149-0x0000000003760000-0x0000000003D60000-memory.dmp

Filesize
6.0MB

Download
memory/4256-145-0x0000000001000000-0x0000000001892000-memory.dmp

Filesize
8.6MB

Download
memory/4256-168-0x0000000001000000-0x0000000001892000-memory.dmp

Filesize
8.6MB

Download
memory/4256-144-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/4592-179-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/4592-183-0x0000000002B30000-0x0000000002B74000-memory.dmp

Filesize
272KB

Download
memory/4592-176-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/4592-177-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/4592-178-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/4592-169-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/4592-180-0x0000000002B30000-0x0000000002B74000-memory.dmp

Filesize
272KB

Download
memory/4592-181-0x0000000002B30000-0x0000000002B74000-memory.dmp

Filesize
272KB

Download
memory/4592-182-0x0000000002AE0000-0x0000000002B1E000-memory.dmp

Filesize
248KB

Download
memory/4592-175-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/4592-184-0x0000000002B30000-0x0000000002B74000-memory.dmp

Filesize
272KB

Download
memory/4592-167-0x0000000000C40000-0x0000000000C6D000-memory.dmp

Filesize
180KB

Download
memory/4592-187-0x0000000000400000-0x0000000000590000-memory.dmp

Filesize
1.6MB

Download
memory/4592-194-0x0000000002B30000-0x0000000002B74000-memory.dmp

Filesize
272KB

Download
memory/4592-197-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/4592-198-0x0000000002B30000-0x0000000002B74000-memory.dmp

Filesize
272KB

Download
memory/4592-200-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/4592-201-0x0000000002B30000-0x0000000002B74000-memory.dmp

Filesize
272KB

Download