Overview

overview

10

Static

static

10

5430b7081b...cs.exe

windows7-x64

10

5430b7081b...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 01:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe
  • Size 2.9MB
  • Sample240512-bf2gdscb29
  • SHA256 49556f419a3ec5e682c72cdcd04614f640f2b99fdabd35c2833073aad200e559
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasionexecutioninfostealerrattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 39 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 48 IoCs
    evasiontrojan
  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Checks whether UAC is enabled 1 TTPs 32 IoCs
    evasiontrojan
  • Drops file in Program Files directory 28 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 39 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 61 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 48 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1532
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1560
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2520
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3132
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3144
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2656
    • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1392
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d1166f7-3727-44e3-b877-c099d5678495.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4264
        • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
          "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4608
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\862d4a0e-270f-4241-a783-47c183dfd729.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4392
            • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
              "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3236
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\105c69fb-5201-4540-bd25-14747562fb22.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:3672
                • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                  "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:116
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84fda92e-3745-41fb-8fd2-6faa4a501cb2.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1860
                    • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                      "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4472
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\393c3942-28c8-4c65-aadf-cb64434f3687.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2700
                        • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                          "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:2836
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a783ea29-e4bd-481c-bd73-e0cc57c1cf5c.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:932
                            • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:1636
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\501984fd-f80a-46e2-bf17-1239351bf49a.vbs"
                                15⤵
                                  PID:1576
                                  • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                                    "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                                    16⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • System policy modification
                                    PID:3248
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\351ad505-74cf-48b7-806b-eeae656997da.vbs"
                                      17⤵
                                        PID:3984
                                        • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                                          "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                                          18⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • System policy modification
                                          PID:4524
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e868c1c9-bf6e-4538-8664-a7003d30d6f9.vbs"
                                            19⤵
                                              PID:484
                                              • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                                                "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                                                20⤵
                                                • UAC bypass
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • System policy modification
                                                PID:1344
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d82bc30-a7e9-43b1-96b0-f5d11f59ca0e.vbs"
                                                  21⤵
                                                    PID:3916
                                                    • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                                                      "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                                                      22⤵
                                                      • UAC bypass
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • System policy modification
                                                      PID:2040
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9aaef37a-6be6-414c-b9d2-c8c392793b2e.vbs"
                                                        23⤵
                                                          PID:4952
                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                                                            "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                                                            24⤵
                                                            • UAC bypass
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Checks whether UAC is enabled
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • System policy modification
                                                            PID:3200
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33abccd0-1c42-45ab-97d9-53fc150003d1.vbs"
                                                              25⤵
                                                                PID:4788
                                                                • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                                                                  "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                                                                  26⤵
                                                                  • UAC bypass
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • System policy modification
                                                                  PID:4552
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d726889-5986-4e2c-8487-b60e0c4f64b2.vbs"
                                                                    27⤵
                                                                      PID:3048
                                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                                                                        28⤵
                                                                        • UAC bypass
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Checks whether UAC is enabled
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • System policy modification
                                                                        PID:1456
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca37e59e-7b28-48dd-b475-3f258635920e.vbs"
                                                                          29⤵
                                                                            PID:4668
                                                                            • C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
                                                                              "C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
                                                                              30⤵
                                                                              • UAC bypass
                                                                              • Executes dropped EXE
                                                                              • Checks whether UAC is enabled
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • System policy modification
                                                                              PID:1392
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\221d9f92-40fb-4f59-828c-f1cb72c77cff.vbs"
                                                                            29⤵
                                                                              PID:2492
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1991667a-2ef2-42f7-88aa-21eb50b84169.vbs"
                                                                          27⤵
                                                                            PID:3624
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7026d59f-4d50-4dee-91db-4bdd354b5776.vbs"
                                                                        25⤵
                                                                          PID:1352
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\127fccc2-beec-44fd-b95d-09ed569d5296.vbs"
                                                                      23⤵
                                                                        PID:912
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a02eba7a-6450-4846-8d01-679db95709c7.vbs"
                                                                    21⤵
                                                                      PID:3452
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e945dec0-e521-4ec3-b403-74e0ddced6f0.vbs"
                                                                  19⤵
                                                                    PID:1148
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e618ac5-f995-4a7c-8735-f642cdd5a56d.vbs"
                                                                17⤵
                                                                  PID:3972
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eab23ddf-763d-4a75-afdc-2967282361a7.vbs"
                                                              15⤵
                                                                PID:3676
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b54786c2-b6b3-4613-a2aa-6f7959ee485f.vbs"
                                                            13⤵
                                                              PID:1560
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e8554f29-47f6-48d6-93a8-d4dca2298ef2.vbs"
                                                          11⤵
                                                            PID:816
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91bf120b-b822-46b6-a299-4728ea929ea8.vbs"
                                                        9⤵
                                                          PID:5016
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5da1fa5-5508-416a-bd1c-5b67bb2fe34a.vbs"
                                                      7⤵
                                                        PID:3804
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67984555-e227-40ae-b2f5-ca19b2137e70.vbs"
                                                    5⤵
                                                      PID:1644
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20bb1961-e15b-4a95-8d97-cee3914f4b22.vbs"
                                                  3⤵
                                                    PID:2660
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3860
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1344
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:5088
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\StartMenuExperienceHost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4276
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3384
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4280
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\winlogon.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2952
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\winlogon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3244
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\winlogon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2200
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Recent\RuntimeBroker.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3740
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Recent\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4568
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Recent\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3904
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3088
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3344
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4432
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\microsoft.system.package.metadata\smss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2184
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\microsoft.system.package.metadata\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3108
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\microsoft.system.package.metadata\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4264
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Windows\Web\Screen\backgroundTaskHost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3756
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Web\Screen\backgroundTaskHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4176
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Windows\Web\Screen\backgroundTaskHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4792
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics5" /sc MINUTE /mo 14 /tr "'C:\Windows\SchCache\5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:208
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics" /sc ONLOGON /tr "'C:\Windows\SchCache\5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3040
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics5" /sc MINUTE /mo 5 /tr "'C:\Windows\SchCache\5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2840
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics5" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3632
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4844
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics5" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2876
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\winlogon.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4556
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\winlogon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4624
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\winlogon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3260
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\spoolsv.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:464
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\spoolsv.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1588
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\spoolsv.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2428
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3656
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4712
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1768
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4840
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:944
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3212

                                              Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    RCX6ABC.tmp
                                                    • Path C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX6ABC.tmp
                                                    • Size 2.9MB
                                                    • SHA256 205189f1b470fe2c35d68733240ed1e224948c38c5509581555ae592f6bc0368
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe
                                                    • Path C:\Program Files (x86)\Windows Sidebar\5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe
                                                    • Size 2.9MB
                                                    • SHA256 ebec1aabcbbebf1026225b42347ca47ad8b7bb5e802fc62559cf8fd13c51406a
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    dllhost.exe
                                                    • Path C:\Recovery\WindowsRE\dllhost.exe
                                                    • Size 2.9MB
                                                    • SHA256 49556f419a3ec5e682c72cdcd04614f640f2b99fdabd35c2833073aad200e559
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Registry.exe.log
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log
                                                    • Size 1KB
                                                    • SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    powershell.exe.log
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                    • Size 2KB
                                                    • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    StartupProfileData-NonInteractive
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    • Size 944B
                                                    • SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    StartupProfileData-NonInteractive
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    • Size 944B
                                                    • SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    StartupProfileData-NonInteractive
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    • Size 944B
                                                    • SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    StartupProfileData-NonInteractive
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    • Size 944B
                                                    • SHA256 8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    0d1166f7-3727-44e3-b877-c099d5678495.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\0d1166f7-3727-44e3-b877-c099d5678495.vbs
                                                    • Size 739B
                                                    • SHA256 a3376123a9fc788fbb830ae570d63f78140d52115b387ba2dcc41196876c2dd4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    0d726889-5986-4e2c-8487-b60e0c4f64b2.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\0d726889-5986-4e2c-8487-b60e0c4f64b2.vbs
                                                    • Size 739B
                                                    • SHA256 18dbb548fe8f0f9d5eccb902cecb61189fa23a8b8a47aba7640e9006d40c0e2f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    105c69fb-5201-4540-bd25-14747562fb22.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\105c69fb-5201-4540-bd25-14747562fb22.vbs
                                                    • Size 739B
                                                    • SHA256 a1f02ccad0b95f6f8736d52632bc9c83068136ff569ac533c50840eebf50489b
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    20bb1961-e15b-4a95-8d97-cee3914f4b22.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\20bb1961-e15b-4a95-8d97-cee3914f4b22.vbs
                                                    • Size 515B
                                                    • SHA256 980975b8d974abdae6db7f53216aa74a5129f0cf15d249f4e937b844604e0d95
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    33abccd0-1c42-45ab-97d9-53fc150003d1.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\33abccd0-1c42-45ab-97d9-53fc150003d1.vbs
                                                    • Size 739B
                                                    • SHA256 f1d273e6d27779509ea68786cab2216f27a1827e88e0a055f74125e09d5cca2c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    351ad505-74cf-48b7-806b-eeae656997da.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\351ad505-74cf-48b7-806b-eeae656997da.vbs
                                                    • Size 739B
                                                    • SHA256 94d24fe66e9a6d3ca0e6f244f7f50feffa9484cd55ca5f6f726f77437b7d68ab
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    393c3942-28c8-4c65-aadf-cb64434f3687.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\393c3942-28c8-4c65-aadf-cb64434f3687.vbs
                                                    • Size 739B
                                                    • SHA256 1b43e37ff65d91adb8d75812f2808ab3b9650820a77aca5b11eb2977bbe6c72e
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    501984fd-f80a-46e2-bf17-1239351bf49a.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\501984fd-f80a-46e2-bf17-1239351bf49a.vbs
                                                    • Size 739B
                                                    • SHA256 a01777347a39cd1750441a4683e9adefd24bf7e7f147568043c5efbe67f2a2d0
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    84fda92e-3745-41fb-8fd2-6faa4a501cb2.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\84fda92e-3745-41fb-8fd2-6faa4a501cb2.vbs
                                                    • Size 738B
                                                    • SHA256 5a8582609230e25d56cad2fc391b92cb15ba2022fa5d543db22709fb44095176
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    862d4a0e-270f-4241-a783-47c183dfd729.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\862d4a0e-270f-4241-a783-47c183dfd729.vbs
                                                    • Size 739B
                                                    • SHA256 18bea5d2123748088d3b7b3fe04afcc3efac885189cd9aad685b3f72b7b8aa02
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    9aaef37a-6be6-414c-b9d2-c8c392793b2e.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\9aaef37a-6be6-414c-b9d2-c8c392793b2e.vbs
                                                    • Size 739B
                                                    • SHA256 d5d5b41ec38e8445170b3b8cc91d5b2fbf614a37af888c64922d4a910efed09b
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    9d82bc30-a7e9-43b1-96b0-f5d11f59ca0e.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\9d82bc30-a7e9-43b1-96b0-f5d11f59ca0e.vbs
                                                    • Size 739B
                                                    • SHA256 18d900f4d9e51d781c97ca89feed3cb9fc304c95e11562b50af66f2ec5dfa170
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    __PSScriptPolicyTest_rsykar5b.rf2.ps1
                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rsykar5b.rf2.ps1
                                                    • Size 60B
                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    a783ea29-e4bd-481c-bd73-e0cc57c1cf5c.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\a783ea29-e4bd-481c-bd73-e0cc57c1cf5c.vbs
                                                    • Size 739B
                                                    • SHA256 44787b6d07ba8926a790c120384c1eba611a89947b072582b97c91be1f5d30b2
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    b935b1f74bad2fdb1615016a349626c7457f2cac.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\b935b1f74bad2fdb1615016a349626c7457f2cac.exe
                                                    • Size 2.9MB
                                                    • SHA256 57fe9b4ba845681bef3e809a1a7b4a6df030bf6c413ac17817be780885ad385a
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    e868c1c9-bf6e-4538-8664-a7003d30d6f9.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\e868c1c9-bf6e-4538-8664-a7003d30d6f9.vbs
                                                    • Size 739B
                                                    • SHA256 55c83b44ee4d58c49f43fc5207d4b42097311cf4562d361831c3b388f0703f84
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    memory/1636-397-0x000000001B7D0000-0x000000001B826000-memory.dmp
                                                    Download

                                                    memory/2040-442-0x000000001B2C0000-0x000000001B2D2000-memory.dmp
                                                    Download

                                                    memory/3132-195-0x00000267B2990000-0x00000267B29B2000-memory.dmp
                                                    Download

                                                    memory/3452-25-0x000000001C330000-0x000000001C338000-memory.dmp
                                                    Download

                                                    memory/3452-0-0x00007FFECB833000-0x00007FFECB835000-memory.dmp
                                                    Download

                                                    memory/3452-9-0x000000001BAD0000-0x000000001BAD8000-memory.dmp
                                                    Download

                                                    memory/3452-11-0x000000001BAF0000-0x000000001BAFA000-memory.dmp
                                                    Download

                                                    memory/3452-27-0x000000001C350000-0x000000001C35C000-memory.dmp
                                                    Download

                                                    memory/3452-306-0x00007FFECB830000-0x00007FFECC2F1000-memory.dmp
                                                    Download

                                                    memory/3452-10-0x000000001BAE0000-0x000000001BAF0000-memory.dmp
                                                    Download

                                                    memory/3452-8-0x0000000003180000-0x0000000003188000-memory.dmp
                                                    Download

                                                    memory/3452-5-0x0000000003140000-0x0000000003148000-memory.dmp
                                                    Download

                                                    memory/3452-6-0x0000000003150000-0x0000000003160000-memory.dmp
                                                    Download

                                                    memory/3452-4-0x00000000032B0000-0x0000000003300000-memory.dmp
                                                    Download

                                                    memory/3452-3-0x0000000001870000-0x000000000188C000-memory.dmp
                                                    Download

                                                    memory/3452-18-0x000000001C2C0000-0x000000001C2C8000-memory.dmp
                                                    Download

                                                    memory/3452-2-0x00007FFECB830000-0x00007FFECC2F1000-memory.dmp
                                                    Download

                                                    memory/3452-19-0x000000001C2D0000-0x000000001C2D8000-memory.dmp
                                                    Download

                                                    memory/3452-7-0x0000000003160000-0x0000000003176000-memory.dmp
                                                    Download

                                                    memory/3452-24-0x000000001C320000-0x000000001C32C000-memory.dmp
                                                    Download

                                                    memory/3452-12-0x000000001BB00000-0x000000001BB56000-memory.dmp
                                                    Download

                                                    memory/3452-26-0x000000001C340000-0x000000001C34A000-memory.dmp
                                                    Download

                                                    memory/3452-20-0x000000001C2E0000-0x000000001C2EA000-memory.dmp
                                                    Download

                                                    memory/3452-21-0x000000001C2F0000-0x000000001C2FE000-memory.dmp
                                                    Download

                                                    memory/3452-22-0x000000001C300000-0x000000001C308000-memory.dmp
                                                    Download

                                                    memory/3452-23-0x000000001C310000-0x000000001C31E000-memory.dmp
                                                    Download

                                                    memory/3452-17-0x000000001C7F0000-0x000000001CD18000-memory.dmp
                                                    Download

                                                    memory/3452-16-0x000000001C290000-0x000000001C2A2000-memory.dmp
                                                    Download

                                                    memory/3452-15-0x000000001BB70000-0x000000001BB7C000-memory.dmp
                                                    Download

                                                    memory/3452-14-0x000000001BB60000-0x000000001BB68000-memory.dmp
                                                    Download

                                                    memory/3452-13-0x000000001BB50000-0x000000001BB5C000-memory.dmp
                                                    Download

                                                    memory/3452-1-0x0000000000C20000-0x0000000000F06000-memory.dmp
                                                    Download