Overview

overview

10

Static

static

10

04af917128...cs.exe

windows7-x64

10

04af917128...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 23:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    04af9171286cbc77247b56340d580000_NeikiAnalytics.exe
  • Size 3.2MB
  • Sample240609-3mdsfshb47
  • SHA256 040a4ba0cfc777c7b3983233cc8ab510783f135166d4d80d83d29080ca65c0bc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasionexecutioninfostealerrattrojan

Malware Config

Signatures

  • DcRat 52 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 27 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Checks whether UAC is enabled 1 TTPs 18 IoCs
    evasiontrojan
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 27 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\04af9171286cbc77247b56340d580000_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\04af9171286cbc77247b56340d580000_NeikiAnalytics.exe"
    1⤵
    • DcRat
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2080
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3180
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3420
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4916
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5116
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:376
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
    • C:\Users\Admin\AppData\Local\Temp\04af9171286cbc77247b56340d580000_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\04af9171286cbc77247b56340d580000_NeikiAnalytics.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4128
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:448
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1776
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3488
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1804
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3656
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4892
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4940
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4444
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4228
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4040
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PUmy1tFbk5.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5024
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          4⤵
            PID:3840
          • C:\Program Files\7-Zip\Lang\RuntimeBroker.exe
            "C:\Program Files\7-Zip\Lang\RuntimeBroker.exe"
            4⤵
            • UAC bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2600
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72714e1b-ee74-4b4c-9c7c-c0fcab11d775.vbs"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3340
              • C:\Program Files\7-Zip\Lang\RuntimeBroker.exe
                "C:\Program Files\7-Zip\Lang\RuntimeBroker.exe"
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2636
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\027e0093-f62c-42fb-b59c-1b321b4d4523.vbs"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1188
                  • C:\Program Files\7-Zip\Lang\RuntimeBroker.exe
                    "C:\Program Files\7-Zip\Lang\RuntimeBroker.exe"
                    8⤵
                    • UAC bypass
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • System policy modification
                    PID:1476
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\482fe45c-1723-41f1-99ec-8baa336b0d3c.vbs"
                      9⤵
                        PID:4228
                        • C:\Program Files\7-Zip\Lang\RuntimeBroker.exe
                          "C:\Program Files\7-Zip\Lang\RuntimeBroker.exe"
                          10⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • System policy modification
                          PID:2548
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9958cb9-9e1c-43db-a4bf-bc1d79602248.vbs"
                            11⤵
                              PID:4576
                              • C:\Program Files\7-Zip\Lang\RuntimeBroker.exe
                                "C:\Program Files\7-Zip\Lang\RuntimeBroker.exe"
                                12⤵
                                • UAC bypass
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • System policy modification
                                PID:2356
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0e71427-0143-4f57-b613-2d6cf4f9c596.vbs"
                                  13⤵
                                    PID:3108
                                    • C:\Program Files\7-Zip\Lang\RuntimeBroker.exe
                                      "C:\Program Files\7-Zip\Lang\RuntimeBroker.exe"
                                      14⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • System policy modification
                                      PID:4156
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6eeeb490-065b-4e50-9b17-14e74b6027d0.vbs"
                                        15⤵
                                          PID:3964
                                          • C:\Program Files\7-Zip\Lang\RuntimeBroker.exe
                                            "C:\Program Files\7-Zip\Lang\RuntimeBroker.exe"
                                            16⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • System policy modification
                                            PID:1596
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\befcdde5-6df7-4dbe-aea3-47aff45c3a70.vbs"
                                              17⤵
                                                PID:4164
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\591c7900-b1ca-4fb8-87ee-adf529e94dbf.vbs"
                                                17⤵
                                                  PID:4944
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46734e6b-8be4-4401-b4f1-ac55080a14f4.vbs"
                                              15⤵
                                                PID:4296
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\416c7c06-3a9a-4fcb-bddf-7a729a460678.vbs"
                                            13⤵
                                              PID:2188
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bde8b2c8-4fce-49fb-82c9-331a65a21ff5.vbs"
                                          11⤵
                                            PID:2068
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bfdae2e-ef86-4b49-8774-77e90466c06b.vbs"
                                        9⤵
                                          PID:4072
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fd25a57-4c64-42ba-8059-eed0891dc38f.vbs"
                                      7⤵
                                        PID:4384
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6bdfbe0-5f84-465c-8350-ec839b11ab9b.vbs"
                                    5⤵
                                      PID:2948
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\fontdrvhost.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4384
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\L2Schemas\fontdrvhost.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4836
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\L2Schemas\fontdrvhost.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1980
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\ImmersiveControlPanel\upfc.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1332
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\upfc.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:2724
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Windows\ImmersiveControlPanel\upfc.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1752
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:2184
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:2460
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:2592
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\uk-UA\csrss.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:2636
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\IME\uk-UA\csrss.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3808
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\uk-UA\csrss.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1376
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\System.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:2356
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\System.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:2636
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\System.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4400
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3852
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:5052
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1700
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Speech_OneCore\Engines\RuntimeBroker.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3972
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\RuntimeBroker.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1596
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Speech_OneCore\Engines\RuntimeBroker.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3512
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1684
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3128
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3360
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3196
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4220
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3356
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4648
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3068
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4820
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\TextInputHost.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4576
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\TextInputHost.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1648
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\TextInputHost.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4332
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4928
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4244
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:808
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\smss.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4764
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\smss.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1952
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\smss.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4528
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\it-IT\SearchApp.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4952
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\it-IT\SearchApp.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3372
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\it-IT\SearchApp.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1008
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\services.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3868
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:1332
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:3432
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:2600
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:404
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                              1⤵
                              • DcRat
                              • Process spawned unexpected child process
                              • Creates scheduled task(s)
                              PID:4856

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  04af9171286cbc77247b56340d580000_NeikiAnalytics.exe.log
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\04af9171286cbc77247b56340d580000_NeikiAnalytics.exe.log
                                  • Size 1KB
                                  • SHA256 2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  RuntimeBroker.exe.log
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
                                  • Size 1KB
                                  • SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  powershell.exe.log
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                  • Size 2KB
                                  • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 7f1d12b28e13fdd8cba3f75fb8bda4113a59767876fe59c0c06f31ec872ffa9f
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 900aa2c83ec8773c3f9705f75b28fff0eaca57f7adb33dc82564d7ea8f8069a3
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 6cec99d44ed65e73240a96691f299a41e944a9c8f59c543df3ecd73d95c8bf40
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 baeb07292d7c8d7ba665a29178999ea08d4b26e8d05bb29c6dee8b8dad8de27e
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 c893092af552e973c44e0596d1509605a393896a0c1eae64f11456dc956ba40e
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 944B
                                  • SHA256 b89786113f914c4c6c44f0455750d167a760b375dc12c18a52054e71f0d24737
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  027e0093-f62c-42fb-b59c-1b321b4d4523.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\027e0093-f62c-42fb-b59c-1b321b4d4523.vbs
                                  • Size 721B
                                  • SHA256 9166e0f4824b76472303afec7adec13542f2f6d6b126582103bed2773bb0bf0b
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  482fe45c-1723-41f1-99ec-8baa336b0d3c.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\482fe45c-1723-41f1-99ec-8baa336b0d3c.vbs
                                  • Size 721B
                                  • SHA256 5310a0a1fa9f9a04e51d0390f8dd88254951516ae3cd859c6fed49a4f47346c9
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  6eeeb490-065b-4e50-9b17-14e74b6027d0.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\6eeeb490-065b-4e50-9b17-14e74b6027d0.vbs
                                  • Size 721B
                                  • SHA256 255ef65ce4cce097c84be425c66fd10b670f51bc1c23f310f350c38f159e437e
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  72714e1b-ee74-4b4c-9c7c-c0fcab11d775.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\72714e1b-ee74-4b4c-9c7c-c0fcab11d775.vbs
                                  • Size 721B
                                  • SHA256 58b20d3dd7f139a406578a019beb13c93e2e101723df19f7e83eedef7e57d82a
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  PUmy1tFbk5.bat
                                  • Path C:\Users\Admin\AppData\Local\Temp\PUmy1tFbk5.bat
                                  • Size 210B
                                  • SHA256 55de798e0e77387d4f55865d3f3ee3abcc0f38675d305aa3e076f20a1d2cbc6f
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  RCX5D63.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\RCX5D63.tmp
                                  • Size 3.2MB
                                  • SHA256 040a4ba0cfc777c7b3983233cc8ab510783f135166d4d80d83d29080ca65c0bc
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  __PSScriptPolicyTest_pd5w50z2.d3e.ps1
                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pd5w50z2.d3e.ps1
                                  • Size 60B
                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  a6bdfbe0-5f84-465c-8350-ec839b11ab9b.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\a6bdfbe0-5f84-465c-8350-ec839b11ab9b.vbs
                                  • Size 497B
                                  • SHA256 075bc8febb62c846eef60755aecdf4e5812e42f392fbd8e08c6d560c8d664074
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  befcdde5-6df7-4dbe-aea3-47aff45c3a70.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\befcdde5-6df7-4dbe-aea3-47aff45c3a70.vbs
                                  • Size 721B
                                  • SHA256 9e7b9f5edf6fe6c4b48278b4ea554faa7c47cd588b1b213a1e41911c5e88d9ba
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  c9958cb9-9e1c-43db-a4bf-bc1d79602248.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\c9958cb9-9e1c-43db-a4bf-bc1d79602248.vbs
                                  • Size 721B
                                  • SHA256 5b5025f18fd764bbdf7d4f0b0be684bc7888c4fec39f41fe00a3997f9214328e
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  d0e71427-0143-4f57-b613-2d6cf4f9c596.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\d0e71427-0143-4f57-b613-2d6cf4f9c596.vbs
                                  • Size 721B
                                  • SHA256 d5af6ae65d23749c8449126bba91527f5a3737c611678aca893c51f4786f2526
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  memory/1048-102-0x00000224FCA30000-0x00000224FCA52000-memory.dmp
                                  Download

                                  memory/2256-16-0x000000001B0B0000-0x000000001B0B8000-memory.dmp
                                  Download

                                  memory/2256-18-0x000000001B0D0000-0x000000001B0D8000-memory.dmp
                                  Download

                                  memory/2256-37-0x00007FFB9B590000-0x00007FFB9C051000-memory.dmp
                                  Download

                                  memory/2256-33-0x000000001BAC0000-0x000000001BACA000-memory.dmp
                                  Download

                                  memory/2256-31-0x000000001BAB0000-0x000000001BAB8000-memory.dmp
                                  Download

                                  memory/2256-28-0x000000001B980000-0x000000001B988000-memory.dmp
                                  Download

                                  memory/2256-27-0x000000001B970000-0x000000001B97E000-memory.dmp
                                  Download

                                  memory/2256-26-0x000000001B960000-0x000000001B96A000-memory.dmp
                                  Download

                                  memory/2256-25-0x000000001BAD0000-0x000000001BAD8000-memory.dmp
                                  Download

                                  memory/2256-32-0x00007FFB9B590000-0x00007FFB9C051000-memory.dmp
                                  Download

                                  memory/2256-29-0x000000001BA90000-0x000000001BA9E000-memory.dmp
                                  Download

                                  memory/2256-30-0x000000001BAA0000-0x000000001BAAC000-memory.dmp
                                  Download

                                  memory/2256-199-0x00007FFB9B590000-0x00007FFB9C051000-memory.dmp
                                  Download

                                  memory/2256-24-0x000000001B850000-0x000000001B85C000-memory.dmp
                                  Download

                                  memory/2256-23-0x000000001B840000-0x000000001B84C000-memory.dmp
                                  Download

                                  memory/2256-22-0x000000001B830000-0x000000001B83C000-memory.dmp
                                  Download

                                  memory/2256-21-0x000000001B0F0000-0x000000001B0FC000-memory.dmp
                                  Download

                                  memory/2256-20-0x000000001BD60000-0x000000001C288000-memory.dmp
                                  Download

                                  memory/2256-19-0x000000001B0E0000-0x000000001B0F2000-memory.dmp
                                  Download

                                  memory/2256-34-0x000000001BB20000-0x000000001BB2C000-memory.dmp
                                  Download

                                  memory/2256-17-0x000000001B0C0000-0x000000001B0CC000-memory.dmp
                                  Download

                                  memory/2256-0-0x00007FFB9B593000-0x00007FFB9B595000-memory.dmp
                                  Download

                                  memory/2256-15-0x000000001B0A0000-0x000000001B0AC000-memory.dmp
                                  Download

                                  memory/2256-14-0x000000001B050000-0x000000001B0A6000-memory.dmp
                                  Download

                                  memory/2256-13-0x000000001B040000-0x000000001B04A000-memory.dmp
                                  Download

                                  memory/2256-12-0x000000001B030000-0x000000001B040000-memory.dmp
                                  Download

                                  memory/2256-11-0x000000001AFC0000-0x000000001AFC8000-memory.dmp
                                  Download

                                  memory/2256-10-0x000000001AFA0000-0x000000001AFB6000-memory.dmp
                                  Download

                                  memory/2256-9-0x000000001AF90000-0x000000001AFA0000-memory.dmp
                                  Download

                                  memory/2256-8-0x000000001AF80000-0x000000001AF88000-memory.dmp
                                  Download

                                  memory/2256-7-0x000000001AFD0000-0x000000001B020000-memory.dmp
                                  Download

                                  memory/2256-6-0x000000001AF60000-0x000000001AF7C000-memory.dmp
                                  Download

                                  memory/2256-5-0x000000001AF50000-0x000000001AF58000-memory.dmp
                                  Download

                                  memory/2256-4-0x0000000002660000-0x000000000266E000-memory.dmp
                                  Download

                                  memory/2256-3-0x0000000000C60000-0x0000000000C6E000-memory.dmp
                                  Download

                                  memory/2256-2-0x00007FFB9B590000-0x00007FFB9C051000-memory.dmp
                                  Download

                                  memory/2256-1-0x0000000000100000-0x000000000043C000-memory.dmp
                                  Download