fatalrat | fee4bc48a833facbde77aeb03320697fe7a1e54d633f6d9f157cf994b2a405f1

Analysis

max time kernel
142s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d348b2fd315d69bb969cd00d30f1f11eeb45656e4e429e6555eebdd5a566e5b2.msi
Size

45.4MB
MD5

b548cd27d7cc4d966305c2fc5c0ee5e1
SHA1

2f116d9e09a8796c040abe8ca5f6637e1110ea8c
SHA256

d348b2fd315d69bb969cd00d30f1f11eeb45656e4e429e6555eebdd5a566e5b2
SHA512

8f5ec981769a44575f215fe53b58b4c6522efa98bfd7eb409ca166cd1dca766fc5f6f8af04ec9d3ace3ad1b54b3ad62612e8a599840161ff685c001aab32c086
SSDEEP

786432:1ELiyuxCaAPkt69LZSq5EfJ9WEH9aSeLHDKsn3MoNh2Z51JbY+R4+pjRxt7iQetk:1EiEaAW6FZSqSWs9aSeLHDWk2Z5O+fxX

Score

10^/10

fatalrat gh0strat bootkit discovery infostealer persistence privilege_escalation rat upx

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3040-663-0x00000000042C0000-0x000000000440D000-memory.dmp	family_gh0strat
behavioral1/memory/3040-664-0x00000000042C0000-0x000000000440D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Fatal Rat payload 2 IoCs

rat infostealer

Processes:

resource	yara_rule
behavioral1/memory/3040-511-0x0000000000790000-0x00000000007BA000-memory.dmp	fatalrat
behavioral1/memory/808-475-0x0000000001F90000-0x0000000001FBA000-memory.dmp	fatalrat

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3040-663-0x00000000042C0000-0x000000000440D000-memory.dmp	upx
behavioral1/memory/3040-664-0x00000000042C0000-0x000000000440D000-memory.dmp	upx
behavioral1/memory/3040-660-0x00000000042C0000-0x000000000440D000-memory.dmp	upx

Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exemsiexec.exeMsiExec.exe

flow	pid	Process
3	2532	msiexec.exe
5	2532	msiexec.exe
6	1852	msiexec.exe
14	1044	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

Sogou.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Sogou.exe

Drops file in Windows directory 24 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE541.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE797.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE91F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIE0B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE173.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE32C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE931.tmp	msiexec.exe
File created	C:\Windows\Installer\f76dd83.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5FD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE930.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f76dd86.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76dd86.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76dd83.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE465.tmp	msiexec.exe

Executes dropped EXE 5 IoCs

Processes:

MSIE91F.tmpMSIE930.tmpthelper.exeSogou.exethelper.exe

pid	Process
1524	MSIE91F.tmp
2292	MSIE930.tmp
808	thelper.exe
2100	Sogou.exe
3040	thelper.exe

Loads dropped DLL 38 IoCs

Processes:

MsiExec.exeMsiExec.exethelper.exethelper.exeSogou.exe

pid	Process
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
2716	MsiExec.exe
2716	MsiExec.exe
1044	MsiExec.exe
808	thelper.exe
808	thelper.exe
808	thelper.exe
808	thelper.exe
808	thelper.exe
808	thelper.exe
808	thelper.exe
808	thelper.exe
808	thelper.exe
808	thelper.exe
808	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
2100	Sogou.exe
2100	Sogou.exe
2100	Sogou.exe
2100	Sogou.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

Processes:

msiexec.exe

pid	Process
2532	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MSIE91F.tmpMSIE930.tmpthelper.exeSogou.exethelper.exeMsiExec.exeMsiExec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIE91F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIE930.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sogou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

thelper.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	thelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	thelper.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

MsiExec.exemsiexec.exeSogou.exethelper.exe

pid	Process
1044	MsiExec.exe
1852	msiexec.exe
1852	msiexec.exe
2100	Sogou.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
3040	thelper.exe
2100	Sogou.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	Process
Token: SeShutdownPrivilege	2532	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	1852	msiexec.exe
Token: SeTakeOwnershipPrivilege	1852	msiexec.exe
Token: SeSecurityPrivilege	1852	msiexec.exe
Token: SeCreateTokenPrivilege	2532	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2532	msiexec.exe
Token: SeLockMemoryPrivilege	2532	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2532	msiexec.exe
Token: SeMachineAccountPrivilege	2532	msiexec.exe
Token: SeTcbPrivilege	2532	msiexec.exe
Token: SeSecurityPrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeLoadDriverPrivilege	2532	msiexec.exe
Token: SeSystemProfilePrivilege	2532	msiexec.exe
Token: SeSystemtimePrivilege	2532	msiexec.exe
Token: SeProfSingleProcessPrivilege	2532	msiexec.exe
Token: SeIncBasePriorityPrivilege	2532	msiexec.exe
Token: SeCreatePagefilePrivilege	2532	msiexec.exe
Token: SeCreatePermanentPrivilege	2532	msiexec.exe
Token: SeBackupPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeShutdownPrivilege	2532	msiexec.exe
Token: SeDebugPrivilege	2532	msiexec.exe
Token: SeAuditPrivilege	2532	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2532	msiexec.exe
Token: SeChangeNotifyPrivilege	2532	msiexec.exe
Token: SeRemoteShutdownPrivilege	2532	msiexec.exe
Token: SeUndockPrivilege	2532	msiexec.exe
Token: SeSyncAgentPrivilege	2532	msiexec.exe
Token: SeEnableDelegationPrivilege	2532	msiexec.exe
Token: SeManageVolumePrivilege	2532	msiexec.exe
Token: SeImpersonatePrivilege	2532	msiexec.exe
Token: SeCreateGlobalPrivilege	2532	msiexec.exe
Token: SeBackupPrivilege	1960	vssvc.exe
Token: SeRestorePrivilege	1960	vssvc.exe
Token: SeAuditPrivilege	1960	vssvc.exe
Token: SeBackupPrivilege	1852	msiexec.exe
Token: SeRestorePrivilege	1852	msiexec.exe
Token: SeRestorePrivilege	744	DrvInst.exe
Token: SeRestorePrivilege	744	DrvInst.exe
Token: SeRestorePrivilege	744	DrvInst.exe
Token: SeRestorePrivilege	744	DrvInst.exe
Token: SeRestorePrivilege	744	DrvInst.exe
Token: SeRestorePrivilege	744	DrvInst.exe
Token: SeRestorePrivilege	744	DrvInst.exe
Token: SeLoadDriverPrivilege	744	DrvInst.exe
Token: SeLoadDriverPrivilege	744	DrvInst.exe
Token: SeLoadDriverPrivilege	744	DrvInst.exe
Token: SeRestorePrivilege	1852	msiexec.exe
Token: SeTakeOwnershipPrivilege	1852	msiexec.exe
Token: SeRestorePrivilege	1852	msiexec.exe
Token: SeTakeOwnershipPrivilege	1852	msiexec.exe
Token: SeRestorePrivilege	1852	msiexec.exe
Token: SeTakeOwnershipPrivilege	1852	msiexec.exe
Token: SeRestorePrivilege	1852	msiexec.exe
Token: SeTakeOwnershipPrivilege	1852	msiexec.exe
Token: SeRestorePrivilege	1852	msiexec.exe
Token: SeTakeOwnershipPrivilege	1852	msiexec.exe
Token: SeRestorePrivilege	1852	msiexec.exe
Token: SeTakeOwnershipPrivilege	1852	msiexec.exe
Token: SeRestorePrivilege	1852	msiexec.exe
Token: SeTakeOwnershipPrivilege	1852	msiexec.exe
Token: SeRestorePrivilege	1852	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid	Process
2532	msiexec.exe
2532	msiexec.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

msiexec.exethelper.exe

description	pid	Process	procid_target
PID 1852 wrote to memory of 1044	1852	msiexec.exe	35
PID 1852 wrote to memory of 1044	1852	msiexec.exe	35
PID 1852 wrote to memory of 1044	1852	msiexec.exe	35
PID 1852 wrote to memory of 1044	1852	msiexec.exe	35
PID 1852 wrote to memory of 1044	1852	msiexec.exe	35
PID 1852 wrote to memory of 1044	1852	msiexec.exe	35
PID 1852 wrote to memory of 1044	1852	msiexec.exe	35
PID 1852 wrote to memory of 2716	1852	msiexec.exe	36
PID 1852 wrote to memory of 2716	1852	msiexec.exe	36
PID 1852 wrote to memory of 2716	1852	msiexec.exe	36
PID 1852 wrote to memory of 2716	1852	msiexec.exe	36
PID 1852 wrote to memory of 2716	1852	msiexec.exe	36
PID 1852 wrote to memory of 2716	1852	msiexec.exe	36
PID 1852 wrote to memory of 2716	1852	msiexec.exe	36
PID 1852 wrote to memory of 1524	1852	msiexec.exe	37
PID 1852 wrote to memory of 1524	1852	msiexec.exe	37
PID 1852 wrote to memory of 1524	1852	msiexec.exe	37
PID 1852 wrote to memory of 1524	1852	msiexec.exe	37
PID 1852 wrote to memory of 1524	1852	msiexec.exe	37
PID 1852 wrote to memory of 1524	1852	msiexec.exe	37
PID 1852 wrote to memory of 1524	1852	msiexec.exe	37
PID 1852 wrote to memory of 2292	1852	msiexec.exe	38
PID 1852 wrote to memory of 2292	1852	msiexec.exe	38
PID 1852 wrote to memory of 2292	1852	msiexec.exe	38
PID 1852 wrote to memory of 2292	1852	msiexec.exe	38
PID 1852 wrote to memory of 2292	1852	msiexec.exe	38
PID 1852 wrote to memory of 2292	1852	msiexec.exe	38
PID 1852 wrote to memory of 2292	1852	msiexec.exe	38
PID 808 wrote to memory of 3040	808	thelper.exe	41
PID 808 wrote to memory of 3040	808	thelper.exe	41
PID 808 wrote to memory of 3040	808	thelper.exe	41
PID 808 wrote to memory of 3040	808	thelper.exe	41

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d348b2fd315d69bb969cd00d30f1f11eeb45656e4e429e6555eebdd5a566e5b2.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2532

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ADC00FF84924DCADDC4391DB380322A7
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9D75747968685A07486A58582E9F3CE M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2716
- C:\Windows\Installer\MSIE91F.tmp
  "C:\Windows\Installer\MSIE91F.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\Sogou.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1524
- C:\Windows\Installer\MSIE930.tmp
  "C:\Windows\Installer\MSIE930.tmp" /DontWait "C:\ProgramData\Microsoft\MF\thelper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B8" "00000000000005A8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\ProgramData\Microsoft\MF\thelper.exe
"C:\ProgramData\Microsoft\MF\thelper.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:808
- C:\Users\Admin\AppData\Local\thelper.exe
  "C:\Users\Admin\AppData\Local\thelper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3040

C:\Users\Admin\AppData\Roaming\Sogou.exe
"C:\Users\Admin\AppData\Roaming\Sogou.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76dd87.rbs

Filesize
377KB

MD5
f65a3deca03d805872ece99670cc641d

SHA1
fc17cfef4ab9e876db6f85220fe3d96985d7360f

SHA256
b26bcefa5aef603432b8f9b1e71b25a0109c7803ee418b69a7c8191b09655823

SHA512
042e4059cb6d9b0c315bad2e9752ba3847c04ea1757ba5b732f04a480d0fdfb348a8e77c45f0dc69bbe70fa67bb8ce6770ce1ab5a37233d5143f0d7be0c59707

Download Submit
C:\ProgramData\Microsoft\MF\Mi.jpg

Filesize
199KB

MD5
6623c712226ec7da02b7a6d2e636f93b

SHA1
ca7cc067795d66d9592f40e7b7f7be2fb8d2381a

SHA256
27550491d63f83141fa86cd048434c4c3990dc215a1d77d2ae6395cea3b0d996

SHA512
b5503e7af6d094a4c5741d621e1ea99eef8bf2a6d77cc994975c2629ebab2b0317a1ad51ce7ddcd44dafaa7461f032ae5d45d79e4537504846989e1b9bb0170b

Download Submit
C:\ProgramData\Microsoft\MF\XLFSIO2.DLL

Filesize
209KB

MD5
1bc7af7a8512cf79d4f0efc5cb138ce3

SHA1
68fd202d9380cacd2f8e0ce06d8df1c03c791c5b

SHA256
ef474b18f89310c067a859d55abd4e4f42fdac732e49eafe4246545e36872a62

SHA512
84de4d193d22a305be2ba28fc67bd1cccf83616cead721e57347f1b2e0736d351fef1abf168f7914caa1bcc7a72db43769991016673cd4646def544802ee8960

Download Submit
C:\ProgramData\Microsoft\MF\XLGraphic.dll

Filesize
730KB

MD5
74c75ae5b97ad708dbe6f69d3a602430

SHA1
a02764d99b44ce4b1d199ef0f8ce73431d094a6a

SHA256
89fbb6b1ca9168a452e803dbdc6343db7c661ad70860a245d76b3b08830156e2

SHA512
52c5f7e00dffb1c0719d18184da2cc8ec2ad178b222775f167b87320f0683a3c2846e30190bc506f12d14c07fa45896935b3d4ac396baa14d7564996e35c2ada

Download Submit
C:\ProgramData\Microsoft\MF\XLUE.dll

Filesize
2.4MB

MD5
0abbe96e1f7a254e23a80f06a1018c69

SHA1
0b83322fd5e18c9da8c013a0ed952cffa34381ae

SHA256
10f099f68741c179d5ad60b226d15233bb02d73f84ce51a5bbbbc4eb6a08e9d4

SHA512
2924e1e11e11bd655f27eb0243f87002a50a2d4b80e0b0e3ad6fd4c3d75c44222fab426fcaa695881b0093babf544e8aeee50a065ea92274145b0f88b1db0c58

Download Submit
C:\ProgramData\Microsoft\MF\thelper.exe

Filesize
226KB

MD5
17749f66292f190ef93652eb512c5ab7

SHA1
e2f651aa9d37404063ffc79e920787c9d3e71fdb

SHA256
0aa17ee66b8dae520e82a94388b1a1d603ec2aed20c464d6cac9a521d4167f24

SHA512
2ef192a191dc40a16c9b8768e749175c1a57319ab896809691effcc5de61c4a38fd8a8388b8907a1985e505907a8529f4d10990e362831092c75dafb8900b13e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\538F535B7FBDE384E456CC9F5DA5FBAB

Filesize
1KB

MD5
6d469ed9256d08235b5e747d1e27dbf2

SHA1
d3dd483e2bbf4c05e8af10f5fa7626cfd3dc3092

SHA256
b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b804

SHA512
04cbf2a5f740d030208136b0ee1db38299943c74efa55045f564268246a929018fcaf26aa02768bb20321aa3f70c4609c163c75a3929ef8da016de000566a74c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\538F535B7FBDE384E456CC9F5DA5FBAB

Filesize
194B

MD5
fb74368ab6a28bf67c038f19dc99ab51

SHA1
353f82a82b93230315e6f589830444755491b917

SHA256
dd6b2849a337602b99d322e259a27733f33668f5f133ee07e3761803cd7b843a

SHA512
04bbaf69e5f520af1f2a576895d4e853b33ec494babfa35234d768d8dda0ac7e479f9bc3a2d8540e915f20e31691063fd6d250ce95b8a7cca81898b6fa64de80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0884f94de62c8fdf03beea45bb2a8ead

SHA1
74f7bc7fe8eca5b9968b252db6223a9b5750dc64

SHA256
8a3cf7bc5b010c0dbddc025cf03d591044e0e7da5becfd043daedea9e8cf5312

SHA512
493ff787fcc45c38ffd93f1b0b1f5fdd01cf7f634632a1414980c585607e676e31ef081a66e2c5bed09f479e4b800fc41981772158315bd5042e03a2327f22db

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c89e2ff508bfba81eedd\74.24.63\tracking.ini

Filesize
84B

MD5
27b7c0c847a715cec816abbe8061e293

SHA1
f258e047cde8f6655b2f9278bc88f5090b28d1ec

SHA256
edc5be33fb626d214664bd729579607949aa1d79827b09be012309afb8235a08

SHA512
7972887bb20967df451bb235e6dc8388f7a45341b616940b4b1b8d52a0c070ec5aa42595f0582513e12628431550e00e4f6e65888d78ab367ab122fdb7e98d22

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c89e2ff508bfba81eedd\74.24.63\{7A7F79E6-B5C0-4076-98CE-0707DE4DA81D}.session

Filesize
4KB

MD5
b833d129007e0e5d470fca4870a754ee

SHA1
aeb8851e55f2e3887e7a9b92f2a944ff7cfd1a16

SHA256
6bb54a5610241ed287b3d7baf2afad68b0e309d129ec187b2ddc47adb10c087a

SHA512
cdfc026080b8d5ac987b73102b35b0923dbb45d2b8c54ba08b4a6d54c4e24ff35712c62c17a2e4acae1fe1f86c2df499841713d44862ec0c8e8d0af00fb85499

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE23.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBEC2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoEB1C.tmp\SetupLib.dll

Filesize
2.5MB

MD5
96e5de7481ab4c69be46bc2055b8c0b3

SHA1
26854a0b1a0e4c08d0fda1fbb2b430c7a5aa1183

SHA256
c9cb61c290140cf63e8fcfcecb4bc6edd43d9d9b5ff0df93f8f71b26c5cd21dc

SHA512
e419b2d4f751b8dbb8c4e9ffcb3bf6ec0bbf69e488e144ea7188d8b1d3574567c559346d941068fa341286342c8ce75f57d074db6cd959d0fdb1d96eb9b4719e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoEB1C.tmp\ioSpecial.ini

Filesize
954B

MD5
923f39ccef2c242acf1347d23181a390

SHA1
8b5094a30d320f11a25948f1264b451d4c7ccad4

SHA256
905bd163f41623612ce14d21d5bd1d35fae1b62b72498fcb4d459946431bfa33

SHA512
a16d816429f831e9f6ac9913e9f5d9ef4fd2b885a552f0953be1ac15de474bbe6adbc0eddfd1d43d28e43226de843bc170526d8339fb5bdb408492588be40aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoEB1C.tmp\validate.ini

Filesize
111B

MD5
6f833a68105fa15445fd02a71f5f6b70

SHA1
65bf80d5978ad1d5f505577e086f476976ee08fd

SHA256
b3134f47d62c3551b288d0b1e64e3643622ee0c9ba7c78a113e78fd372c92356

SHA512
51a080c93183f36ea53acc5a148486441176ee7122cbf3bdb1cb4f7bf3ae25bba190d5be617160a201b032de51d2dfec2eedb2197c30a12f07f95a7e4212dce6

Download Submit
C:\Users\Admin\AppData\Roaming\Sogou.exe

Filesize
38.4MB

MD5
166da5372ada91e8c0ede06ca3db2096

SHA1
9c86e5640b341519c1dba0548c25b732e8164ec2

SHA256
e9cc52087141132cb6026a3cbf5519f621f321adf8c5406f794bad8d7c7cc8af

SHA512
c1dc98dd6b649c439306b09bae9c4304e9832533fb6695408d76f3a550afcb7a226a14815e73edd90f99870157054bec124459d5580b9db77dacbe5f06d5b789

Download Submit
C:\Windows\Installer\MSIE0B7.tmp

Filesize
770KB

MD5
356fc2c181cc37e3f8ae4d6b855ebfcb

SHA1
2ead1e69f14099ae33a3216a9312c88007b73cd1

SHA256
c92b2d9623f19f8acfeac5fd894346515631ebb590e68f22c40a35fbacbef03c

SHA512
74ea73d3206ba1c6f1963caa4866589fe86636f68815c74733644ad6c4913de3f1399770f6095a48c9d94a7d934072d8d8b409a393de644265f6e456455dcebd

Download Submit
C:\Windows\Installer\MSIE1E2.tmp

Filesize
897KB

MD5
6189cdcb92ab9ddbffd95facd0b631fa

SHA1
b74c72cefcb5808e2c9ae4ba976fa916ba57190d

SHA256
519f7ac72beba9d5d7dcf71fcac15546f5cfd3bcfc37a5129e63b4e0be91a783

SHA512
ee9ce27628e7a07849cd9717609688ca4229d47579b69e3d3b5b2e7c2433369de9557ef6a13fa59964f57fb213cd8ca205b35f5791ea126bde5a4e00f6a11caf

Download Submit
C:\Windows\Installer\MSIE930.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\ProgramData\Microsoft\MF\XLFSIO.dll

Filesize
900KB

MD5
a06090c5f2d3df2cedc51cc99e19e821

SHA1
701ac97c2fd140464b234f666a0453d058c9fabf

SHA256
64ffdffb82fc649e6847b3c4f8678d9cca0d5117fa54c9abbb746625d3feef89

SHA512
541804db74a25fc5f50801f23b4d9f2be788d3c95d3d23dd8098f4c8888d1fc808e6eb6959c458965c639ea28b594a87dff7f3a89c4750c109b29b573c4535cf

Download Submit
\ProgramData\Microsoft\MF\XLLuaRuntime.dll

Filesize
249KB

MD5
5362cb2efe55c6d6e9b51849ec0706b2

SHA1
d91acbe95dedc3bcac7ec0051c04ddddd5652778

SHA256
1d7519acca9c8a013c31af2064fbc599a0b14cfd1dfb793a345fab14045fed40

SHA512
dbd591c3d0b9847d9cef59277c03ec89e246db0e54b58fbbe9d492b75cdcb32d75444012cdfb1c77376d15db7fde1f74e694d2487c481ce29a2133342b91e1f5

Download Submit
\ProgramData\Microsoft\MF\ic.dll

Filesize
1.6MB

MD5
bb1197bea58b158554fa3fa25866d1ea

SHA1
cae7f395ed42fa2dd3362f4c816fb678072feb49

SHA256
20a04729fdd8e02e2fb5be79af130c364d0f3ce85e49478a6819a0a2020ae844

SHA512
f80b7669da861400a5b5add8148b85cc62994819e3a3a2220475d7ec2fc31f70bc3c683d5a5d6043b319b428a0ac47b9b41201aee7aba5d5cc927a8556dd7b73

Download Submit
\ProgramData\Microsoft\MF\libexpat.dll

Filesize
668KB

MD5
5ff790879aab8078884eaac71affeb4a

SHA1
59352663fdcf24bb01c1f219410e49c15b51d5c5

SHA256
cceca70f34bbcec861a02c3700de79ea17d80c0a7b9f33d7edd1357a714e0f2f

SHA512
34fbaffc48912e3d3fa2d224e001121e8b36f5be7284a33eb31d306b9a5c00de6e23a9fdc1a17a61fb1371768f0b0e30b9c6e899a08c735fc70482d5aa8ea824

Download Submit
\ProgramData\Microsoft\MF\libpng13.dll

Filesize
157KB

MD5
bb1922dfbdd99e0b89bec66c30c31b73

SHA1
f7a561619c101ba9b335c0b3d318f965b8fc1dfb

SHA256
76457f38cbbdd3dce078a40d42d9ac0dc26ae1c4bb68ab9c880eb7ffb400fd99

SHA512
3054574dd645feb1468cee53db2fd456e4f923eaf5fd686557a01c72c0572b19d70f3885d47fe42e97cdf7ccc2c674a6e966ff19668907cf7828e0a943cf474a

Download Submit
\ProgramData\Microsoft\MF\mt.dll

Filesize
1.5MB

MD5
9ded3fdffb0ff7f62e6a0a7f996c0caf

SHA1
fcc959b28a32923ccdb1ca4e304c74a31dede929

SHA256
87aab1db611adb132f503c08c32dc4efc23c9216d97e918f7279f86920701c93

SHA512
a7e7cb96a78827b01e71c595ca0d106eaf7afe35d4a548e5beccf0b009cc02d33274822958dca4998a427d8b4027eaefe99b40b3648e24730c81df34eab32ba0

Download Submit
\ProgramData\Microsoft\MF\zlib1.dll

Filesize
62KB

MD5
37163aacc5534fbab012fb505be8d647

SHA1
73de6343e52180a24c74f4629e38a62ed8ad5f81

SHA256
0a6357a8852daaafe7aed300e2f7e69d993cac4156e882baa8a3a56b583255ba

SHA512
c3bed1c9bc58652ed16b162ed16a93cf7479a0492db7e6ea577001dbe859affc0b20387d93d23e06e73f49f395e4c9a5a07680f000ebb82d32269742c16a5242

Download Submit
\Windows\Installer\MSIE173.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSIE5FE.tmp

Filesize
187KB

MD5
f11e8ec00dfd2d1344d8a222e65fea09

SHA1
235ed90cc729c50eb6b8a36ebcd2cf044a2d8b20

SHA256
775037d6d7de214796f2f5850440257ae7f04952b73538da2b55db45f3b26e93

SHA512
6163dd8fd18b4520d7fda0986a80f2e424fe55f5d65d67f5a3519a366e53049f902a08164ea5669476100b71bb2f0c085327b7c362174cb7a051d268f10872d3

Download Submit
memory/808-452-0x00000000002F0000-0x0000000000325000-memory.dmp

Filesize
212KB

Download
memory/808-442-0x0000000000460000-0x0000000000568000-memory.dmp

Filesize
1.0MB

Download
memory/808-464-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/808-457-0x0000000000330000-0x000000000036F000-memory.dmp

Filesize
252KB

Download
memory/808-466-0x0000000072B60000-0x0000000072D77000-memory.dmp

Filesize
2.1MB

Download
memory/808-472-0x0000000072920000-0x0000000072B54000-memory.dmp

Filesize
2.2MB

Download
memory/808-468-0x0000000000700000-0x0000000000731000-memory.dmp

Filesize
196KB

Download
memory/808-475-0x0000000001F90000-0x0000000001FBA000-memory.dmp

Filesize
168KB

Download
memory/808-500-0x0000000072920000-0x0000000072B54000-memory.dmp

Filesize
2.2MB

Download
memory/808-502-0x0000000072B60000-0x0000000072D77000-memory.dmp

Filesize
2.1MB

Download
memory/808-501-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/1524-435-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/2100-522-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2100-638-0x0000000075A30000-0x0000000075BF4000-memory.dmp

Filesize
1.8MB

Download
memory/2100-528-0x0000000001FD0000-0x0000000001FE9000-memory.dmp

Filesize
100KB

Download
memory/2292-436-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/3040-504-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/3040-634-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/3040-507-0x0000000000AA0000-0x0000000000AD1000-memory.dmp

Filesize
196KB

Download
memory/3040-511-0x0000000000790000-0x00000000007BA000-memory.dmp

Filesize
168KB

Download
memory/3040-496-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/3040-498-0x00000000002C0000-0x00000000002FF000-memory.dmp

Filesize
252KB

Download
memory/3040-490-0x00000000003A0000-0x00000000004A8000-memory.dmp

Filesize
1.0MB

Download
memory/3040-506-0x0000000072920000-0x0000000072B54000-memory.dmp

Filesize
2.2MB

Download
memory/3040-636-0x0000000072920000-0x0000000072B54000-memory.dmp

Filesize
2.2MB

Download
memory/3040-635-0x0000000072B60000-0x0000000072D77000-memory.dmp

Filesize
2.1MB

Download
memory/3040-505-0x0000000072B60000-0x0000000072D77000-memory.dmp

Filesize
2.1MB

Download
memory/3040-663-0x00000000042C0000-0x000000000440D000-memory.dmp

Filesize
1.3MB

Download
memory/3040-664-0x00000000042C0000-0x000000000440D000-memory.dmp

Filesize
1.3MB

Download
memory/3040-660-0x00000000042C0000-0x000000000440D000-memory.dmp

Filesize
1.3MB

Download