Overview

overview

8

Static

static

1

reWASD933-11011.exe

windows10-2004-x64

reWASD933-11011.exe

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    101s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/05/2026, 19:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    reWASD933-11011.exe
  • Size 64.8MB
  • Sample260503-xp4trsa14r
  • SHA256 48f23ca06c1fcfd195843d6551cec2a17b27b8304f78eaf74c95675dae06913a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 6 IoCs
    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 39 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 44 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\reWASD933-11011.exe
    "C:\Users\Admin\AppData\Local\Temp\reWASD933-11011.exe"
    1⤵
    • Adds Run key to start application
    • Downloads MZ/PE file
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe
      "C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe" /install /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Windows\Temp\{130EE186-6355-4DAB-91A1-C68835863494}\.cr\windowsdesktop-runtime-win-x86.exe
        "C:\Windows\Temp\{130EE186-6355-4DAB-91A1-C68835863494}\.cr\windowsdesktop-runtime-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe" -burn.filehandle.attached=704 -burn.filehandle.self=708 /install /quiet /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Windows\Temp\{69216230-C2AE-455A-9E0F-5CE9DFBB936C}\.be\windowsdesktop-runtime-9.0.0-win-x86.exe
          "C:\Windows\Temp\{69216230-C2AE-455A-9E0F-5CE9DFBB936C}\.be\windowsdesktop-runtime-9.0.0-win-x86.exe" -q -burn.elevated BurnPipe.{428CB0CC-0A92-4C47-974C-62DCF86BF534} {D0889769-2C6F-44BD-B559-2CF640FDD4BC} 1004
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:2160
    • C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe
      "C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe" /install /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\Temp\{1BA49D0A-1455-4BF5-849B-9D4ED2EF8D9E}\.cr\aspnetcore-runtime-x86.exe
        "C:\Windows\Temp\{1BA49D0A-1455-4BF5-849B-9D4ED2EF8D9E}\.cr\aspnetcore-runtime-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /install /quiet /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Windows\Temp\{A330C7E8-0630-423C-8AF3-FF858E38DFE5}\.be\AspNetCoreSharedFrameworkBundle-x86.exe
          "C:\Windows\Temp\{A330C7E8-0630-423C-8AF3-FF858E38DFE5}\.be\AspNetCoreSharedFrameworkBundle-x86.exe" -q -burn.elevated BurnPipe.{D9C64DD4-F556-41A7-9EBA-CE37E38F419C} {CD06B49C-A736-4CDD-AEF1-75A999F22C95} 2900
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4308
    • C:\Windows\SysWOW64\logman.exe
      "C:\Windows\System32\logman.exe" start REWASD_service -p {1E767961-1C64-4044-BA73-7B9AE696BF0C} 0xff 255 -o "C:\Users\Public\Documents\reWASD\Logs\REWASD_service.etl" -ets
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4400
    • C:\Windows\SysWOW64\logman.exe
      "C:\Windows\System32\logman.exe" start REWASD_driver -p {E35FE979-9CB9-41C3-A38E-1787EDAEBD93} 0xff 255 -o "C:\Users\Public\Documents\reWASD\Logs\REWASD_driver.etl" -ets
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2520
    • C:\Program Files\reWASD\xjn17svc.exe
      "C:\Program Files\reWASD\xjn17svc.exe" -drvcheck
      2⤵
      • Executes dropped EXE
      PID:1512
    • C:\Program Files\reWASD\xjn17svc.exe
      "C:\Program Files\reWASD\xjn17svc.exe" -drvinstall
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4700
    • C:\Program Files\reWASD\xjn17svc.exe
      "C:\Program Files\reWASD\xjn17svc.exe" -install
      2⤵
      • Executes dropped EXE
      PID:1580
    • C:\Windows\SysWOW64\logman.exe
      "C:\Windows\System32\logman.exe" stop REWASD_service -ets
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3760
    • C:\Windows\SysWOW64\logman.exe
      "C:\Windows\System32\logman.exe" stop REWASD_driver -ets
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1472
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" advfirewall firewall add rule name="reWASD Engine App" dir=in program="C:\Program Files\reWASD\Engine.exe" action=allow protocol=TCP
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4516
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" http add urlacl url=http://*:35474/ sddl=D:(A;;GX;;;S-1-1-0)
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3524
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" http add urlacl url=http://localhost:35474/ sddl=D:(A;;GX;;;S-1-1-0)
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4572
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" advfirewall firewall add rule name="reWASD Engine Http (In) 35474" dir=in action=allow protocol=TCP localport=35474
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4264
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" http add urlacl url=http://*:35475/ sddl=D:(A;;GX;;;S-1-1-0)
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3332
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" http add urlacl url=http://localhost:35475/ sddl=D:(A;;GX;;;S-1-1-0)
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3400
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" advfirewall firewall add rule name="reWASD Engine Http (In) 35475" dir=in action=allow protocol=TCP localport=35475
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:1028
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" http add urlacl url=http://*:35476/ sddl=D:(A;;GX;;;S-1-1-0)
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3448
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" http add urlacl url=http://localhost:35476/ sddl=D:(A;;GX;;;S-1-1-0)
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:1664
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" advfirewall firewall add rule name="reWASD Engine Http (In) 35476" dir=in action=allow protocol=TCP localport=35476
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:860
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" advfirewall firewall add rule name="reWASD UDP Emulator Port <36474>" dir=in action=allow protocol=UDP localport=36474
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3520
    • C:\Windows\SysWOW64\netsh.exe
      "netsh.exe" advfirewall firewall add rule name="reWASD MDNS UDP 5353" dir=in action=allow protocol=UDP localport=5353
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:1156
    • C:\Windows\SysWOW64\shutdown.exe
      "C:\Windows\System32\shutdown.exe" /r /t 0
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1724
  • C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\windowsdesktop-runtime-9.0.0-win-x86.exe
    "C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\windowsdesktop-runtime-9.0.0-win-x86.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\windowsdesktop-runtime-9.0.0-win-x86.exe
      "C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\windowsdesktop-runtime-9.0.0-win-x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338.log" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4152
      • C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\windowsdesktop-runtime-9.0.0-win-x86.exe
        "C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\windowsdesktop-runtime-9.0.0-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\windowsdesktop-runtime-9.0.0-win-x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338.log" /install
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\windowsdesktop-runtime-9.0.0-win-x86.exe
          "C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\windowsdesktop-runtime-9.0.0-win-x86.exe" -q -burn.elevated BurnPipe.{45CF0A38-B9EF-42DD-B865-205022A70C8E} {22B3BC05-062C-4024-94CD-E5C8776E2E16} 2724
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3524
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 26E00FE2243837165EBB92ECB76A7BD4
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2152
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 399B25D99FB1E9F6B3D1AF74210DDA41
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4952
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding EFF0C0DD024198D3CF683D24081C273C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4600
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 04A9DAEF1661726193A3322B3E298850
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3192
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BA0DE1A0A3B7403438229A8370F04A2D
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1560
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    PID:2400
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:4648
    • C:\ProgramData\Package Cache\{7db4f4d0-13ae-4544-8c31-8f13d0c55da7}\AspNetCoreSharedFrameworkBundle-x86.exe
      "C:\ProgramData\Package Cache\{7db4f4d0-13ae-4544-8c31-8f13d0c55da7}\AspNetCoreSharedFrameworkBundle-x86.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:408
      • C:\ProgramData\Package Cache\{7db4f4d0-13ae-4544-8c31-8f13d0c55da7}\AspNetCoreSharedFrameworkBundle-x86.exe
        "C:\ProgramData\Package Cache\{7db4f4d0-13ae-4544-8c31-8f13d0c55da7}\AspNetCoreSharedFrameworkBundle-x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260503200352.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\ProgramData\Package Cache\{7db4f4d0-13ae-4544-8c31-8f13d0c55da7}\AspNetCoreSharedFrameworkBundle-x86.exe
          "C:\ProgramData\Package Cache\{7db4f4d0-13ae-4544-8c31-8f13d0c55da7}\AspNetCoreSharedFrameworkBundle-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{7db4f4d0-13ae-4544-8c31-8f13d0c55da7}\AspNetCoreSharedFrameworkBundle-x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260503200352.log" /install
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1900
          • C:\ProgramData\Package Cache\{7db4f4d0-13ae-4544-8c31-8f13d0c55da7}\AspNetCoreSharedFrameworkBundle-x86.exe
            "C:\ProgramData\Package Cache\{7db4f4d0-13ae-4544-8c31-8f13d0c55da7}\AspNetCoreSharedFrameworkBundle-x86.exe" -q -burn.elevated BurnPipe.{44B2EB04-017D-4192-BCE8-92AA680FE632} {D41D03A6-D2F6-439D-8565-BA48DBC18888} 1900
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1612
    • C:\Program Files\reWASD\Engine.exe
      "C:\Program Files\reWASD\Engine.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2800
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4250d9c9-6131-0e49-9518-74a07e6aaf3e}\xjn17hlp.inf" "9" "460ceccbf" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\program files\rewasd"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:3520
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:b2fe4818ebc2f07d:Install:3.47.0.0:root\xjn17hlp," "460ceccbf" "000000000000014C"
        2⤵
        • Drops file in Drivers directory
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        PID:3992
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3a035ab7-20cf-ef40-89c3-44ec7e61a25e}\xjn17flt.inf" "9" "4438e8ec7" "000000000000014C" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\reWASD"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4356
    • C:\Program Files\reWASD\xjn17svc.exe
      "C:\Program Files\reWASD\xjn17svc.exe"
      1⤵
      • Executes dropped EXE
      PID:1872
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3961855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:3344

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Network Share Discovery

          1
          T1135

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          4
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58d86c.rbs
          • Path C:\Config.Msi\e58d86c.rbs
          • Size 49KB
          • SHA256 30206213068ccd05d9ad1693e94c6aeed8b226f4b9160eebaf0543aa013a3f24
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58d871.rbs
          • Path C:\Config.Msi\e58d871.rbs
          • Size 8KB
          • SHA256 fb8925b5a06b8fafe60973bb1e3e2f125902c56113790fcc3d1bafd405f94a99
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58d876.rbs
          • Path C:\Config.Msi\e58d876.rbs
          • Size 9KB
          • SHA256 c9e447240687498fa2256c8d9637541cdff29f0651caa0b3288e51b3f71bca0c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58d87b.rbs
          • Path C:\Config.Msi\e58d87b.rbs
          • Size 91KB
          • SHA256 939e46d42e9f220449f9b49f2193b721285f6db6e8e68796c9e6988b7c814347
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58d87f.rbs
          • Path C:\Config.Msi\e58d87f.rbs
          • Size 3KB
          • SHA256 3d9329be93f1a118cff948caabfdf625770b67de6fe7060afa365b395d5cde5a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          e58d883.rbs
          • Path C:\Config.Msi\e58d883.rbs
          • Size 41KB
          • SHA256 e6f4252881744c1012f7c5cf00f7e49a08e758fa9ac4e939e59618d59e4f64a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LICENSE.txt
          • Path C:\Program Files (x86)\dotnet\LICENSE.txt
          • Size 9KB
          • SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ThirdPartyNotices.txt
          • Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
          • Size 77KB
          • SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostfxr.dll
          • Path C:\Program Files (x86)\dotnet\host\fxr\9.0.0\hostfxr.dll
          • Size 290KB
          • SHA256 1beb96617cda3b055189bea5e3e11219f756a620158f53de252bb8bd73acc648
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.AspNetCore.App.deps.json
          • Path C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\9.0.0\Microsoft.AspNetCore.App.deps.json
          • Size 22KB
          • SHA256 66048999fdd7e7036edc96b9c47fc8573196ecbe6d71513278e14d8a97213443
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.AspNetCore.App.runtimeconfig.json
          • Path C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\9.0.0\Microsoft.AspNetCore.App.runtimeconfig.json
          • Size 288B
          • SHA256 9a7c72899fd77964b0d94fc7aa7049fe86d8b36253085a8b79743f45ccdd5d9b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft.NETCore.App.deps.json
          • Path C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\9.0.0\Microsoft.NETCore.App.deps.json
          • Size 27KB
          • SHA256 b73fb91c3317c91fc83ba2353746b26a15cffc378e41835318d2bc252fcce69a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.NETCore.App.runtimeconfig.json
          • Path C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\9.0.0\Microsoft.NETCore.App.runtimeconfig.json
          • Size 53B
          • SHA256 b6de529b719ac3e585c6108e79430e42474e787fdbc8d7ec13ee2f345b0e5019
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          coreclr.dll
          • Path C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\9.0.0\coreclr.dll
          • Size 3.7MB
          • SHA256 f0f6a605e2aefea241e341205f78f95fd8c0dabefb615f158b1cb779023b7312
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostpolicy.dll
          • Path C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\9.0.0\hostpolicy.dll
          • Size 310KB
          • SHA256 4c4eb3f7ef55c557887d04edc3210b4c5ca21df854733b2f7ac1c61733919e44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WindowsDesktop.App.deps.json
          • Path C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.0\Microsoft.WindowsDesktop.App.deps.json
          • Size 30KB
          • SHA256 c891999cf4e8b3e69350f2e3a3fac373253e4a82c1e297581cb23dbf7391a0d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WindowsDesktop.App.runtimeconfig.json
          • Path C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.0\Microsoft.WindowsDesktop.App.runtimeconfig.json
          • Size 182B
          • SHA256 12f80b547fa7b0df84079463be2c2db7461817a6f2ad589154cac57a7ac89333
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Engine.exe
          • Path C:\Program Files\reWASD\Engine.exe
          • Size 240KB
          • SHA256 48d5abdcb8f8a837a1be7aed1b3bbc54ea4cfd64d1a0b2da4862f92a06be5c05
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Engine.runtimeconfig.json
          • Path C:\Program Files\reWASD\Engine.runtimeconfig.json
          • Size 658B
          • SHA256 41a88135a11c11c242e55330e62a42b122b5e7d8ba4b2fdbecd0ab6dd4d57f13
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          reWASDUI.exe
          • Path C:\Program Files\reWASD\reWASDUI.exe
          • Size 242KB
          • SHA256 8f11f6688dbb9f5002934bbedefd1a313f203b2e476308f39d2d6d1fde3aa39b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          xjn17flt.cat
          • Path C:\Program Files\reWASD\xjn17flt.cat
          • Size 11KB
          • SHA256 da91a9b80f845b6a65796858d387f2e1e5568d7e2672a32012e72b769f150c17
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          xjn17flt.inf
          • Path C:\Program Files\reWASD\xjn17flt.inf
          • Size 920B
          • SHA256 b5b7e631ab14452cebbf9b5fe3f35aa66bb526b28bb1b2d71d1d35e53d29aedc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          xjn17hlp.cat
          • Path C:\Program Files\reWASD\xjn17hlp.cat
          • Size 11KB
          • SHA256 2aef45fe73204b4fc4a3cdba842500068d91e9fe3204a7ae55319ee22847a7a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          xjn17hlp.inf
          • Path C:\Program Files\reWASD\xjn17hlp.inf
          • Size 1KB
          • SHA256 674ff3ef97cb8c24eb05dc52f00c3ef57fedc2950d3a27e434a5f4d878e3cfda
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          xjn17hlp.sys
          • Path C:\Program Files\reWASD\xjn17hlp.sys
          • Size 342KB
          • SHA256 36d618f8601ee6e9266c8583685886b264961e030d221c10de6f80a66b956c13
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          xjn17svc.exe
          • Path C:\Program Files\reWASD\xjn17svc.exe
          • Size 3.2MB
          • SHA256 5db5c4b9064fd0ca5b3a7ecf8f27c295b1398c5ebd4ed5c2ea5f205c35623a8c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.json
          • Path C:\ProgramData\Disc-Soft\reWASD\Settings\settings.json
          • Size 2B
          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
          • MD5 SHA1 SHA512
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\state.rsm
          • Size 1KB
          • SHA256 44f63da2436e2cbb18dd76507e2335febace87a6892c8a163de3951defa897f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{51d35d67-0e91-4228-a998-e9d59b515557}\state.rsm
          • Size 1016B
          • SHA256 781c05083e8d9266094ae49076b27bdcdd0f4228fed089e4e7edf8772d325c5e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338_000_dotnet_runtime_9.0.0_win_x86.msi.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338_000_dotnet_runtime_9.0.0_win_x86.msi.log
          • Size 2KB
          • SHA256 fa32d2838477ef32496483140d485aac608617c15743750eefafb3150b2e528a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338_001_dotnet_hostfxr_9.0.0_win_x86.msi.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338_001_dotnet_hostfxr_9.0.0_win_x86.msi.log
          • Size 2KB
          • SHA256 fab2c6d206adc059b89a823e2392e64c29e787734aca93ae3021ff53774d5c11
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338_002_dotnet_host_9.0.0_win_x86.msi.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338_002_dotnet_host_9.0.0_win_x86.msi.log
          • Size 2KB
          • SHA256 6b53a4128fd68ca84cba7c6546eee3b5bdb2d3ae57b090b020ce807803ec0fde
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338_003_windowsdesktop_runtime_9.0.0_win_x86.msi.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.0_(x86)_20260503200338_003_windowsdesktop_runtime_9.0.0_win_x86.msi.log
          • Size 2KB
          • SHA256 b6fb584205e5f8795bf2878e902a12f43186d89650f26febab9c8af99a738a0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_dd_AspNetCoreSharedFramework___20260503200352_000_AspNetCoreSharedFramework_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260503200352_000_AspNetCoreSharedFramework_x86.log
          • Size 3KB
          • SHA256 96bd5c4a80e4d184e2ac05ab20d8639f79c2483b9ca5e2c25b20e8ef6fadd0ec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          aspnetcore-runtime-x86.exe
          • Path C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe
          • Size 9.4MB
          • SHA256 6816090d80082fcefb22a4ebe7a67494746505f211a53c5245e3e5979ce12c04
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          For Any device.rewasd
          • Path C:\Users\Public\Documents\reWASD\Profiles\Switch console\Controller\For Any device.rewasd
          • Size 69KB
          • SHA256 e7efc86ef882c162fa88d2764b8b647966f5a5e1bc631ff0781baebaae143643
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIE849.tmp
          • Path C:\Windows\Installer\MSIE849.tmp
          • Size 219KB
          • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windowsdesktop-runtime-win-x86.exe
          • Path C:\Windows\Temp\{130EE186-6355-4DAB-91A1-C68835863494}\.cr\windowsdesktop-runtime-win-x86.exe
          • Size 608KB
          • SHA256 253fc418f3a58c52698354a72ec218d99641690a553adb37bb127720d855e407
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          aspnetcore-runtime-x86.exe
          • Path C:\Windows\Temp\{1BA49D0A-1455-4BF5-849B-9D4ED2EF8D9E}\.cr\aspnetcore-runtime-x86.exe
          • Size 589KB
          • SHA256 f35483ec561206ab99b8fc830496da4949fb2598905ed46b83b0493abad267c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bg.png
          • Path C:\Windows\Temp\{69216230-C2AE-455A-9E0F-5CE9DFBB936C}\.ba\bg.png
          • Size 4KB
          • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{69216230-C2AE-455A-9E0F-5CE9DFBB936C}\.ba\wixstdba.dll
          • Size 190KB
          • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet_host_9.0.0_win_x86.msi
          • Path C:\Windows\Temp\{69216230-C2AE-455A-9E0F-5CE9DFBB936C}\dotnet_host_9.0.0_win_x86.msi
          • Size 696KB
          • SHA256 dbda997711ec4416285e85ab86a062b3fffc023c45cc6e62b51098ac1e3553bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet_hostfxr_9.0.0_win_x86.msi
          • Path C:\Windows\Temp\{69216230-C2AE-455A-9E0F-5CE9DFBB936C}\dotnet_hostfxr_9.0.0_win_x86.msi
          • Size 756KB
          • SHA256 f3b4b6bfeb1d00f739df5e826e6ba60d4f1832095935865380186454fe1ec45a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet_runtime_9.0.0_win_x86.msi
          • Path C:\Windows\Temp\{69216230-C2AE-455A-9E0F-5CE9DFBB936C}\dotnet_runtime_9.0.0_win_x86.msi
          • Size 24.9MB
          • SHA256 0084b6f6e7a96b308263e46f723c271b956fb75a2e14fbd28c28d9e91fefc8a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windowsdesktop_runtime_9.0.0_win_x86.msi
          • Path C:\Windows\Temp\{69216230-C2AE-455A-9E0F-5CE9DFBB936C}\windowsdesktop_runtime_9.0.0_win_x86.msi
          • Size 27.6MB
          • SHA256 aecc85f6937e96260abbf183085360f6da70755b31d58ab1caadf05ecca248a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{6BF65481-1F16-449C-91CD-636EE4B44567}\.ba\thm.wxl
          • Size 4KB
          • SHA256 65507ddc6f2ab2a93b684684ba1d69fdf0b024296367cdce5dad31d5e49813d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{A330C7E8-0630-423C-8AF3-FF858E38DFE5}\.ba\logo.png
          • Size 12KB
          • SHA256 c8e23a42e04fbd73f5f66f3b9f2ba34a777bc4769c413a0f78335a4e757baad5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AspNetCoreSharedFramework_x86
          • Path C:\Windows\Temp\{A330C7E8-0630-423C-8AF3-FF858E38DFE5}\AspNetCoreSharedFramework_x86
          • Size 9.1MB
          • SHA256 26b73c7d7733772084ea082cdc4d0705e94c8eb2e278992c5bf648a97dca3574
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{F6C094F6-A84D-4D0C-BB51-361DE85A18D4}\.ba\1033\thm.wxl
          • Size 5KB
          • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/680-1055-0x000000000C770000-0x000000000C782000-memory.dmp
          Download

          memory/680-8-0x00000000099E0000-0x0000000009A06000-memory.dmp
          Download

          memory/680-1447-0x0000000008D90000-0x0000000009343000-memory.dmp
          Download

          memory/680-1-0x00000000067B0000-0x00000000067C0000-memory.dmp
          Download

          memory/680-0-0x0000000000340000-0x0000000004408000-memory.dmp
          Download

          memory/680-2-0x0000000009590000-0x0000000009644000-memory.dmp
          Download

          memory/680-3-0x00000000099D0000-0x00000000099DA000-memory.dmp
          Download

          memory/680-35-0x0000000009350000-0x0000000009423000-memory.dmp
          Download

          memory/680-9-0x0000000009A20000-0x0000000009A28000-memory.dmp
          Download

          memory/680-10-0x0000000009A40000-0x0000000009A58000-memory.dmp
          Download

          memory/680-851-0x0000000008D90000-0x0000000009343000-memory.dmp
          Download

          memory/680-11-0x0000000009A60000-0x0000000009A6A000-memory.dmp
          Download

          memory/680-12-0x0000000009A90000-0x0000000009A98000-memory.dmp
          Download

          memory/680-13-0x0000000009A70000-0x0000000009A7A000-memory.dmp
          Download

          memory/680-33-0x00000000067B0000-0x00000000067C0000-memory.dmp
          Download

          memory/680-18-0x000000000A140000-0x000000000A180000-memory.dmp
          Download

          memory/680-19-0x00000000067B0000-0x00000000067C0000-memory.dmp
          Download

          memory/680-28-0x000000000C550000-0x000000000C568000-memory.dmp
          Download

          memory/680-20-0x000000000A2A0000-0x000000000A2A8000-memory.dmp
          Download

          memory/680-21-0x000000000CA90000-0x000000000CAC8000-memory.dmp
          Download

          memory/680-1056-0x000000000C760000-0x000000000C76A000-memory.dmp
          Download

          memory/680-358-0x0000000008D90000-0x0000000009343000-memory.dmp
          Download

          memory/680-25-0x0000000008D90000-0x0000000009343000-memory.dmp
          Download

          memory/680-1216-0x000000000FE00000-0x000000000FE76000-memory.dmp
          Download

          memory/680-1217-0x000000000C7B0000-0x000000000C7CE000-memory.dmp
          Download

          memory/680-26-0x0000000009350000-0x0000000009423000-memory.dmp
          Download

          memory/680-27-0x00000000067B0000-0x00000000067C0000-memory.dmp
          Download

          memory/680-24-0x000000000CDD0000-0x000000000CE62000-memory.dmp
          Download

          memory/680-23-0x00000000067B0000-0x00000000067C0000-memory.dmp
          Download

          memory/680-22-0x000000000C520000-0x000000000C52E000-memory.dmp
          Download

          memory/1004-468-0x0000000003830000-0x0000000003903000-memory.dmp
          Download

          memory/1004-778-0x0000000003830000-0x0000000003903000-memory.dmp
          Download

          memory/1504-1432-0x0000021636220000-0x0000021636299000-memory.dmp
          Download

          memory/1504-1464-0x0000021637BA0000-0x0000021637BAC000-memory.dmp
          Download

          memory/1504-853-0x0000021636220000-0x0000021636299000-memory.dmp
          Download

          memory/1504-1463-0x0000021636220000-0x0000021636299000-memory.dmp
          Download

          memory/1504-676-0x0000021636220000-0x0000021636299000-memory.dmp
          Download

          memory/1504-677-0x0000021637BA0000-0x0000021637BAC000-memory.dmp
          Download

          memory/1612-1445-0x0000000002B40000-0x0000000002C13000-memory.dmp
          Download

          memory/1872-1431-0x00007FFCBD9B0000-0x00007FFCBD9C0000-memory.dmp
          Download

          memory/1900-1446-0x00000000031C0000-0x0000000003293000-memory.dmp
          Download

          memory/2160-469-0x0000000002930000-0x0000000002A03000-memory.dmp
          Download

          memory/2160-776-0x0000000002930000-0x0000000002A03000-memory.dmp
          Download

          memory/2724-850-0x0000000003230000-0x0000000003303000-memory.dmp
          Download

          memory/2724-673-0x0000000003230000-0x0000000003303000-memory.dmp
          Download

          memory/2800-1268-0x0000000008C80000-0x0000000008D53000-memory.dmp
          Download

          memory/2900-1054-0x0000000002D80000-0x0000000002E53000-memory.dmp
          Download

          memory/2900-855-0x0000000002D80000-0x0000000002E53000-memory.dmp
          Download

          memory/3520-1351-0x000001EDF6440000-0x000001EDF644C000-memory.dmp
          Download

          memory/3524-849-0x0000000002B60000-0x0000000002C33000-memory.dmp
          Download

          memory/4308-888-0x0000000003770000-0x0000000003843000-memory.dmp
          Download

          memory/4308-1052-0x0000000003770000-0x0000000003843000-memory.dmp
          Download

          memory/4356-1418-0x0000024F4D8A0000-0x0000024F4D8AC000-memory.dmp
          Download

          memory/4700-1422-0x000001BCD7C40000-0x000001BCD7C4C000-memory.dmp
          Download