584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57

General
Target

584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe

Filesize

4MB

Completed

25-11-2021 16:43

Score
10/10
MD5

58b2216c8519dffd06f5e9b522cfc5c5

SHA1

7ad25174ea6b7ef8317840d73ac20e6b9c6df89e

SHA256

584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57

Malware Config

Extracted

Family metasploit
Version windows/single_exec
Signatures 5

Filter: none

  • MetaSploit

    Description

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    17281040WerFault.exe584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
  • Modifies data under HKEY_USERS
    584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
  • Suspicious behavior: EnumeratesProcesses
    584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe

    Reported IOCs

    pidprocess
    2936584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    2936584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
  • Suspicious use of AdjustPrivilegeToken
    584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2936584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    Token: SeImpersonatePrivilege2936584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
    "C:\Users\Admin\AppData\Local\Temp\584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe
      "C:\Users\Admin\AppData\Local\Temp\584522a8a53da3c5cd77b68c235ac8636430cbcb656e80e889746b9f8e4efa57.exe"
      Modifies data under HKEY_USERS
      PID:1040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 788
        Program crash
        PID:1728
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1040-121-0x0000000003D8D000-0x000000000419C000-memory.dmp

                          • memory/1040-122-0x0000000000400000-0x0000000002000000-memory.dmp

                          • memory/2936-118-0x0000000003DF1000-0x0000000004200000-memory.dmp

                          • memory/2936-120-0x0000000000400000-0x0000000002000000-memory.dmp

                          • memory/2936-119-0x0000000004210000-0x0000000004AB2000-memory.dmp