Analysis
- max time kernel
130s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
18/05/2024, 19:43
General
- Target 3ba31656df80ef673e309b396a1ffa30_NeikiAnalytics.exe
- Size 2.9MB
- Sample240518-yflghacf37
- SHA256 d54518c2293da734288c781360682cff73cb4eefcce42d068e3a335defaa9d67
Score
10/10
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 42 IoCs
- DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 13 IoCs
- Checks whether UAC is enabled 1 TTPs 28 IoCs
- Drops file in Program Files directory 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 42 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ba31656df80ef673e309b396a1ffa30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3ba31656df80ef673e309b396a1ffa30_NeikiAnalytics.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gl1hJzHfof.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0938da96-f484-4713-8f85-ab1115d49037.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adc0f8f3-7480-4d19-9e93-68b6d96545b4.vbs"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47b89098-993f-459e-b009-9de8c1cc4046.vbs"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c924663-072a-4b82-879c-5824b8198a66.vbs"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6773929-44d8-4e58-aec8-5559a14afd40.vbs"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb319302-30ed-4f85-b411-c5b8dd483e53.vbs"14⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\857ad5ce-a9da-481d-a5d2-2bfe83acc52e.vbs"16⤵
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2882af8-b76d-4a91-ba5b-9c3ed17f64ab.vbs"18⤵
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efb900b3-2067-4318-bad3-3866f24ffbac.vbs"20⤵
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ec0a081-9575-42c2-a025-dd487409af08.vbs"22⤵
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6e0cc8a-0d6a-492f-91b8-c4af52629ac1.vbs"24⤵
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6b36ec6-7ed6-4164-90fc-ffe3a95d0904.vbs"26⤵
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"27⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fd8e033-75c6-49b0-aec3-e8a6d33e6d3f.vbs"28⤵
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"29⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49517bdf-d6e6-45ce-bdc0-0c49990d5917.vbs"30⤵
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"31⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9468ad3b-8c3b-4c61-b898-155ff9cc0b7e.vbs"32⤵
-
C:\Program Files\Mozilla Firefox\explorer.exe"C:\Program Files\Mozilla Firefox\explorer.exe"33⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47bbe6cc-fdb9-4c9a-bb9d-a5018e45d643.vbs"34⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be09c14b-2018-4aab-b293-a6f539b59ef1.vbs"34⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c8e3639-0857-4531-a939-9bdb790e280c.vbs"32⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\286551ff-d64d-47b6-887b-b5831ea8d37f.vbs"30⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c200f21-83ac-4c98-8ca3-0f26c0dfd2d9.vbs"28⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cda2db90-28ab-4b8f-90cc-ac995409dd5a.vbs"26⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e85d9ed-5cbf-486f-89f5-63bcfa6bb967.vbs"24⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7bcc68af-2455-4141-bd2c-9981531f2721.vbs"22⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea93e66e-c298-4a26-a40d-a9e1f7497578.vbs"20⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\242b8d52-75ec-4960-a6d4-6eb805f87f90.vbs"18⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9a10929-57f9-4bab-b395-1e8a4198d579.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c42ad43-af01-4d16-87ab-613dc9873c62.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f70e226-d0ed-43e3-b4d4-d2a84f057e27.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd3a79c5-186d-4e24-ab29-bb7922665239.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2211ad6d-774c-4ad2-b803-7dcb760a55e9.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\164afc5f-1dae-4763-8679-6fbaa3801373.vbs"6⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93c155ba-696e-4159-9c0f-074f4f0bbd94.vbs"4⤵
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
explorer.exe
explorer.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
0938da96-f484-4713-8f85-ab1115d49037.vbs
1fd8e033-75c6-49b0-aec3-e8a6d33e6d3f.vbs
47b89098-993f-459e-b009-9de8c1cc4046.vbs
5ec0a081-9575-42c2-a025-dd487409af08.vbs
857ad5ce-a9da-481d-a5d2-2bfe83acc52e.vbs
93c155ba-696e-4159-9c0f-074f4f0bbd94.vbs
9c924663-072a-4b82-879c-5824b8198a66.vbs
Gl1hJzHfof.bat
__PSScriptPolicyTest_kjqtn4t5.xbx.ps1
adc0f8f3-7480-4d19-9e93-68b6d96545b4.vbs
b2882af8-b76d-4a91-ba5b-9c3ed17f64ab.vbs
b6b36ec6-7ed6-4164-90fc-ffe3a95d0904.vbs
bb319302-30ed-4f85-b411-c5b8dd483e53.vbs
c6e0cc8a-0d6a-492f-91b8-c4af52629ac1.vbs
efb900b3-2067-4318-bad3-3866f24ffbac.vbs
f6773929-44d8-4e58-aec8-5559a14afd40.vbs
memory/2576-333-0x000000001B1F0000-0x000000001B246000-memory.dmp
memory/2624-219-0x000000001C100000-0x000000001C112000-memory.dmp
memory/3132-254-0x0000000002F20000-0x0000000002F32000-memory.dmp
memory/3364-16-0x000000001BF20000-0x000000001BF32000-memory.dmp
memory/3364-0-0x00007FFCB5943000-0x00007FFCB5945000-memory.dmp
memory/3364-18-0x000000001BF50000-0x000000001BF58000-memory.dmp
memory/3364-89-0x00007FFCB5940000-0x00007FFCB6401000-memory.dmp
memory/3364-1-0x00000000008C0000-0x0000000000BA6000-memory.dmp
memory/3364-19-0x000000001BF60000-0x000000001BF68000-memory.dmp
memory/3364-24-0x000000001BFC0000-0x000000001BFCC000-memory.dmp
memory/3364-25-0x000000001BFD0000-0x000000001BFD8000-memory.dmp
memory/3364-26-0x000000001C0E0000-0x000000001C0EA000-memory.dmp
memory/3364-27-0x000000001BFE0000-0x000000001BFEC000-memory.dmp
memory/3364-21-0x000000001BF80000-0x000000001BF8E000-memory.dmp
memory/3364-20-0x000000001BF70000-0x000000001BF7A000-memory.dmp
memory/3364-22-0x000000001BFA0000-0x000000001BFA8000-memory.dmp
memory/3364-23-0x000000001BFB0000-0x000000001BFBE000-memory.dmp
memory/3364-14-0x000000001BF00000-0x000000001BF08000-memory.dmp
memory/3364-2-0x00007FFCB5940000-0x00007FFCB6401000-memory.dmp
memory/3364-15-0x000000001BF10000-0x000000001BF1C000-memory.dmp
memory/3364-17-0x000000001C4D0000-0x000000001C9F8000-memory.dmp
memory/3364-13-0x000000001BEF0000-0x000000001BEFC000-memory.dmp
memory/3364-12-0x000000001BEA0000-0x000000001BEF6000-memory.dmp
memory/3364-6-0x000000001BDF0000-0x000000001BE00000-memory.dmp
memory/3364-7-0x000000001BE00000-0x000000001BE16000-memory.dmp
memory/3364-8-0x000000001BE20000-0x000000001BE28000-memory.dmp
memory/3364-9-0x000000001BE30000-0x000000001BE38000-memory.dmp
memory/3364-10-0x000000001BF90000-0x000000001BFA0000-memory.dmp
memory/3364-5-0x0000000002D00000-0x0000000002D08000-memory.dmp
memory/3364-11-0x000000001BE90000-0x000000001BE9A000-memory.dmp
memory/3364-3-0x0000000002CE0000-0x0000000002CFC000-memory.dmp
memory/3364-4-0x000000001BE40000-0x000000001BE90000-memory.dmp
memory/3852-242-0x0000000002A80000-0x0000000002A92000-memory.dmp
memory/3952-207-0x000000001B080000-0x000000001B0D6000-memory.dmp
memory/4260-277-0x000000001C590000-0x000000001C5A2000-memory.dmp
memory/4964-88-0x000001E576780000-0x000001E5767A2000-memory.dmp