Analysis
- max time kernel
148s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/05/2026, 12:34
General
- Target 2026-05-28_02d2fc5ce562514f01c0e0febeb7b5a4_elex_floxif_wannacry.exe
- Size 28.7MB
- Sample260528-prskhsfx2p
- SHA256 0e6759d90d89033d122dc5cd2bd234b8fdc54c40b3ebc4bf0d4d876e96e59df0
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 14 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 55 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 42 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 56 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 51 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_02d2fc5ce562514f01c0e0febeb7b5a4_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_02d2fc5ce562514f01c0e0febeb7b5a4_elex_floxif_wannacry.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-19"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /c:" 5."3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v productname4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex4⤵
-
-
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled"3⤵
-
-
C:\Windows\system32\findstr.exefindstr "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled"3⤵
-
-
C:\Windows\system32\findstr.exefindstr "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\System32\msi.dll"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\System32\msi.dll"4⤵
-
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"3⤵
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{7A23916E-D258-470B-9F8B-6DA0D529F754} {2FF8895C-C8D0-43BC-822C-5A9998952797} 48404⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{C49E0973-6DBD-4D68-8ACA-2A891EDE813B} {45A467C8-DFE3-48B1-A9ED-6FB0278D399F} 32604⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{B62F3E8A-051E-4D9C-92ED-D53267AE929B} {13FD40E9-87D1-4658-96D3-146220DE6AC3} 22244⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 9325⤵
- Loads dropped DLL
- Program crash
-
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{6F396F6B-7C05-4F69-92A1-804D182229F8} {3851CD43-6A86-432F-BE00-CAB4377E2C00} 16964⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 12045⤵
- Loads dropped DLL
- Program crash
-
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm100.dll"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm100.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm110.dll"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm110.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm140.dll"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm140.dll"4⤵
-
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{440E0BEF-63E9-4F99-8492-3522BA4CC61D} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{67BB9BB3-D228-4BBE-83C2-12E2E59C41EA} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {710f4c1c-cc18-4c49-8cbf-51240c89a1a2}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {9BE518E6-ECC6-35A9-88E4-87755C07200F}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {B175520C-86A2-35A7-8619-86DC379688B9}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {BD95A8CD-1D9F-35AD-981A-3E7925026EBB}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {D401961D-3A20-3AC7-943B-6139D5BD490A}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {8122DAB1-ED4D-3676-BB0A-CA368196543E}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {67BB9BB3-D228-4BBE-83C2-12E2E59C41EA}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {440E0BEF-63E9-4F99-8492-3522BA4CC61D}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\msiexec.exemsiexec /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\System32\mfcm110.dll"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\System32\mfcm110.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\System32\mfcm140.dll"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\System32\mfcm140.dll"4⤵
-
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall\{DB3A77DC-CC8B-42DA-9D87-7691A59BA884} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall\{64442078-E76B-4333-A8DF-31F06B41482B} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {1D8E6291-B0D5-35EC-8441-6616F567A0F7}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {37B8F9C7-03FB-3253-8781-2517C99D7C00}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {010792BA-551A-3AC0-A7EF-0FAB4156C382}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {53CF6934-A98D-3D84-9146-FC4EDF3D5641}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {64442078-E76B-4333-A8DF-31F06B41482B}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {DB3A77DC-CC8B-42DA-9D87-7691A59BA884}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\msiexec.exemsiexec /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete hklm\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exemsiexec /X{CB0836EC-B072-368D-82B2-D3470BF95707} /passive /norestart3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete hklm\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707} /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2019\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2019\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2019\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2019\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 6F59BC1FE3814886AB9BA2E63A36EEE82⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 7F2DED7B791401E59C662346150CEE242⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CCEA1BE37E8FC3998930683AE671B82E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 039695A5F83219FAB3348B9FE8134DEC2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E90760B5377337BD6A54DB9135C5EF902⤵
- Badlisted process makes network request
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260528083927.log" /uninstall /passive /norestart ignored /burn.runonce1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260528083927.log /uninstall /passive /norestart ignored2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260528083927.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{3EE04C3D-0E66-403A-8E83-8A68C08C9242} {4C0FA357-54FA-4B99-B074-C8A48C41F901} 26963⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260528083931.log"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260528083931.log" -burn.unelevated BurnPipe.{D526782B-D6A9-4835-BD0B-C0C74F5B1AF1} {9184C354-DB17-49AE-A312-0D2D8B031992} 26243⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4936 -ip 49361⤵
- Loads dropped DLL
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260528083935.log"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260528083935.log" -burn.unelevated BurnPipe.{4EEE6AEE-D003-48E2-A0CA-21914889B296} {E6BA4F73-8057-4C0A-9773-28F27B752AC6} 16323⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 11844⤵
- Loads dropped DLL
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2700 -ip 27001⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2828 -ip 28281⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Replay Monitor
Loading Replay Monitor...
Downloads
e58ecbe.rbs
e58ecd1.rbs
e58ecd8.rbs
e58ece9.rbs
e58ecee.rbs
e58ed01.rbs
e58ed25.rbf
e58ed2a.rbs
e58ed51.rbs
e58ed5a.rbs
e58ed60.rbs
e58ed67.rbs
e58ed6c.rbs
e58ed71.rbs
e58ed76.rbs
e58ed7d.rbs
e58ed83.rbs
e58ed89.rbs
e58ed8c.rbs
e58ed90.rbs
e58ed98.rbs
e58ed9f.rbs
symsrv.dll
symsrv.dll.000
vcredist_x86.exe.tmp
state.rsm
vcredist_x86.exe.tmp
ATL80.dll
mfc80.dll
mfc80u.dll
mfcm80.dll
mfcm80u.dll
msvcm80.dll
msvcp80.dll
msvcr80.dll
mfc80CHS.dll
mfc80CHT.dll
mfc80DEU.dll
mfc80ENU.dll
mfc80ESP.dll
mfc80FRA.dll
mfc80ITA.dll
mfc80JPN.dll
mfc80KOR.dll
vcomp.dll
mfc90chs.dll
9.0.30729.7523.cat
9.0.30729.7523.policy
atl90.dll
msvcm90.dll
msvcp90.dll
msvcr90.dll
mfc90chs.dll
mfc90cht.dll
mfc90deu.dll
mfc90enu.dll
mfc90esn.dll
mfc90esp.dll
mfc90fra.dll
mfc90ita.dll
mfc90jpn.dll
mfc90kor.dll
mfc90rus.dll
mfc90.dll
mfc90u.dll
mfcm90.dll
mfcm90u.dll
vcomp90.dll
vc_red.msi
Installer.cmd
filever.vbs
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
ucrtbase.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
ucrtbase.dll
Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll
Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll
Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll
Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll
Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
Microsoft.Office.Tools.Common.Implementation.dll
Microsoft.Office.Tools.Common.dll
Microsoft.Office.Tools.Common.v9.0.dll
Microsoft.Office.Tools.Excel.Implementation.dll
Microsoft.Office.Tools.Excel.dll
Microsoft.Office.Tools.Excel.v9.0.dll
Microsoft.Office.Tools.Outlook.Implementation.dll
Microsoft.Office.Tools.Outlook.dll
Microsoft.Office.Tools.Outlook.v9.0.dll
Microsoft.Office.Tools.Word.Implementation.dll
Microsoft.Office.Tools.Word.dll
Microsoft.Office.Tools.Word.v9.0.dll
Microsoft.Office.Tools.dll
Microsoft.Office.Tools.v4.0.Framework.dll
Microsoft.Office.Tools.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.dll
Microsoft.VisualStudio.Tools.Applications.Runtime.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll
Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
Microsoft.VisualStudio.Tools.Office.Runtime.dll
Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll
dd_vcredist_amd64_20260528083927.log
dd_vcredist_amd64_20260528083927_0_vcRuntimeAdditional_x64.log
dd_vcredist_amd64_20260528083927_1_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20260528083935.log
dd_vcredist_amd64_20260528083935_000_vcRuntimeAdditional_x64.log
dd_vcredist_amd64_20260528083935_001_vcRuntimeMinimum_x64.log
dd_vcredist_x86_20260528083931.log
dd_vcredist_x86_20260528083931_000_vcRuntimeAdditional_x86.log
dd_vcredist_x86_20260528083931_001_vcRuntimeMinimum_x86.log
msi.txt
msi.txt
wix.txt
logo.png
wixstdba.dll
wixstdba.dll.tmp
wixstdba.dll
license.rtf
thm.wxl
thm.xml
license.rtf
MSI24BB.tmp
MSI392E.tmp
e58ed9c.msi
ATL80.dll
amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_d7470ca6.cat
amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_d7470ca6.manifest
amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_76a71f32.cat
amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_76a71f32.manifest
msvcm80.dll
msvcp80.dll
msvcr80.dll
amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_478d9237.cat
amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_478d9237.manifest
mfc80.dll
mfc80u.dll
mfcm80.dll
mfcm80u.dll
amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_9cdcab35.cat
amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_9cdcab35.manifest
mfc80CHS.dll
mfc80CHT.dll
mfc80DEU.dll
mfc80ENU.dll
mfc80ESP.dll
mfc80FRA.dll
mfc80ITA.dll
mfc80JPN.dll
mfc80KOR.dll
amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_77aceccc.cat
amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_77aceccc.manifest
vcomp.dll
8.0.50727.6229.cat
8.0.50727.6229.policy
8.0.50727.6229.cat
8.0.50727.6229.policy
8.0.50727.6229.cat
8.0.50727.6229.policy
8.0.50727.6229.cat
8.0.50727.6229.policy
8.0.50727.6229.cat
8.0.50727.6229.policy
x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_a53d26c6.cat
x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_a53d26c6.manifest
x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952.cat
x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952.manifest
x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_1583ac57.cat
x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_1583ac57.manifest
x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_6ad2c555.cat
x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_6ad2c555.manifest
x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_45a306ec.cat
x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_45a306ec.manifest
8.0.50727.6229.cat
8.0.50727.6229.policy
8.0.50727.6229.cat
8.0.50727.6229.policy
8.0.50727.6229.cat
8.0.50727.6229.policy
8.0.50727.6229.cat
8.0.50727.6229.policy
8.0.50727.6229.cat
8.0.50727.6229.policy
memory/436-2509-0x0000000010000000-0x0000000010030000-memory.dmp
memory/436-2511-0x0000000010000000-0x0000000010030000-memory.dmp
memory/536-2662-0x0000000010000000-0x0000000010030000-memory.dmp
memory/536-2599-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1060-3167-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1080-3098-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1220-2334-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1220-2328-0x0000000000090000-0x00000000000EE000-memory.dmp
memory/1220-2332-0x0000000000090000-0x00000000000EE000-memory.dmp
memory/1220-2288-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1220-2324-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1220-2330-0x0000000072570000-0x0000000072594000-memory.dmp
memory/1632-2655-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1632-2678-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1632-2513-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1696-2484-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1696-2575-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2164-2873-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2164-2854-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2204-2817-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2204-2814-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2224-2406-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2224-2480-0x0000000000FA0000-0x0000000001005000-memory.dmp
memory/2224-2482-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2480-3074-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2480-3043-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2496-3150-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2624-2434-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2624-2581-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2624-2579-0x0000000000FA0000-0x0000000001005000-memory.dmp
memory/2624-2515-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2696-2478-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2696-2367-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2696-2544-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2696-2541-0x0000000000780000-0x00000000007DE000-memory.dmp
memory/2700-2487-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2700-2573-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2720-2433-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2720-2430-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2828-2675-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2828-2516-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2828-2664-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2876-2400-0x0000000000780000-0x00000000007DE000-memory.dmp
memory/2876-2402-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2876-2342-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2888-2744-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2888-2751-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2888-2811-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-3258-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-3176-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-3175-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-3170-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3128-2748-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3128-2960-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3128-2931-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3128-2810-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3128-2754-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3256-3086-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3260-2403-0x0000000000780000-0x00000000007DE000-memory.dmp
memory/3260-2340-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3260-2404-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3316-2929-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3316-2908-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3388-2968-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3464-2365-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3464-2363-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3488-2538-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3488-2576-0x0000000000FA0000-0x0000000001005000-memory.dmp
memory/3488-2436-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3488-2578-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3564-2976-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3580-2978-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3580-3036-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3804-3040-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3964-2852-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3964-2820-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4020-2321-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4020-2339-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4020-2910-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4020-12-0x0000000075355000-0x0000000075356000-memory.dmp
memory/4020-14-0x0000000075340000-0x00000000753A3000-memory.dmp
memory/4020-15-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4020-826-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4020-1133-0x0000000075340000-0x00000000753A3000-memory.dmp
memory/4020-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4020-2304-0x0000000075340000-0x00000000753A3000-memory.dmp
memory/4020-4120-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4020-4121-0x0000000075340000-0x00000000753A3000-memory.dmp
memory/4236-2369-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4236-2542-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4236-2539-0x0000000000780000-0x00000000007DE000-memory.dmp
memory/4236-2485-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4520-2982-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4520-3259-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4520-2963-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4520-2750-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4520-2743-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4552-3152-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4552-3034-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4552-2983-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4552-2906-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4552-3159-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4668-3100-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4668-3120-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4840-2323-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4840-2335-0x0000000000090000-0x00000000000EE000-memory.dmp
memory/4840-2286-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4840-2326-0x0000000000090000-0x00000000000EE000-memory.dmp
memory/4840-2337-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4936-2459-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4936-2409-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5036-2740-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5036-2729-0x0000000010000000-0x0000000010030000-memory.dmp