Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 15:29

General

  • Target

    e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe

  • Size

    2.9MB

  • MD5

    e349210264df2c9c8513e938aa1f3940

  • SHA1

    e689f7221e0954c75e760d5103723c021b82eebb

  • SHA256

    4d520afba4c682d393f2979de1abea0e96ec9f84f2b1d0164b57eea4eea15175

  • SHA512

    93fb466f6a853c227ebf88ed5586d509e4982f6b0c6e6dce7343c38e887a5c5e5f9b3484d70c7d64b3bdff50a2a93bb73ce7e6a4f6eb4ee8960052248db08b99

  • SSDEEP

    49152:f4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:QDKmzjWnC8Wikx1DUN2/Uq

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:692
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1184
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:844
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1416
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4436
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4376
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2484
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4428
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3092
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Qh9VekMcNe.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:4768
        • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
          "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4748
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82c33a76-482b-4c63-b143-e906d9dc6fe9.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2060
            • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
              "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4992
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f934632b-0b62-4e0f-81b3-1bfa77017b2d.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3388
                • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                  "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2484
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b130ef7-7610-49a4-b9a4-f26cd85fc60d.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4364
                    • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                      "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4712
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\929593c7-7000-4505-945d-a32b494fcb43.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4720
                        • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                          "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:1368
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f69558bf-b4d3-47ea-bf0f-a48954c2739f.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3180
                            • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                              "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4444
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32e09c32-50c5-48cd-807a-6c69ffa2e2e5.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3804
                                • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                                  "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:3388
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20cfcbef-b0b9-4922-a83f-5968c6a5a53b.vbs"
                                    16⤵
                                      PID:3960
                                      • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                                        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                                        17⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:3152
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2355dd4d-d008-4794-980d-fcaccb0761d6.vbs"
                                          18⤵
                                            PID:4756
                                            • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                                              "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                                              19⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:4536
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a310182-8dc8-4d0a-b40b-7f2807d65bf5.vbs"
                                                20⤵
                                                  PID:4148
                                                  • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                                                    "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                                                    21⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:1116
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1756601-a560-4f71-8143-1c3a32fadff4.vbs"
                                                      22⤵
                                                        PID:4248
                                                        • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                                                          "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                                                          23⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:3376
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0d43544-f15a-4545-ac4a-68648888ff72.vbs"
                                                            24⤵
                                                              PID:1692
                                                              • C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
                                                                "C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"
                                                                25⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:4908
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14fd738e-2af5-4917-9cc7-996ceec93925.vbs"
                                                                  26⤵
                                                                    PID:1208
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e208bf7-498d-4623-8aa3-381864b29166.vbs"
                                                                    26⤵
                                                                      PID:2656
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44e7def4-9403-4204-ba6a-5b7edfab2864.vbs"
                                                                  24⤵
                                                                    PID:4152
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c209b46a-cac2-48b2-b1db-128bb1fb1392.vbs"
                                                                22⤵
                                                                  PID:5024
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\389e1f54-8c01-4226-a20d-bd1f7962d505.vbs"
                                                              20⤵
                                                                PID:412
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4403b37b-7848-4851-9e64-faa24d259bdc.vbs"
                                                            18⤵
                                                              PID:1560
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0d48346-e6ce-4386-9f22-c2a5474ccb6d.vbs"
                                                          16⤵
                                                            PID:824
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8f46b37-6c17-4c7d-9fdd-4fcb84107481.vbs"
                                                        14⤵
                                                          PID:3352
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\087ce2d6-11da-4cd1-9dfb-8c66ac19bd04.vbs"
                                                      12⤵
                                                        PID:4060
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f550c0ee-1727-49ab-9a77-a6f39310f549.vbs"
                                                    10⤵
                                                      PID:60
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c3ed728-c385-4e4b-9556-776a37a4c3ae.vbs"
                                                  8⤵
                                                    PID:696
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02a72462-e69d-499f-80d5-56639959363a.vbs"
                                                6⤵
                                                  PID:4424
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87077c02-db44-4ed0-b582-4843dd4c22e0.vbs"
                                              4⤵
                                                PID:4240
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:516
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:4864
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:3764
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Registry.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:2396
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Registry.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:3312
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Registry.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:4720
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\lsass.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:1464
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\lsass.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:704
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\lsass.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:2952
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\OfficeClickToRun.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:1304
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\OfficeClickToRun.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:3100
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\OfficeClickToRun.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:5096
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\CbsTemp\spoolsv.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:1460
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\CbsTemp\spoolsv.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:3108
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\CbsTemp\spoolsv.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:2596
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\TextInputHost.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:1732
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\TextInputHost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:1172
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\TextInputHost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:4892
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Favorites\Registry.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:736
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Favorites\Registry.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:2408
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Favorites\Registry.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:3692
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:928
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:3456
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Creates scheduled task(s)
                                          PID:4308

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                          Filesize

                                          2KB

                                          MD5

                                          d85ba6ff808d9e5444a4b369f5bc2730

                                          SHA1

                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                          SHA256

                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                          SHA512

                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log

                                          Filesize

                                          1KB

                                          MD5

                                          4a667f150a4d1d02f53a9f24d89d53d1

                                          SHA1

                                          306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                          SHA256

                                          414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                          SHA512

                                          4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          cadef9abd087803c630df65264a6c81c

                                          SHA1

                                          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                          SHA256

                                          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                          SHA512

                                          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          6c47b3f4e68eebd47e9332eebfd2dd4e

                                          SHA1

                                          67f0b143336d7db7b281ed3de5e877fa87261834

                                          SHA256

                                          8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

                                          SHA512

                                          0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          bd5940f08d0be56e65e5f2aaf47c538e

                                          SHA1

                                          d7e31b87866e5e383ab5499da64aba50f03e8443

                                          SHA256

                                          2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                          SHA512

                                          c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          3a6bad9528f8e23fb5c77fbd81fa28e8

                                          SHA1

                                          f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                          SHA256

                                          986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                          SHA512

                                          846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                        • C:\Users\Admin\AppData\Local\Temp\14fd738e-2af5-4917-9cc7-996ceec93925.vbs

                                          Filesize

                                          743B

                                          MD5

                                          949988c59b1d7406bd0971d1901c0619

                                          SHA1

                                          bea740a721dbce97d6e06b7f4ee40718287b83a5

                                          SHA256

                                          a864f3794608f725d27f2d75ce350994eafd9e6c7bc421f02ef25713f329d87c

                                          SHA512

                                          496145823b91b4b50ad1107b7350bce16c9e2b3ba3503b8c613f0b668299229f16fcc7cd5360131902a1493e79fb1de68e388f368fa90237ddfb16b55cdc97ec

                                        • C:\Users\Admin\AppData\Local\Temp\20cfcbef-b0b9-4922-a83f-5968c6a5a53b.vbs

                                          Filesize

                                          743B

                                          MD5

                                          4f41603579adccf749d9ff9cac438f2b

                                          SHA1

                                          1450a9b8b11f50c9c11f90c7e3844e37f77d272d

                                          SHA256

                                          931ccf0ce36de9d87124c4435dc03a387bc3bee8390abd8ffbdf98015c43445d

                                          SHA512

                                          57740bb93f9214a91a95de18fcc7880197318095da05c3bdaa7346ddedc91971b68840deea3ceddf252cf5b360d9c2b0b0c39484b2de3c8d1b93c8d2b1704ce4

                                        • C:\Users\Admin\AppData\Local\Temp\2355dd4d-d008-4794-980d-fcaccb0761d6.vbs

                                          Filesize

                                          743B

                                          MD5

                                          cfdab03a143935d5374bba3bdd6cbfa9

                                          SHA1

                                          a13f9e3f36f4bb90edc74982330e5d9d81edf6d4

                                          SHA256

                                          38c0082d0de158b71fc543bcc54ec07c595bd0e7d7a7b657041d986e2bbc6168

                                          SHA512

                                          6268361c2846d14dc8a1c7054687518f751358d9418b3b733929614ab8c344fa302132ffbcfe79cc44396f52134804a259ced22ba2ac8a2c2fcf221a4c7d1227

                                        • C:\Users\Admin\AppData\Local\Temp\2a310182-8dc8-4d0a-b40b-7f2807d65bf5.vbs

                                          Filesize

                                          743B

                                          MD5

                                          96d057046655bc6099ea584cde5ffe05

                                          SHA1

                                          5128eaca2cd0317b6e209e539393072be91190bf

                                          SHA256

                                          0fbcc08b7d91ce47e02bec9be9f2bdc53ca87da0c555eb1f24f5bd15e09109d7

                                          SHA512

                                          ee1f95ac0a2005c834e1fbc376f37bf85e1cf88f6ccfb93629dd05e467e45c7ec845eed771c2c02868942804d4ee22b71c80ce67e21ef8f2305af4b23a1661df

                                        • C:\Users\Admin\AppData\Local\Temp\2b130ef7-7610-49a4-b9a4-f26cd85fc60d.vbs

                                          Filesize

                                          743B

                                          MD5

                                          0905cf14886f5dd9d767bf59a55c8c12

                                          SHA1

                                          0fc7187df619d98caea83bec3efb7379a6cdcdf6

                                          SHA256

                                          b971ea34f6c6499be177c5a7e39c3badd0baf35361e59559244b1ed3c431a5a4

                                          SHA512

                                          b1371b4193ee62523c59bef47940cd3d2a6a49a0e06c0ef8418a1ab7886e7a71fc1edff48d6b4d3ca82f7ab218f3f9f84f6d2c432f6e1b4369aa4dcad632e9d8

                                        • C:\Users\Admin\AppData\Local\Temp\32e09c32-50c5-48cd-807a-6c69ffa2e2e5.vbs

                                          Filesize

                                          743B

                                          MD5

                                          45ca9e0a46f54715d8bddf9953101b76

                                          SHA1

                                          2f89b4ee5e558e6662894cad40b6d7eb3eb1fdca

                                          SHA256

                                          2aa5dbbfe0cd32f6f0adc60701140469d56420cd26dca63c02743926eaadab22

                                          SHA512

                                          fef18414fd58374c6e07a50e6fa8cc36be1504d04466a94285c8b09e9efef0f5de80446d9c698bd785e5aee39d4a8914b43a8ee0f098330383e289d79e7cccab

                                        • C:\Users\Admin\AppData\Local\Temp\82c33a76-482b-4c63-b143-e906d9dc6fe9.vbs

                                          Filesize

                                          743B

                                          MD5

                                          ce0e315967750f876e2667ca3d37e49e

                                          SHA1

                                          d75a8b47314283f9303a43ba03b3db269797ddd7

                                          SHA256

                                          72527636f5a9c6209da1da9cc2f8194aecf43abd8a81fc9e7a56663f99db6e44

                                          SHA512

                                          5436c07bce7e1ac27293230deb53933478c5a6be05c763d6617381a82693d65fe9c33627a1c313cad155a6b9d934931382c50943e568f870fb470215fffbc986

                                        • C:\Users\Admin\AppData\Local\Temp\87077c02-db44-4ed0-b582-4843dd4c22e0.vbs

                                          Filesize

                                          519B

                                          MD5

                                          bb4228689ebea737374b7e36c4a7d5af

                                          SHA1

                                          dfb2a19c0f12006346b96af27824055f2f65e01e

                                          SHA256

                                          1e4d35ef75b6e830e2e04f1ee8c1cc830c895c45d9cd57ad04673115cda6794a

                                          SHA512

                                          7576431b9d8abb7ff78ea3340b08e1efd10fce2bfe5cbd3bf59e1d1056d66379be6bc3e4a3e503f7bbcb0af2d15683fc6fdca27de935e70b8e1d65c2d3805109

                                        • C:\Users\Admin\AppData\Local\Temp\929593c7-7000-4505-945d-a32b494fcb43.vbs

                                          Filesize

                                          743B

                                          MD5

                                          e9054c8dce0d994c6403c439868f6868

                                          SHA1

                                          38fc5b338254b5689cf5a2f8cedb621d7a5958da

                                          SHA256

                                          6da67460a852aae899862de169e593145bac43e76fa3c77368fab103844839b5

                                          SHA512

                                          b17b6ecc01945655226b1249c97e1edef67cc1a23dbbfde4019e1c2365f77813ae8305ff0b6e54bb2e588cddd5aeb9126403c6b38f5712e9b9be44366d89b379

                                        • C:\Users\Admin\AppData\Local\Temp\Qh9VekMcNe.bat

                                          Filesize

                                          232B

                                          MD5

                                          6e0ebe415999694bbe357fa8991f4bab

                                          SHA1

                                          a5386711f5ab6e5d075d3915fb157209c9b65b6c

                                          SHA256

                                          cfa1b6b05286f53b7d7bf9b96e4385121394b732ed036bf85ee6889a426be208

                                          SHA512

                                          25cee9ce0175ac36452feffabb213bf40e29586f3b7a814824783c30ccaa01b12ac20bd6865a1e5cf6f8278ef20a681d9d331c3f83f244188e1b9c572410d3bf

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yuovahwq.sx5.ps1

                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        • C:\Users\Admin\AppData\Local\Temp\b1756601-a560-4f71-8143-1c3a32fadff4.vbs

                                          Filesize

                                          743B

                                          MD5

                                          69f508203a60a3c2c501a9a4147261ec

                                          SHA1

                                          dfb3cc635429c9461208a308fca065b9568b4fb7

                                          SHA256

                                          76567dd78bb3416bee660ae8915ede2db304c1e02ca6b2c5da8ac82918f4dd37

                                          SHA512

                                          8c5271ba0c34a761595152f3570d90f25a34defa96e16e9a2b2c7ba5c212bb54ea3c7f689acc25ab52738bc625b1ed97a7f83a4440e47a4300e8d4e555d1285f

                                        • C:\Users\Admin\AppData\Local\Temp\f0d43544-f15a-4545-ac4a-68648888ff72.vbs

                                          Filesize

                                          743B

                                          MD5

                                          7019c242f079b5ea6084820455a3c6eb

                                          SHA1

                                          eb3af486b229be0f70db50b79c9113bcff294add

                                          SHA256

                                          64a35813660b45ba967479acd08bdab8bff44533d50590be0c88450b7625c6a8

                                          SHA512

                                          e17cc96935837c8fe44cb5f331941427367bdaaf48410582a86643df7cb46315e36ac917a76a0c24495f55fde826232783a080851c4ac92da6228e8463469714

                                        • C:\Users\Admin\AppData\Local\Temp\f69558bf-b4d3-47ea-bf0f-a48954c2739f.vbs

                                          Filesize

                                          743B

                                          MD5

                                          9f7280b4049981e75d8c208152724825

                                          SHA1

                                          e4d3c72188c4ee9d82e2f5262fdf4433b2268d1d

                                          SHA256

                                          8d85d13ab52a1f698b0380d16e4cbacce5c801e3377cb55b898d4966daf2d15f

                                          SHA512

                                          a9ceb86899a7879ab55daf90a9d0a73a0a01603e989bba9c1699ab1bbd2ae8aa73b4ba0d8d6abb7db82e6a2e7e2560ea66fff165736675023693a642861c429f

                                        • C:\Users\Admin\AppData\Local\Temp\f934632b-0b62-4e0f-81b3-1bfa77017b2d.vbs

                                          Filesize

                                          743B

                                          MD5

                                          4972953e4daec1fbe4845e5ff954a3f2

                                          SHA1

                                          64fbd6bfc5cbf86150ae6a71038dc973f6ef1bf2

                                          SHA256

                                          1f3cce9be14f8d0234fe7b522b27007524b263bc53ff026cddb70375e501575b

                                          SHA512

                                          d974ef204fe71d0823f1762956f6c5afe2f1b9192e1d926f75e63386b3c4694235919478fc8402d1f2bcfae0a19e34262d84ad69017ffe9d4935c284ab50c3fe

                                        • C:\Windows\CbsTemp\spoolsv.exe

                                          Filesize

                                          2.9MB

                                          MD5

                                          e349210264df2c9c8513e938aa1f3940

                                          SHA1

                                          e689f7221e0954c75e760d5103723c021b82eebb

                                          SHA256

                                          4d520afba4c682d393f2979de1abea0e96ec9f84f2b1d0164b57eea4eea15175

                                          SHA512

                                          93fb466f6a853c227ebf88ed5586d509e4982f6b0c6e6dce7343c38e887a5c5e5f9b3484d70c7d64b3bdff50a2a93bb73ce7e6a4f6eb4ee8960052248db08b99

                                        • memory/692-14-0x000000001BDE0000-0x000000001BDE8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/692-0-0x00007FF96E2F3000-0x00007FF96E2F5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/692-24-0x000000001BE90000-0x000000001BE9C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/692-20-0x000000001BE50000-0x000000001BE5A000-memory.dmp

                                          Filesize

                                          40KB

                                        • memory/692-19-0x000000001BE40000-0x000000001BE48000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/692-18-0x000000001BE30000-0x000000001BE38000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/692-27-0x000000001BEC0000-0x000000001BECC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/692-1-0x0000000000790000-0x0000000000A76000-memory.dmp

                                          Filesize

                                          2.9MB

                                        • memory/692-26-0x000000001BEB0000-0x000000001BEBA000-memory.dmp

                                          Filesize

                                          40KB

                                        • memory/692-144-0x00007FF96E2F0000-0x00007FF96EDB1000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/692-21-0x000000001BE60000-0x000000001BE6E000-memory.dmp

                                          Filesize

                                          56KB

                                        • memory/692-22-0x000000001BE70000-0x000000001BE78000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/692-23-0x000000001BE80000-0x000000001BE8E000-memory.dmp

                                          Filesize

                                          56KB

                                        • memory/692-17-0x000000001C360000-0x000000001C888000-memory.dmp

                                          Filesize

                                          5.2MB

                                        • memory/692-16-0x000000001BE00000-0x000000001BE12000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/692-15-0x000000001BDF0000-0x000000001BDFC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/692-2-0x00007FF96E2F0000-0x00007FF96EDB1000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/692-25-0x000000001BEA0000-0x000000001BEA8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/692-13-0x000000001BDD0000-0x000000001BDDC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/692-12-0x000000001BD80000-0x000000001BDD6000-memory.dmp

                                          Filesize

                                          344KB

                                        • memory/692-11-0x000000001BD70000-0x000000001BD7A000-memory.dmp

                                          Filesize

                                          40KB

                                        • memory/692-3-0x0000000001290000-0x00000000012AC000-memory.dmp

                                          Filesize

                                          112KB

                                        • memory/692-10-0x000000001B650000-0x000000001B660000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/692-4-0x000000001B600000-0x000000001B650000-memory.dmp

                                          Filesize

                                          320KB

                                        • memory/692-9-0x000000001B5F0000-0x000000001B5F8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/692-5-0x00000000012C0000-0x00000000012C8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/692-7-0x000000001B5C0000-0x000000001B5D6000-memory.dmp

                                          Filesize

                                          88KB

                                        • memory/692-8-0x000000001B5E0000-0x000000001B5E8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/692-6-0x000000001B5B0000-0x000000001B5C0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/1184-115-0x000001F654D60000-0x000001F654D82000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/2484-248-0x0000000003570000-0x0000000003582000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4712-260-0x000000001BCC0000-0x000000001BCD2000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4748-224-0x000000001B420000-0x000000001B432000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4908-349-0x0000000002E20000-0x0000000002E32000-memory.dmp

                                          Filesize

                                          72KB