fab5f7b81e5afd283ee929f648841576fbb250bac4a778d2011a022e973d53d3

Analysis

user interaction
yes
max time kernel
50s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 36.7MB
Sample260429-2prxesg17z
SHA256 fab5f7b81e5afd283ee929f648841576fbb250bac4a778d2011a022e973d53d3
MD5 a51dd84a9d10ef44849c50a387580e0b
SHA1 3c67f3665c75fe2e77650f4961d5eabc2f7fb90f
SHA512 f363c07a8b3f2af889904e768e97fe4a7312358948a2c43d299177508eec8cc21e9ca6b741e7cfaaf5c554a190708609a2acbc69c8fab8e3ec8131ce19b17b8d
SSDEEP 786432:bY1vpxYzmFlWDhaGcwv6t8l8E5Bl45qZB5lrBW6QzMbnli:bYE80VaJvJOa5oBz1czanw
TLSH
T1A98733E3C72F81F2E720E1317BD465B6BD647AE96C6328114B47F88526B9C0650FCC9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4768	MSIBF26.tmp

Loads dropped DLL 1 IoCs

pid	Process
2868	MsiExec.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
17	1036	MSIEXEC.EXE
19	1036	MSIEXEC.EXE
21	1036	MSIEXEC.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\KORG\KORG Legacy\Documentation\ReadMe WAVESTATION(J).rtf	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\audioio\asio.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Digidesign\DAE\Plug-Ins\WAVESTATION RTAS.dpm	msiexec.exe
File created	C:\Program Files (x86)\Common Files\KORG\Plug-Ins\VST\WAVESTATION.dll	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\WAVESTATION.exe	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\Presets\WAVESTATION.fxb	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\Presets\WAVESTATION_Init.fxb	msiexec.exe
File created	C:\Program Files (x86)\Common Files\KORG\KORG Legacy\WAVESTATION Authorizer.exe	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\audioio\directsound.dll	msiexec.exe
File created	C:\Program Files\Vstplugins\KORG\WAVESTATION.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\KORG\WAVESTATION\WAVESTATION RTAS.nfo	msiexec.exe
File created	C:\Program Files (x86)\Common Files\KORG\WAVESTATION\WAVESTATION.nfo	msiexec.exe
File created	C:\Program Files (x86)\Common Files\KORG\WAVESTATION\wsdatex	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\audioio\mme.dll	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\language\Legacy1041.dll	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\language\default.dll	msiexec.exe
File created	C:\Program Files\Common Files\KORG\WAVESTATION\wsdatex	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\WAVESTATION.dll	msiexec.exe
File created	C:\Program Files (x86)\KORG\KORG Legacy\Documentation\ReadMe WAVESTATION(E).rtf	msiexec.exe
File created	C:\Program Files\Common Files\KORG\WAVESTATION\WAVESTATION VST.nfo	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Digidesign\DAE\Plug-Ins\WAVESTATION RTAS.dpm.rsr	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e58b1a8.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6C2C56CC-9075-491D-9B29-55147B67B892}	msiexec.exe
File created	C:\Windows\Installer\{6C2C56CC-9075-491D-9B29-55147B67B892}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{6C2C56CC-9075-491D-9B29-55147B67B892}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\e58b1aa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b1a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b1a8.mst	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB447.tmp	msiexec.exe
File created	C:\Windows\Installer\{6C2C56CC-9075-491D-9B29-55147B67B892}\1033.MST	msiexec.exe
File opened for modification	C:\Windows\Installer\{6C2C56CC-9075-491D-9B29-55147B67B892}\1033.MST	msiexec.exe
File created	C:\Windows\Installer\e58b1a7.msi	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIBF26.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f6f843118761a0680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f6f843110000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f6f84311000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af6f84311000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df6f84311000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\VST	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3F24BDAC144EFB48B18A0B5181DB99D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\WAVESTATION_RTAS = "RTAS"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\ProductName = "KORG Legacy Collection - WAVESTATION"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Version = "17235968"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Transforms = "C:\\Windows\\Installer\\{6C2C56CC-9075-491D-9B29-55147B67B892}\\1033.MST"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\PackageCode = "0769FB6114B4F9D4EAC516B8D6255065"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3F24BDAC144EFB48B18A0B5181DB99D\CC65C2C65709D194B9925541B7768B29	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\PackageName = "KORG Legacy Collection - WAVESTATION.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{CB819817-2E11-4BA1-BE23-263ECC957078}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\RTAS	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\AuthorizedLUAApp = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{CB819817-2E11-4BA1-BE23-263ECC957078}\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\Standalone	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\WAVESTATION_VST = "VST"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\ProductIcon = "C:\\Windows\\Installer\\{6C2C56CC-9075-491D-9B29-55147B67B892}\\ARPPRODUCTICON.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC65C2C65709D194B9925541B7768B29\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC65C2C65709D194B9925541B7768B29\WAVESTATION = "Standalone"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3316	msiexec.exe
3316	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1036	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	1036	MSIEXEC.EXE
Token: SeSecurityPrivilege	3316	msiexec.exe
Token: SeCreateTokenPrivilege	1036	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	1036	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	1036	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	1036	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	1036	MSIEXEC.EXE
Token: SeTcbPrivilege	1036	MSIEXEC.EXE
Token: SeSecurityPrivilege	1036	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	1036	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	1036	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	1036	MSIEXEC.EXE
Token: SeSystemtimePrivilege	1036	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	1036	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	1036	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	1036	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	1036	MSIEXEC.EXE
Token: SeBackupPrivilege	1036	MSIEXEC.EXE
Token: SeRestorePrivilege	1036	MSIEXEC.EXE
Token: SeShutdownPrivilege	1036	MSIEXEC.EXE
Token: SeDebugPrivilege	1036	MSIEXEC.EXE
Token: SeAuditPrivilege	1036	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	1036	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	1036	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	1036	MSIEXEC.EXE
Token: SeUndockPrivilege	1036	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	1036	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	1036	MSIEXEC.EXE
Token: SeManageVolumePrivilege	1036	MSIEXEC.EXE
Token: SeImpersonatePrivilege	1036	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	1036	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	1036	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	1036	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	1036	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	1036	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	1036	MSIEXEC.EXE
Token: SeTcbPrivilege	1036	MSIEXEC.EXE
Token: SeSecurityPrivilege	1036	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	1036	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	1036	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	1036	MSIEXEC.EXE
Token: SeSystemtimePrivilege	1036	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	1036	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	1036	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	1036	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	1036	MSIEXEC.EXE
Token: SeBackupPrivilege	1036	MSIEXEC.EXE
Token: SeRestorePrivilege	1036	MSIEXEC.EXE
Token: SeShutdownPrivilege	1036	MSIEXEC.EXE
Token: SeDebugPrivilege	1036	MSIEXEC.EXE
Token: SeAuditPrivilege	1036	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	1036	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	1036	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	1036	MSIEXEC.EXE
Token: SeUndockPrivilege	1036	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	1036	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	1036	MSIEXEC.EXE
Token: SeManageVolumePrivilege	1036	MSIEXEC.EXE
Token: SeImpersonatePrivilege	1036	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	1036	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	1036	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	1036	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	1036	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2620	Setup.exe
1036	MSIEXEC.EXE
1036	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 1036	2620	Setup.exe	86
PID 3316 wrote to memory of 2868	3316	msiexec.exe	89
PID 3316 wrote to memory of 2996	3316	msiexec.exe	102
PID 1036 wrote to memory of 4768	1036	MSIEXEC.EXE	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{CB819817-2E11-4BA1-BE23-263ECC957078}\KORG Legacy Collection - WAVESTATION.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{CB819817-2E11-4BA1-BE23-263ECC957078}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\MSIBF26.tmp
    "C:\Users\Admin\AppData\Local\Temp\MSIBF26.tmp" SSJU2MP7C7GYIG6PLPBB7BK4822FC6MD2LWYFCFT4Z3P9XTDTK#
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4768

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9B8AA6E7E3BE4409287EEA3B5395E73A C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2868
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b1a9.rbs

Path C:\Config.Msi\e58b1a9.rbs
Size 15KB
SHA256 0f4e8a15ba7e12c9da3296d68cb7a9a1814e65238513ecf4c7283870b9b2ddc1
MD5 07912e779fb55b942abd39ce627c2d56
SHA1 d322a9dbdc39566403adbd772d6c09137dc70a1f
SHA512 098f4cfb1b0a1a6553a4071710f96578fd18a15ac55bf9506aa2138ca20f7f657805d4b9bdee983021ee81c4ee85dd997e9da2481c86b2be80521bf0bf06b55b
SSDEEP 192:5CIFVUrIt1Zopk+FnTiG0AeWbqG9bqrTgSuENZ3BuoY8sNrzz:5dFVUct7wfGobzbQhEvz
TLSH
T1C77230426740C2E2F9921A3083B31B523793EBD49B1A532F89DDC6324DC1B9E5AF506B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WAVESTATION.exe

Path C:\Program Files (x86)\KORG\KORG Legacy\WAVESTATION.exe
Size 469KB
SHA256 d4436cd523fc4be4240673c81ec1c3f051db097198ea804eca3ce279c1ecb891
MD5 3c047a77d56bceb1997162cdae48b70b
SHA1 e72bd96d906a2b6f352127ab7c8358827181181a
SHA512 97d62074bb85d12999d4a453967db7a445ad597e3bd145f122d8a9f1703ec27b80fd6002fbbe904b234e4bcfbe3929be70c68bb3ee10887cac805b09695b993c
SSDEEP 6144:BeBjPwsxSionYf6chysLmdYut/VXLsch8bmZg7ZonAD1YZdaVx:Bqv7f6chryPLscmquoADWSx
TLSH
T1F6A49D11F3A181B3DA4A16390CBEB759897D9E994F298BC3A3D43D1EDD727C22833149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60E31627FDA0A46932B0E5948949F2A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
Size 1KB
SHA256 64e94ea72dffb576571358d070cfe7ff5cbd6edb11d86492f818ca73bbaffd5d
MD5 f8d3904655f1dfd5082a1e9c68b3e526
SHA1 d1df59f63a480c5615dc9e98659398b8406fb049
SHA512 60bcfab16e91c4ac09fa3dbc710da31cb039678e979a70d0a11c1634c9c7f00f23e910e10990aa1ebec9846730dc4a85bb0a693caf1cfbe5d54962794c16330e
TLSH
T1243157690851377354A13775C99B8DD79EF293911BA2D84AC2644A460822FCA1FC80F7
MD5 SHA1 SHA512 TLSH

Submit Download

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 26KB
SHA256 0795f8f0e616d33050adb4bae2c724ba3f8007a5998826f1200d27cef3a13a6c
MD5 ff690102c64e4baa8bad0c6a7a0fcac2
SHA1 b540a742f34bca1ad6b1541a7fd372025389a138
SHA512 36f8fc1fdacb07bc06bb32a8562663eb035d665e04cd0124b9abd3d55d6313adc48b7c0eaf335814a8996fae47a04eee24ab12ea5168a2acc55404084194f2ee
SSDEEP 384:zUkQFwszgMxAXQjBnzqzx80qLnv3B9xKjtB1WGTz02kq/9w9HvDdWBtudAJLqE5I:zgbEMxASm98vnvR9rg02ku+xRgL5I
TLSH
T12EC2FADCAC5539D7A045E2B2C98B9EA7DDB4B58437C2D00B96644F454822FCEDEE80E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_C4776F43E34360B285B1E0E212F424A8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_C4776F43E34360B285B1E0E212F424A8
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
Size 834B
SHA256 de6bcf84b3f5959cfdf2f8b6622a68cbbbd52d804e59751a5e52a8ac985d369d
MD5 4ae5d026e246530e8e5c389ad0814e17
SHA1 e1c1a7225cac5fafcbb8bd8abf30559d2029914c
SHA512 1d0139cf1270f44e1d0fcc8d9eca365fbb86bb3bcd0993904c02b581a20f51aeb14d1de32a9224337f35a2c61667e791bf3a965d34633a5905526e986f772170
TLSH
T1740112E6C1187921A4915725C19CFD5FC87473C95FC9D44A90F8C7CA2C63F986B4206B
MD5 SHA1 SHA512 TLSH

Submit Download

60E31627FDA0A46932B0E5948949F2A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
Size 182B
SHA256 529f54d38e40778c518d6df0a46d1ee77333c228b9b07c9e7882ea1047c5da7b
MD5 9fcfe785c5d9d1075e969ba6500d5fb8
SHA1 11c419f2591d40dc24cea520c06e30ee75011716
SHA512 5a097ea3a4f4504b82201104fdfe9e29b19cbc7efe3afd2eeefd214db4585115705400c76ecf79a666a737dac899b5aea1109e1d391315233b6f5a54eae2ee66
TLSH
T1CCC08C0423588102F1900A7A08B105209A303911966383294B3C13184438A600877802
MD5 SHA1 SHA512 TLSH

Submit Download

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 212B
SHA256 60d86654da548c7f544c05912f00497b6cf9902bfeb79d4ae6a6ded5ae36ef77
MD5 2ed23262a196aaace40d49d2e437465d
SHA1 f1d4220356faa224364c72bc0b28e8fe2af749d7
SHA512 dbc654f745d4ef5837be9bbdbc6e984778382d22721f98356c13c9586bdd41b232dec3918014932645eb2e57a2273cce91052b71cc3b55b00a3c56f49acd2cf1
TLSH
T1E9D08C0007390243F0664B3E1AE21B0BAE2AAFB28592CB0913B053094638E25EC7CC2A
MD5 SHA1 SHA512 TLSH

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_C4776F43E34360B285B1E0E212F424A8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_C4776F43E34360B285B1E0E212F424A8
Size 408B
SHA256 6bc58db8fb7b2e6b6e1736e87871b43b3896cf23ffd214e630caeb28092733e1
MD5 d35cb2d63c6e7b67e4e25236ab036b46
SHA1 58c1786ca98746a4d1909a32965b74b7454dc4dd
SHA512 f3878e751a19ed0ea51952b5c28b4acd575dd2f8b0c1dca24609f57110746c34f7756bc361d20c551f5dcd787c51a1549a234d50be12528c79de3cfa1588fd5e
TLSH
T13FE07D18177D823CF136EA385AD9E164C45BEB1204E005A641C262477A22900DDE3939
MD5 SHA1 SHA512 TLSH

Submit Download

7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
Size 404B
SHA256 99a06d73a28cde06a246b6d9a43ef601bd7b3b1c2ee3e14f17af8e7a05c4437d
MD5 2f47e7c49aa58aae92de04fc5bdf891c
SHA1 3dcf83879f39dc6392e4a11a7f58cb1c9bfe8a7e
SHA512 c47d29b06cee917c147218d419238ba54fd54a83b8097a472bf3455093fed8451d26e630a17e4dfe4de201d90b6d083c4c36047b76de2439d07e5e773b608da3
TLSH
T114E07D0819FE62ADF0B4CE759BD559166A17F90104B003FA91C06212AB23E000CE1931
MD5 SHA1 SHA512 TLSH

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
Size 188B
SHA256 0739f4ebf672f463dd3cd163c149ea71c6e5749cfe8cfab59e0ddb90b2d2c824
MD5 7b7a9b3b4bda983719108dc77dd151f8
SHA1 2cab9f6b07c2fc4dbc80e0568a399ad270128574
SHA512 9c65b69a621be42b5db534b9cfe1e24928f1748e621f99d4c2ee250b01975866a8be5bdaada2739562c9346f73cf24f889fdb2dac218bca2e32584c96a2aec7a
TLSH
T1EDC08C002786060BF961033E28310601BF38BB028351C30507F81018893FF200C71C02
MD5 SHA1 SHA512 TLSH

Submit Download

D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE
Size 408B
SHA256 571c27d4e51053bbcbb8c0628dde6c174cf0e176e11dc1bb3da231029305300d
MD5 60c00aaf3b9e87ea625c197df600dfd4
SHA1 af7aaf3610210e1ca55915954bb62676ba32721f
SHA512 7fe1cfc6de2c7b698eb3537d99a8e7ddbefa2e947757f41841d0b96e3b8a4daa5d56ed1e6ac766dd6291def83b266ca85506ec28799977e8f84ad2e0d79aa3e1
TLSH
T144E07D0826FB826EF4A0D57889DDB137592BF712054E61FA00905349B752B051D63E71
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4C94.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI4C94.tmp
Size 96KB
SHA256 18ffc2996e1a0f89a4018da7c9f3287b40b2c19ba9ec9b0265d2d27ac294d7a8
MD5 f12f03b678df900492b14985e5b5fc73
SHA1 87172dc3215fc168157b11d8fb026eaae98cb507
SHA512 05ec9b0858153c96193ccab8e266719494b5170cd70e26ea436eab672bc85d81409319df958261cd7f43015e5e05e27ae98525f015beb080f17f06909b723850
SSDEEP 1536:xVgNTb67hb2MwFTKySgE6bSKycjyc/jVl0TF84+:sb67hvw++SKycjyc/jVlwGt
TLSH
T19AA39E11BA9043BADA8D143018AA8F3BA77DB9A00FE184D39F75EB5D1C716A0F237147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBF26.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIBF26.tmp
Size 61KB
SHA256 e9309d28bd74a9f73a5c1ba8bbae66238ca555a6fb0556b9ddb27806ccc8e6b4
MD5 5c11a7f40108fde1234b41aeddbf2eca
SHA1 dfbed5b6c8dba817e3de6b71ac751da7c91dcfbb
SHA512 52c69908c4e4a5f0780227512c173f2f083d21dd0bba0015ab5c2eb5d3a627c2c3abb35afec1073f1f2089a95a0c3cb58438fb55dabde80746778544eadaa189
SSDEEP 768:g23K9B8Ze5OOomVam8LrEsk7dX30hZbv6KE7LBVToaBiPmlXgl7b2CL3qbK:af8kPom0mU07dUh5rE7LfTHSlOCOK
TLSH
T1FF539D0735A2D0B3CC45457408E9DB469F37F2110BF0D9833FA8165EAFA27E16A3A369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{CB819817-2E11-4BA1-BE23-263ECC957078}\0x0409.ini
Size 6KB
SHA256 2a5eb805543b141d77ce7192c5f7e4e10ffb56de0a5a66905c79298dfc5ffbd5
MD5 26a9b54f250e00693773481b837e03cc
SHA1 554a407bf23984026785430e3bbdffdd1285be06
SHA512 a9f141f96f7bb498c4326cab2e846ce0715830ec86b04a311ccb0c7f3eb6adcc62ec1412cbd8d230b957cd923ab3a81af34b40294297773395d53d8aa73f9073
SSDEEP 96:VXoB2A2ul8/T3INLfRtMx76U0KOFWgVQMG2Uub0QAg80SbtEBapIx0KsLK3E0bT3:J0YT3wLfRA0v/tBAvCSEB90K
TLSH
T1F0D1644F4FA6837E2861031AB26F2651F322956D5363D167B1EF00587383E1893BB6E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1033.MST

Path C:\Users\Admin\AppData\Local\Temp\{CB819817-2E11-4BA1-BE23-263ECC957078}\1033.MST
Size 29KB
SHA256 c7fe1c9c79ae7d66849f5475cbd2223c33f36454ea230b369152e0da42142e1b
MD5 aeb46a432730d2ba209e2354306825c2
SHA1 c194fa4318a961e2f9f147b8963af37898ae0242
SHA512 267c060bc310b29c4cbdbf41901c1f889fa83bacf6505425916f6b9bead0770ab39698ed343cf724f533a1f415db4983292666ee4a1799fe915e94b68a5f644e
SSDEEP 768:jY8jq2zt41yKlK6+jVyvLRIdP7rtLtdPYcP+qPCIZJkZ1tW:E05yjRIdP7rtLtdPYcP+qPCIZJkZ1tW
TLSH
T12FD25273E5803EF2C4E202B41D06E9993AF65C2970B6D3943951B09B51BFE3443F75AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KORG Legacy Collection - WAVESTATION.msi

Path C:\Users\Admin\AppData\Local\Temp\{CB819817-2E11-4BA1-BE23-263ECC957078}\KORG Legacy Collection - WAVESTATION.msi
Size 32.8MB
SHA256 478a6b7f137f8b99c2fdcc38237fe4a625d3f3e479ea4cadcbf5d635ccb10762
MD5 e7fb4879d4db363fdeee79454601b397
SHA1 69a5f21070c711eaccbecc3a90b5c873742eb365
SHA512 baa984c3a17d7eca013427f13c81af0d1b12fac0132d9e195e0c9ffafae7d8af570d79e82106e7f2ad4002f5f842c6818691fb8b0e9c449105056b232944e401
SSDEEP 786432:9ZNJ6rA1nqroWRbwo6Hqv7/2dzPlG999pPKJ5H0drJMqJ:9ZT6r2QtUneTSc
TLSH
T127773361750A8231F1586138440B1B628BF7AD118B2897E777B8EE5F1CF3B60E6B91C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.INI

Path C:\Users\Admin\AppData\Local\Temp\{CB819817-2E11-4BA1-BE23-263ECC957078}\Setup.INI
Size 2KB
SHA256 6b71557af4977b65cb6415a2d816a4956134cd80aa1b2e4ce8eb64267c436969
MD5 50d9b11a74181b72d92da0f9163af0ae
SHA1 974ae200f2caaddcd3d80ca172e26945eae161f5
SHA512 62ead0ee72687b592f592c4c5eaf7ec108753494c95ceff8f033f878b6ec90c1532166c713b7c1be382531d9c244940010c6e9fedc7ebce3b731a7ed9f5f509f
TLSH
T1645130D131A718BD914B607729F722C325C929A009273205D7A44AA2DFDCA2B0B3F2B7
MD5 SHA1 SHA512 TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{CB819817-2E11-4BA1-BE23-263ECC957078}\_ISMSIDEL.INI
Size 11B
SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
MD5 3fdd2635aa94921522af8186f3c3d736
SHA1 0fe63553e9f993c0cb2cb36b8cdcfba4f4a2650d
SHA512 ebdbeefbdc777937fce516a1cbd9af7c305fc242091d695ad919a27c98fac5b6b16b44130bdf97dbfd10561cce701180b1fbb303d848944c3b33b8a3c058653a
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 7b8c40476e25490552606653952d0e9a0e8f0d0116d17ae56b68d8a29538cbfd
MD5 dc89e7251dbd1c5d85d64ac681b96f8f
SHA1 cd82ae53324120f856bdfde8770464ee3aa8bc79
SHA512 4d89a03db0e4922bb8497903e0156b935a342ee84db19d2b1d8222b4ccb662bfa449d4f0605cb506d5acc19ed072121a9fa462865e27ae1afe15ec87fa4fbb11
SSDEEP 24576:8u8m+1zbdoO/vvTLbW0ORG6A1d0zMlUyYymt2r1VsUqVuzN54/19sSvBh:g
TLSH
T1A447B62436F92101E7F7AE3CB8F0AA234D3A7D579C19DE8D45411B4E0921BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a27a4acf-e017-4653-8515-12c43631c84c}_OnDiskSnapshotProp

Path \??\Volume{1143f8f6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a27a4acf-e017-4653-8515-12c43631c84c}_OnDiskSnapshotProp
Size 6KB
SHA256 ad241c3b507feecec5c362fee796401b1f5fa7bfc73f9207232c15d9584f782f
MD5 327e5a4db5266dc3262d1ae0b685eff3
SHA1 4024be1e817d66660e6570b593285784683a0fba
SHA512 dfced6ba75d11664014b297c9fa212ed21456d9f509c94956ceb714422295fe6657f16faa589efe9a05b8a97bd94cfab4eb7d04ed98d9c9febfa0eb98efd15f2
SSDEEP 96:F9Xoq3vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:LXpb++ZVmN
TLSH
T1E7D178085AF54711E2B3AB7129F18557A877B911EF33CB8E0298238E2670A10F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-163-0x0000000000920000-0x0000000000BA1000-memory.dmp

Download

memory/1036-139-0x0000000000920000-0x0000000000BA1000-memory.dmp

Download

memory/1036-142-0x0000000000920000-0x0000000000BA1000-memory.dmp

Download

memory/1036-222-0x0000000000920000-0x0000000000BA1000-memory.dmp

Download

memory/2620-134-0x00000000006A0000-0x0000000000921000-memory.dmp

Download

memory/2620-265-0x00000000006A0000-0x0000000000921000-memory.dmp

Download

memory/2868-221-0x0000000000E70000-0x00000000010F1000-memory.dmp

Download

memory/2868-141-0x0000000000E70000-0x00000000010F1000-memory.dmp

Download

memory/4768-220-0x0000000002140000-0x00000000023C1000-memory.dmp

Download