30657b042364630a3bda4ebc7ef2f9ddf5837e0128b0332396df31cfbefefa1e

Analysis

max time kernel
1797s
max time network
1820s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

swat4_spdemo_en.exe
Size

183.1MB
MD5

37cd68b32d7b95b85d289fc3cdab305c
SHA1

fcbdf4786fb70832d02f78548ab20e9b7ea62d4b
SHA256

30657b042364630a3bda4ebc7ef2f9ddf5837e0128b0332396df31cfbefefa1e
SHA512

f593606c016fdd9a5c72c1cb6f9fa49a6f008439bd605a8c8d9812995197aaaf0c0c1cd94977e55361b561a20cf920491d1e4f996f1b356f8832bc5b0e07a992
SSDEEP

3145728:VeO4XB8wYHiFMRX0Jkl2Je3nvCl6GfkZJAvK4WyuozvpOPh8Rr23ttI1htVC0BwH:gLXOwYHimXMkdv664kgNWGxOPh8kze8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1092	IDriver.exe

Loads dropped DLL 13 IoCs

pid	Process
1092	IDriver.exe
1092	IDriver.exe
1092	IDriver.exe
2292	MsiExec.exe
2292	MsiExec.exe
2292	MsiExec.exe
1092	IDriver.exe
1092	IDriver.exe
1092	IDriver.exe
1092	IDriver.exe
1092	IDriver.exe
1092	IDriver.exe
1092	IDriver.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1636	msiexec.exe
5	1636	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	IDriver.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	IDriver.exe
File opened (read-only)	\??\R:	IDriver.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	IDriver.exe
File opened (read-only)	\??\W:	IDriver.exe
File opened (read-only)	\??\J:	IDriver.exe
File opened (read-only)	\??\O:	IDriver.exe
File opened (read-only)	\??\U:	IDriver.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	IDriver.exe
File opened (read-only)	\??\I:	IDriver.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	IDriver.exe
File opened (read-only)	\??\X:	IDriver.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	IDriver.exe
File opened (read-only)	\??\G:	IDriver.exe
File opened (read-only)	\??\Q:	IDriver.exe
File opened (read-only)	\??\E:	IDriver.exe
File opened (read-only)	\??\V:	IDriver.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	IDriver.exe
File opened (read-only)	\??\N:	IDriver.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	IDriver.exe
File opened (read-only)	\??\S:	IDriver.exe
File opened (read-only)	\??\T:	IDriver.exe
File opened (read-only)	\??\Z:	IDriver.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ID	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ISRT.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\_ISRES1033.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IScrCnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\objpscnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\iGdiCnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IUserCnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver2.exe	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f772222.mst	msiexec.exe
File created	C:\Windows\Installer\f772225.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E76.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f772221.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f772221.msi	msiexec.exe
File created	C:\Windows\Installer\f772222.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f772225.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{96EDAA2C-E90A-4ABA-AC0D-9226B8B3AB79}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{96EDAA2C-E90A-4ABA-AC0D-9226B8B3AB79}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{78994A88-276B-4F15-BAF6-FB4CD3F9E223}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92559C8C-F9C8-4BE7-BA9D-26AFEA5E4389}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{0AA8743E-3991-438C-8631-3C8C169399E6}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{FD889BE8-F7D6-415F-84B6-B17CCCB29A6D}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22E4EB97-C4B0-4EE7-88AE-5E3502EA7831}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{738891D7-3A18-4839-A5E7-EFD2E7DE002A}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{65CD17AF-CCEE-4CD6-B304-A3BD48237B67}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAFAF854-1BF8-4DE1-8F96-752839422F73}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{2E30AE6C-8796-4207-968E-FAEFC5DD1818}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FC8AC65-FD78-4439-90A2-291175681698}\ = "ISetupSharedFiles"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B8E161B8-9B5A-4DD2-9B93-1F558A7FAD69}\ = "ISetupShell2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{DF2062B2-540A-4B48-A2C7-ABA0B49D44B9}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9DFAFFD-B547-4387-992F-E5863D4D7E17}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{610B9179-896D-41FC-9056-27616367AD91}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{FA5380BC-76C8-4AD6-A4C4-6F6CB5F32CAE}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C7DC20AA-E26E-4FC9-9DBE-FAFDE6C5CCCD}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{65CD17AF-CCEE-4CD6-B304-A3BD48237B67}\ = "ISetupMainWindow"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{724B3BD1-2098-4DDC-A229-B9BE6595398E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F04EC9AA-E64B-4EE8-91CE-4026BAEA5D41}\ = "IISInstallDriverForceRemove"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9E8176B8-C130-49DA-AB56-F3378E54ADFD}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{ACC4DEAB-2CEA-4869-A2F7-5C7E5A6730B5}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{22E4EB97-C4B0-4EE7-88AE-5E3502EA7831}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{2E30AE6C-8796-4207-968E-FAEFC5DD1818}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{2BF7C25E-DA1D-4E34-8242-5DCDD9F18245}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AEED9AE1-AE66-4065-A274-DC7BBFEE354B}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{2057FC3B-B6A8-4669-B49B-393B0B0193A9}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{DED5FE20-27D3-4F38-8DF3-93659038C417}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3392A51F-A498-421A-A02A-6804C4270A21}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E4FB44E-D416-4243-B811-8E116F9CE39A}\ = "ISetupServiceProvider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{AF21D406-D32C-4413-81CE-B9AF860E1361}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{42814CB5-E1A5-4F07-9D38-18CE4C2AB4A2}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45FC2F5E-D7AC-4255-9B82-967841EB9E64}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{D354A092-4A8E-4077-A738-8314F6BA0DE6}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{184C53CC-8D6D-4A58-8108-90167678B84C}\ = "ISetupReboot"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{B23DEBC2-3C5C-47A6-8FF8-148132D193F4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2665F812-8C0D-46F5-91A3-E70E8F4E0417}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FC8AC65-FD78-4439-90A2-291175681698}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A485A16F-1011-42A0-A5B6-48336907A783}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAFAF854-1BF8-4DE1-8F96-752839422F73}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F31ADE0D-9319-4067-829A-107D25C1C131}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{293B98DF-5B92-42D2-A409-FA9A0C0E1E68}\ = "ISetupShellLink"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1F45426-4ECC-4E2F-A2AD-3424A424B336}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CD549FD5-6590-4F67-B60E-E7422ADAF1B3}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{DAFAF854-1BF8-4DE1-8F96-752839422F73}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{28CD926D-C061-47FC-A3F2-6A9E11133F7C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E4FB44E-D416-4243-B811-8E116F9CE39A}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{9E104755-C78C-4BAC-941C-29857740D46F}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2BF7C25E-DA1D-4E34-8242-5DCDD9F18245}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{39BB147B-55CC-424B-9B10-C5052E5939B9}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{46715E70-0B7D-45BA-A447-AA0951073C78}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF2062B2-540A-4B48-A2C7-ABA0B49D44B9}\ = "ISetupFileErrors"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{85D3BD85-0A91-438D-B2F9-BC4E31A5DB34}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DED5FE20-27D3-4F38-8DF3-93659038C417}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppId\{24D495A5-A174-4945-819D-CF294600C500}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{CD1B2C1C-4F04-4B4F-851B-2DA036EF69FC}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ABC466D7-B7AD-4872-8C72-ED582EF279CE}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FB74205-04B5-4683-B5B5-492FCFDE9ADF}\ = "ISetupTextSubstitution2"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	msiexec.exe
1636	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2868	swat4_spdemo_en.exe
Token: SeIncreaseQuotaPrivilege	2868	swat4_spdemo_en.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeSecurityPrivilege	1636	msiexec.exe
Token: SeCreateTokenPrivilege	2868	swat4_spdemo_en.exe
Token: SeAssignPrimaryTokenPrivilege	2868	swat4_spdemo_en.exe
Token: SeLockMemoryPrivilege	2868	swat4_spdemo_en.exe
Token: SeIncreaseQuotaPrivilege	2868	swat4_spdemo_en.exe
Token: SeMachineAccountPrivilege	2868	swat4_spdemo_en.exe
Token: SeTcbPrivilege	2868	swat4_spdemo_en.exe
Token: SeSecurityPrivilege	2868	swat4_spdemo_en.exe
Token: SeTakeOwnershipPrivilege	2868	swat4_spdemo_en.exe
Token: SeLoadDriverPrivilege	2868	swat4_spdemo_en.exe
Token: SeSystemProfilePrivilege	2868	swat4_spdemo_en.exe
Token: SeSystemtimePrivilege	2868	swat4_spdemo_en.exe
Token: SeProfSingleProcessPrivilege	2868	swat4_spdemo_en.exe
Token: SeIncBasePriorityPrivilege	2868	swat4_spdemo_en.exe
Token: SeCreatePagefilePrivilege	2868	swat4_spdemo_en.exe
Token: SeCreatePermanentPrivilege	2868	swat4_spdemo_en.exe
Token: SeBackupPrivilege	2868	swat4_spdemo_en.exe
Token: SeRestorePrivilege	2868	swat4_spdemo_en.exe
Token: SeShutdownPrivilege	2868	swat4_spdemo_en.exe
Token: SeDebugPrivilege	2868	swat4_spdemo_en.exe
Token: SeAuditPrivilege	2868	swat4_spdemo_en.exe
Token: SeSystemEnvironmentPrivilege	2868	swat4_spdemo_en.exe
Token: SeChangeNotifyPrivilege	2868	swat4_spdemo_en.exe
Token: SeRemoteShutdownPrivilege	2868	swat4_spdemo_en.exe
Token: SeUndockPrivilege	2868	swat4_spdemo_en.exe
Token: SeSyncAgentPrivilege	2868	swat4_spdemo_en.exe
Token: SeEnableDelegationPrivilege	2868	swat4_spdemo_en.exe
Token: SeManageVolumePrivilege	2868	swat4_spdemo_en.exe
Token: SeImpersonatePrivilege	2868	swat4_spdemo_en.exe
Token: SeCreateGlobalPrivilege	2868	swat4_spdemo_en.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeCreateTokenPrivilege	1092	IDriver.exe
Token: SeAssignPrimaryTokenPrivilege	1092	IDriver.exe
Token: SeLockMemoryPrivilege	1092	IDriver.exe
Token: SeIncreaseQuotaPrivilege	1092	IDriver.exe
Token: SeMachineAccountPrivilege	1092	IDriver.exe
Token: SeTcbPrivilege	1092	IDriver.exe
Token: SeSecurityPrivilege	1092	IDriver.exe
Token: SeTakeOwnershipPrivilege	1092	IDriver.exe
Token: SeLoadDriverPrivilege	1092	IDriver.exe
Token: SeSystemProfilePrivilege	1092	IDriver.exe
Token: SeSystemtimePrivilege	1092	IDriver.exe
Token: SeProfSingleProcessPrivilege	1092	IDriver.exe
Token: SeIncBasePriorityPrivilege	1092	IDriver.exe
Token: SeCreatePagefilePrivilege	1092	IDriver.exe
Token: SeCreatePermanentPrivilege	1092	IDriver.exe
Token: SeBackupPrivilege	1092	IDriver.exe
Token: SeRestorePrivilege	1092	IDriver.exe
Token: SeShutdownPrivilege	1092	IDriver.exe
Token: SeDebugPrivilege	1092	IDriver.exe
Token: SeAuditPrivilege	1092	IDriver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	swat4_spdemo_en.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2292	1636	msiexec.exe	34
PID 1636 wrote to memory of 2292	1636	msiexec.exe	34
PID 1636 wrote to memory of 2292	1636	msiexec.exe	34
PID 1636 wrote to memory of 2292	1636	msiexec.exe	34
PID 1636 wrote to memory of 2292	1636	msiexec.exe	34
PID 1636 wrote to memory of 2292	1636	msiexec.exe	34
PID 1636 wrote to memory of 2292	1636	msiexec.exe	34

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\swat4_spdemo_en.exe
"C:\Users\Admin\AppData\Local\Temp\swat4_spdemo_en.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A7AD5E8556204D5152A0DC497147C00D C
  2⤵
  - Loads dropped DLL
  PID:2292

C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe
C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1372

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E0" "00000000000003E4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f772226.rbs

Filesize
51KB

MD5
65984ebcecb4bae8505d1b8c95c83806

SHA1
7f84f45748fc064af33aedc7d8c8831af03fb06b

SHA256
6833327db09083feb948166bc8e3af59efeae414b509ce8e5d8bfd8f1b23e9b1

SHA512
4de5370696309bc3c2059a6eb4618f110057e98bb84dd476a1640509655789f7c31d7d43d10c99401fbab0263791fc509f2a1b454a042796a72483495e577cbf

Download Submit
C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe

Filesize
744KB

MD5
a9d3658c5be72816812a5a32e4560ba3

SHA1
649003292ee74d2407fae441fb92b605a0d91f90

SHA256
b2527d1e2297506796f898e90907fb4c8c7e063f2898194e74152fa9ca21923f

SHA512
b80283aafbe8cd59720979d51a5524a1d53b001e59c6fe9693c754b238101ac6058122130e0be97ce22dc4f7edce9cd84aa4fde869bf728cff8fba1733638c5b

Download Submit
C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IScrCnv.dll

Filesize
260KB

MD5
f6aabdf85821a9c61c61dec9408f40cc

SHA1
ddac695de73be7a67357aea89c7b9c2ca21fc4e1

SHA256
9ee23586d456db53d59fbaa8669e817461aeaf94f81237ead3f2c23cac8c40fa

SHA512
73d2e4352c4055c8d08ad5499fc4495ff6fa7613970f9c0a3cf73dae645fc9102e62cf9c7dd046d6bc3c909cbafd06a30812d1d9bcf8f34c4a253c09d628b538

Download Submit
C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\iGdiCnv.dll

Filesize
176KB

MD5
afdfec6679ce99596261ff182afbe9e6

SHA1
3289711e3ce8bb72bd84bb0bc33f95d958648f4c

SHA256
81b931aaf908e1e372802db04dfbe5256209d488bfe88d58841fc13acadedfd6

SHA512
c8ce4617d03084f37b8766f0505922a8f380e0d2745658864197535c43c3b2f985c4a2bac2228752857782181cd41167bfa4b784c7ce3e8a94932d58d099753a

Download Submit
C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\iusercnv.dll

Filesize
168KB

MD5
197c2ce7cf2a98ae895ece98d88b8245

SHA1
f734d8dc508138501e79b384fe1a689920c6ba93

SHA256
260924991dff4fbd2f691913007aee1f3136708671ef3309b4f9ec8687da6f1e

SHA512
a7ff5f0d56a13d340d9ec1b977f9e995bf7dc61f6bf4b8ecd7369793d39032a43e587146e6b9a9084be5a9cc709876bf971983a218c2af631d3950cd3391cd47

Download Submit
C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\objpscnv.dll

Filesize
32KB

MD5
aba70b81a5811e7b140271595d66f06f

SHA1
42ef824151e67cf921d861d83872c9ef13b500e6

SHA256
26d4765c2461fccd669e455d33659397d6f82fe261ece256c3f19b831dcfa0ba

SHA512
8780d68124e309b8ec2dbbbac18be3291fefabfd6ed9154645eddfb4dd8076e2fda97168d7c5ea9b378b54ee900f75bd409736cfc1262e0d167e0ff62078de0a

Download Submit
C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ISRT.DLL

Filesize
400KB

MD5
db28ca3ba3c2045aa7b6e59aa9831c68

SHA1
55b44ea55f3a04b916339c81e1cc3f3db62d54cc

SHA256
ca41725fb64338211a9f9740f45f1b0c4d80e6c7e84a1d2e5580dcecbf87e489

SHA512
82c409611e61acad6b2986372ff72682e611b7ee5a88e74fec9c7864ce50c7494adba4165a44f2cc99b93daee33ad67320aed4fd5f85ef2fbc4779bf69f55efb

Download Submit
C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\_ISRES1033.DLL

Filesize
528KB

MD5
1c1332bf83f505cb60e06c76fe111cdd

SHA1
3c80e9bd5a41ac3f8fa129d61261ea07db29f801

SHA256
9602fafb7de17b14a3474c64944db928ef6c23e20935c0e82e918fa2447cc979

SHA512
bd7cb4113f5b6067c55e7df1f6dac6b4058a0bdc9b0e7d6875f1718bdcc84d315ea8a2d373a45c47c82326a74cbce41a508f493eac59db99f7cd5e4f33ac575f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4470.tmp

Filesize
108KB

MD5
147c19d5e3eab8d42aee4c115b9356de

SHA1
33259c451d12ebf254fb10831f737bc9489dee04

SHA256
3086adadbf898a7f656223b3b6425e8fc9c8774f60883077500d1a378e731e71

SHA512
128c82534f36e6da35bc38b30ba14db4194138a5cb5405cc86c1e90e3bcb02a5aecb5831d6216c816bdd7830c0da1acbbd9feda84594782a3137885993cb5efc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_isDF77\0x0409.ini

Filesize
5KB

MD5
6c87581375d4e4789761b9833c2a1b4d

SHA1
310395fde36429b08b615831152399db7e4267a2

SHA256
43160e278e4302e378e754149c6394bc51d1969a7941687cfcc6c00b25151282

SHA512
ff499900dd9ae154825bb1b8a65f7c53367a4a75131ce1aa08ffbd0bbaae4d8e3a062455d74b8dce41fc89648bed33fb2ecd95e7ba57098caa7ca652f176dfd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_isDF77\ISScript10.Msi

Filesize
875KB

MD5
f93a766e58d9c06b5cfd7c095fdd4b97

SHA1
d02e24a8c14bc127ff1cbac8ef7c43830142d0e0

SHA256
c00e1e874d0093112e898c615b0f81fa8a0974c25cf01638fe6acb949b1940ed

SHA512
65089a6b7a916716866192781af098b8939ad8ef5881abfafbfebc53fd747c3af5b2451668f4e60ca6c3c15eacf485e009c260e710ab934537c4d98ab67d3bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_isDF77\SWAT 4 Single Player Demo.msi

Filesize
36.0MB

MD5
1195982acc01fea9eed121b7a003d8d1

SHA1
695c933b92228c9d17a5b53383b7a8ed2c922679

SHA256
ce04fc495c548643531d8a48f9b9ebddd7455d158e36d669d3e6716b00352b40

SHA512
7e790307a139fc05c164448af5aad0d0f0b1b88e9d2dd38f14b4b3b3dc82e8c3b2c4b7a9d86a74fd9ee659f3b4c1b608abfdd0bce46db61e30f0cd120673afbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_isDF77\_ISMSIDEL.INI

Filesize
305B

MD5
89865e421fd9ca03d5d76e8fcd5c5f56

SHA1
1c8f6dd1a396b350ae30e480c1bea26d5718a84e

SHA256
c8f85362086cca87e1bf9275e5eb7fdece81f44a6e2b2a4571e8d3485930a138

SHA512
a097ef88271e474ed36415ab899f9d594b7e1693a10ec1e9a658a2c366d467eff8a686ca8f0d51c458f4b4e6dc882cf8aef501a37703b1b0904723f6aa0a86ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\~CAAF.tmp

Filesize
1KB

MD5
84a8c974c59231a84e0c741db73ed91c

SHA1
6eed5b21dbf679b07a2ee03f81f22209d32f0738

SHA256
6a75ae4f99b43d18fbfee8d4e35908c9665ee8bf1d6be5059c405f0a2f133fee

SHA512
aa3698d32c0c1ecdbae41585940a801c899fbab93ed99bd06caf9dc5ebd11779ee024c0b52f138e75b2f580099457ebc1ada798c0de439402d3105c65998e999

Download Submit
\Users\Admin\AppData\Local\Temp\MSI4A98.tmp

Filesize
48KB

MD5
fa13aa9996fe8d85aa680e9f5e4f23e8

SHA1
cbc23243a9a595b6d91431c4c275c1ab2adc6642

SHA256
8f40c1dc28323a3c5310bf21372b9756ca547c20c7cf63197e071a9e1e66b31b

SHA512
9f4bd08583dbaadaec281d05d79c11a1dc1651d2d96cc4ecddd68e74178c3eec843e43bea14c546ba18b371177684dde0c21211e8fdb0369bbeeb5e31fdbe87e

Download Submit
\Users\Admin\AppData\Local\Temp\{F2CA85EF-D86E-4F4C-99E7-8ED7AA18E7B8}\_ISUSER.DLL

Filesize
256KB

MD5
7f7e52355174b392d84af36a422906db

SHA1
e3e541204d609b1094075898025f5e17cda8049f

SHA256
a657145af747382905b641d32627d33c5e0e635ab95909e37fefcf9e479ee89e

SHA512
a2db7824101bd9d9ee2548495bb52d07e9f1ee54ae6af0435afeb0dd713115a2636464a98171dfe4e0193315e86a811a926510ab74caaa3d915589085c1afd51

Download Submit
memory/1092-173-0x000000000E410000-0x000000000E43C000-memory.dmp

Filesize
176KB

Download
memory/1092-179-0x000000000F520000-0x000000000F586000-memory.dmp

Filesize
408KB

Download
memory/1092-184-0x000000000F6A0000-0x000000000F726000-memory.dmp

Filesize
536KB

Download
memory/1092-191-0x000000000F060000-0x000000000F08E000-memory.dmp

Filesize
184KB

Download