metasploit | 5c10afa23f689af55e3479480f13836b05f64dc2f3edf47b7084f297c5894539

Analysis

max time kernel
140s
max time network
140s
platform
windows7_x64
resource
win7v20201028
submitted
11-11-2020 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c10afa23f689af55e3479480f13836b05f64dc2f3edf47b7084f297c5894539.msi
Size

3.1MB
MD5

56f97661a171b446d89733cb499082e4
SHA1

feb03f3d2a29d27b56685954fb6b4a253e3da87f
SHA256

5c10afa23f689af55e3479480f13836b05f64dc2f3edf47b7084f297c5894539
SHA512

21b4ceb6ab24477722ba1d214903755eb7fdc5dfe527d690072e56a4b0e308f99e861f13f0b4c7d78fb194a58d428713bce360cb23b853f7646d87c52711107b

Score

10^/10

metasploit backdoor persistence trojan vmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

http://47.91.237.42:8443/blIF

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 1 IoCs

Processes:

svchcst.exe

pid process

1492 svchcst.exe

pid	process
1492	svchcst.exe

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe	vmprotect
\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe	vmprotect
\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe	vmprotect
behavioral1/memory/1492-19-0x0000000000400000-0x0000000000A0E000-memory.dmp	vmprotect
behavioral1/memory/1492-20-0x0000000000400000-0x0000000000A0E000-memory.dmp	vmprotect
behavioral1/memory/1492-21-0x0000000000400000-0x0000000000A0E000-memory.dmp	vmprotect

Loads dropped DLL 3 IoCs

Processes:

MsiExec.exe

pid process

1604 MsiExec.exe
1604 MsiExec.exe
1604 MsiExec.exe

pid	process
1604	MsiExec.exe
1604	MsiExec.exe
1604	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Modifies service 2 TTPs 149 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPARESNAPSHOT (Enter) = 480000000000000060e919fe19b8d601b80700007c040000ea03000001000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\THAW (Enter) = 4800000000000000203b16ff19b8d601b807000058020000f203000001000000030000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BKGND_FREEZE_THREAD (Leave) = 4800000000000000203b16ff19b8d601b80700006c020000fc03000000000000030000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppCreate (Enter) = 480000000000000080a47cfc19b8d60130060000b0070000d00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_STABLE (SetCurrentState) = 4800000000000000201d27fd19b8d601b8070000540400000100000001000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\GETSTATE (Enter) = 480000000000000040412efd19b8d601b807000054040000f903000001000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_FRONT (Enter) = 480000000000000040db38fe19b8d601b8070000d8070000ec03000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PRECOMMIT (Leave) = 4800000000000000e0c6bbfe19b8d601b8070000d80700000304000000000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\IDENTIFY (Leave) = 4800000000000000201214fd19b8d601b8070000ac070000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) = 4800000000000000203b16ff19b8d601b8070000580200000400000001000000030000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BACKUPSHUTDOWN (Leave) = 4800000000000000e0ad4b001ab8d601b807000058020000fb03000000000000050000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\PREPAREBACKUP (Enter) = 4800000000000000c0bb24fd19b8d601b8070000ac070000e903000001000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_BACK (Leave) = 4800000000000000e08449fe19b8d601b8070000d8070000ed03000000000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\OPEN_VOLUME_HANDLE (Leave) = 4800000000000000a0aaf9fe19b8d601b8070000d8070000fd03000000000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW_KTM (Enter) = 4800000000000000c0ce00ff19b8d601b8070000d8070000f403000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\IDENTIFY (Leave) = 4800000000000000e0bef2fc19b8d6013006000090060000e80300000000000000000000000204001145d875ff55824f8541c6176119e46900000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Leave) = 4800000000000000c0a5fefc19b8d60130060000b0070000d507000001000000000000000a0100810000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer\IDENTIFY (Leave) = 4800000000000000201214fd19b8d601b807000054040000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppCreate (Leave) = 4800000000000000c0a5fefc19b8d60130060000b0070000d007000001000000000000000a0100811145d875ff55824f8541c6176119e46900000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\POSTSNAPSHOT (Leave) = 480000000000000040aca2ff19b8d601b807000058020000f503000000000000040000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BACKUPSHUTDOWN (Leave) = 4800000000000000e0ad4b001ab8d601b80700007c040000fb03000000000000050000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\IDENTIFY (Enter) = 4800000000000000e0b3dffc19b8d6013006000090060000e80300000100000000000000000000001145d875ff55824f8541c6176119e46900000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\PREPAREBACKUP (Leave) = 4800000000000000201d27fd19b8d601b8070000ac070000e903000000000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\THAW (Leave) = 4800000000000000203b16ff19b8d601b80700007c040000f203000000000000030000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BACKUPSHUTDOWN (Enter) = 4800000000000000e0ad4b001ab8d601b80700007c040000fb03000001000000050000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Enter) = 4800000000000000c0a5fefc19b8d60130060000b0070000d50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_BACK (Enter) = 4800000000000000c06042fe19b8d601b8070000d8070000ed03000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_THAW (SetCurrentState) = 4800000000000000e0c6bbfe19b8d601b8070000580200000300000001000000020000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW (Enter) = 4800000000000000c0ce00ff19b8d601b8070000d8070000f203000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPAREBACKUP (Enter) = 4800000000000000c0bb24fd19b8d601b807000054040000e903000001000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\PREPAREBACKUP (Enter) = 4800000000000000c0bb24fd19b8d601b8070000e4060000e903000001000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000600a53fe19b8d601b8070000d4050000fc03000001000000030000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BACKUPSHUTDOWN (Enter) = 4800000000000000e0ad4b001ab8d601b807000058020000fb03000001000000050000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\GETSTATE (Leave) = 480000000000000040412efd19b8d601b8070000ac070000f903000000000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_RM (Enter) = 4800000000000000600a53fe19b8d601b8070000d8070000ef03000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_COMMIT (Enter) = 4800000000000000c0ce00ff19b8d601b80700006c0600000404000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\POSTSNAPSHOT (Enter) = 480000000000000040a18fff19b8d601b80700007c040000f503000001000000040000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Enter) = 4800000000000000707d7cfc19b8d60130060000b0070000d50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\IDENTIFY (Leave) = 4800000000000000201214fd19b8d601b8070000e4060000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_BEGINPREPARE (Leave) = 4800000000000000a0971dfd19b8d601b8070000540400000104000000000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\OPEN_VOLUME_HANDLE (Enter) = 4800000000000000e0c6bbfe19b8d601b8070000d8070000fd03000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\BACKUPSHUTDOWN (Leave) = 4800000000000000e0ad4b001ab8d601b8070000d8070000fb03000000000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_STABLE (SetCurrentState) = 4800000000000000201d27fd19b8d601b8070000ac0700000100000001000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_FLUSH_AND_HOLD (Enter) = 4800000000000000a0aaf9fe19b8d601b8070000d8070000fe03000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_RELEASE (Enter) = 4800000000000000c0ce00ff19b8d601b8070000d8070000ff0300000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\POSTSNAPSHOT (Enter) = 480000000000000040a18fff19b8d601b807000058020000f503000001000000040000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{495fd7e4-1989-11eb-abf9-806e6f6e6963}_)\OPEN_VOLUME_HANDLE (Enter) = 4800000000000000e0c6bbfe19b8d601b8070000cc060000fd03000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\BACKUPSHUTDOWN (Enter) = 4800000000000000804136001ab8d601b8070000d8070000fb03000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\IDENTIFY (Leave) = 4800000000000000c09aebfc19b8d601b807000048040000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\PREPARESNAPSHOT (Leave) = 480000000000000040db38fe19b8d601b8070000d8070000ea03000000000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_FRONT (Leave) = 4800000000000000c06042fe19b8d601b8070000d8070000ec03000000000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\FREEZE (Leave) = 4800000000000000600a53fe19b8d601b807000058020000eb03000000000000020000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\FREEZE (Leave) = 4800000000000000e0c6bbfe19b8d601b807000058020000eb03000000000000020000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\PREPARESNAPSHOT (Leave) = 480000000000000040db38fe19b8d601b807000058020000ea03000000000000010000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_KTM (Enter) = 4800000000000000600a53fe19b8d601b8070000d8070000f003000001000000000000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\FREEZE (Enter) = 4800000000000000802e5afe19b8d601b807000058020000eb03000001000000020000000000000089537c71662f404d94bcc3938f9f5e2e00000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP	msiexec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\IDENTIFY (Enter) = 480000000000000000d8e6fc19b8d601b8070000ac070000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer\IDENTIFY (Leave) = 4800000000000000e0bef2fc19b8d601b8070000e4060000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Leave) = 4800000000000000203003ff19b8d60130060000b0070000d50700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exemsiexec.exeexpand.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f741f54.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f741f53.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f741f53.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21F2.tmp	msiexec.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

MsiExec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\ForegroundLockTimeout = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\ForegroundLockTimeout = "200000"	MsiExec.exe

Modifies data under HKEY_USERS 44 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1584 msiexec.exe
1584 msiexec.exe

pid	process
1584	msiexec.exe
1584	msiexec.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeSecurityPrivilege	1584	msiexec.exe
Token: SeCreateTokenPrivilege	2036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2036	msiexec.exe
Token: SeLockMemoryPrivilege	2036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2036	msiexec.exe
Token: SeMachineAccountPrivilege	2036	msiexec.exe
Token: SeTcbPrivilege	2036	msiexec.exe
Token: SeSecurityPrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe
Token: SeLoadDriverPrivilege	2036	msiexec.exe
Token: SeSystemProfilePrivilege	2036	msiexec.exe
Token: SeSystemtimePrivilege	2036	msiexec.exe
Token: SeProfSingleProcessPrivilege	2036	msiexec.exe
Token: SeIncBasePriorityPrivilege	2036	msiexec.exe
Token: SeCreatePagefilePrivilege	2036	msiexec.exe
Token: SeCreatePermanentPrivilege	2036	msiexec.exe
Token: SeBackupPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeShutdownPrivilege	2036	msiexec.exe
Token: SeDebugPrivilege	2036	msiexec.exe
Token: SeAuditPrivilege	2036	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2036	msiexec.exe
Token: SeChangeNotifyPrivilege	2036	msiexec.exe
Token: SeRemoteShutdownPrivilege	2036	msiexec.exe
Token: SeUndockPrivilege	2036	msiexec.exe
Token: SeSyncAgentPrivilege	2036	msiexec.exe
Token: SeEnableDelegationPrivilege	2036	msiexec.exe
Token: SeManageVolumePrivilege	2036	msiexec.exe
Token: SeImpersonatePrivilege	2036	msiexec.exe
Token: SeCreateGlobalPrivilege	2036	msiexec.exe
Token: SeBackupPrivilege	1976	vssvc.exe
Token: SeRestorePrivilege	1976	vssvc.exe
Token: SeAuditPrivilege	1976	vssvc.exe
Token: SeBackupPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1020	DrvInst.exe
Token: SeRestorePrivilege	1020	DrvInst.exe
Token: SeRestorePrivilege	1020	DrvInst.exe
Token: SeRestorePrivilege	1020	DrvInst.exe
Token: SeRestorePrivilege	1020	DrvInst.exe
Token: SeRestorePrivilege	1020	DrvInst.exe
Token: SeRestorePrivilege	1020	DrvInst.exe
Token: SeLoadDriverPrivilege	1020	DrvInst.exe
Token: SeLoadDriverPrivilege	1020	DrvInst.exe
Token: SeLoadDriverPrivilege	1020	DrvInst.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

2036 msiexec.exe

pid	process
2036	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

msiexec.exeMsiExec.exe

description	pid	process	target process
PID 1584 wrote to memory of 1604	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1604	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1604	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1604	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1604	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1604	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1604	1584	msiexec.exe	MsiExec.exe
PID 1604 wrote to memory of 1172	1604	MsiExec.exe	expand.exe
PID 1604 wrote to memory of 1172	1604	MsiExec.exe	expand.exe
PID 1604 wrote to memory of 1172	1604	MsiExec.exe	expand.exe
PID 1604 wrote to memory of 1172	1604	MsiExec.exe	expand.exe
PID 1604 wrote to memory of 1492	1604	MsiExec.exe	svchcst.exe
PID 1604 wrote to memory of 1492	1604	MsiExec.exe	svchcst.exe
PID 1604 wrote to memory of 1492	1604	MsiExec.exe	svchcst.exe
PID 1604 wrote to memory of 1492	1604	MsiExec.exe	svchcst.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\5c10afa23f689af55e3479480f13836b05f64dc2f3edf47b7084f297c5894539.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Modifies service
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F3631727B624C4DDC20EDCB2A1032789
2⤵
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\expand.exe
"C:\Windows\System32\expand.exe" -R files.cab -F:* files
3⤵
- Drops file in Windows directory
PID:1172

C:\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe
"C:\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe"
3⤵
- Executes dropped EXE
PID:1492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005B0" "00000000000005A8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files.cab
MD5
b653e1dc68612a271aee9b0b3930293f

SHA1
fbf5da87659a05e1011eeb521eb25538f59eb406

SHA256
122350f455ebd60647f862ae34e15d8424517b97bd94eb12b89c2593834c601f

SHA512
dd1f6b5982399516d44fa0ad183ff3a40c40eec4f460054fc62a829138845633673aabb9be2c6498b61a671ce2936e9466ffa24784d5f3fcb6cee6c3f8462315

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe
MD5
8c0c79a1d225b583724e6d6cb97d2640

SHA1
d86f98b0f4c965a2f5e41ebdeb54388890967450

SHA256
9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c

SHA512
6029b4df1048897d941682bc1379d27017f5d0cc2b6724ee5a46c5b54f2f41cb8c2d10e7beca56ec214c77a51a2364dbf5341ef4279af707767659a95671ce18

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe
MD5
8c0c79a1d225b583724e6d6cb97d2640

SHA1
d86f98b0f4c965a2f5e41ebdeb54388890967450

SHA256
9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c

SHA512
6029b4df1048897d941682bc1379d27017f5d0cc2b6724ee5a46c5b54f2f41cb8c2d10e7beca56ec214c77a51a2364dbf5341ef4279af707767659a95671ce18

Download Submit
C:\Windows\Installer\MSI21F2.tmp
MD5
3e9d2974fd83d2c22b647d36a2ba7861

SHA1
3b1d50d42235439d456444f7d3b573f93ecdbe5f

SHA256
339ad75878735d68ccf46bd6f2a73908e4b97be2b947b913e3472dda2c35135a

SHA512
e97fdb1d0053d20e7d869d664662f3a845a8b64103e1876513793adff5a190b110d7c221b81102e7e1f6c902dcf0ade18ade2299d3083917d3673aa3ba4ebb9f

Download Submit
\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe
MD5
8c0c79a1d225b583724e6d6cb97d2640

SHA1
d86f98b0f4c965a2f5e41ebdeb54388890967450

SHA256
9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c

SHA512
6029b4df1048897d941682bc1379d27017f5d0cc2b6724ee5a46c5b54f2f41cb8c2d10e7beca56ec214c77a51a2364dbf5341ef4279af707767659a95671ce18

Download Submit
\Users\Admin\AppData\Local\Temp\MW-d3d555eb-560c-4b43-b171-ce5c0f87d0ff\files\svchcst.exe
MD5
8c0c79a1d225b583724e6d6cb97d2640

SHA1
d86f98b0f4c965a2f5e41ebdeb54388890967450

SHA256
9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c

SHA512
6029b4df1048897d941682bc1379d27017f5d0cc2b6724ee5a46c5b54f2f41cb8c2d10e7beca56ec214c77a51a2364dbf5341ef4279af707767659a95671ce18

Download Submit
\Windows\Installer\MSI21F2.tmp
MD5
3e9d2974fd83d2c22b647d36a2ba7861

SHA1
3b1d50d42235439d456444f7d3b573f93ecdbe5f

SHA256
339ad75878735d68ccf46bd6f2a73908e4b97be2b947b913e3472dda2c35135a

SHA512
e97fdb1d0053d20e7d869d664662f3a845a8b64103e1876513793adff5a190b110d7c221b81102e7e1f6c902dcf0ade18ade2299d3083917d3673aa3ba4ebb9f

Download Submit
memory/288-22-0x000007FEF6B90000-0x000007FEF6E0A000-memory.dmp

Filesize
2.5MB

Download
memory/1172-10-0x0000000000000000-mapping.dmp

Download
memory/1492-19-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1492-21-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1492-17-0x0000000000000000-mapping.dmp

Download
memory/1492-20-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1584-6-0x0000000001020000-0x0000000001024000-memory.dmp

Filesize
16KB

Download
memory/1584-5-0x00000000017D0000-0x00000000017D4000-memory.dmp

Filesize
16KB

Download
memory/1604-7-0x0000000000000000-mapping.dmp

Download
memory/2036-1-0x0000000004030000-0x0000000004034000-memory.dmp

Filesize
16KB

Download
memory/2036-0-0x00000000032B0000-0x00000000032B4000-memory.dmp

Filesize
16KB

Download
memory/2036-4-0x0000000004030000-0x0000000004034000-memory.dmp

Filesize
16KB

Download
memory/2036-3-0x0000000004030000-0x0000000004034000-memory.dmp

Filesize
16KB

Download