Overview

overview

10

Static

static

10

2026-04-15...id.exe

windows10-2004-x64

10

2026-04-15...id.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/04/2026, 04:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_9f386a39aaf96ebdc6776d704dc3d3b1_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
  • Size 375KB
  • Sample260415-fd1vasas9v
  • SHA256 eba9ea797869c23eae4e6c78a5b5290ad1c0e50dcfc10ca216063cbd79c73195
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitdefense_evasiondiscoveryevasionexecutionexploitsheetratpersistenceransomwaretrojan

Malware Config

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat Payload 3 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
    evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 12 IoCs
    defense_evasiontrojan
  • Custom signature
    Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 3 IoCs
  • Custom signature
    Detects executables (downlaoders) containing URLs to raw contents of a paste 3 IoCs
  • Custom signature
    Detects executables embedding registry key / value combination indicative of disabling Windows Defen 3 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs
    ransomwareevasion
  • Drops file in Drivers directory 32 IoCs
  • Possible privilege escalation attempt 34 IoCs
    exploit
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 35 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 34 IoCs
    discovery
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Windows security modification 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 18 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 7 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 53 IoCs
  • Modifies registry class 4 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 19 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Users\Admin\AppData\Local\Temp\2026-04-15_9f386a39aaf96ebdc6776d704dc3d3b1_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-15_9f386a39aaf96ebdc6776d704dc3d3b1_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender TamperProtection settings
      • Modifies security service
      • UAC bypass
      • Drops file in Drivers directory
      • Checks computer location settings
      • Windows security modification
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5248
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /c sc start TrustedInstaller
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Windows\system32\sc.exe
          sc start TrustedInstaller
          4⤵
          • Launches sc.exe
          PID:1060
      • C:\Windows\SYSTEM32\sc.exe
        "sc" stop WinDefend
        3⤵
        • Launches sc.exe
        PID:5256
      • C:\Windows\SYSTEM32\sc.exe
        "sc" config WinDefend start= demand
        3⤵
        • Launches sc.exe
        PID:5544
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /c mountvol E: /S
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\system32\mountvol.exe
          mountvol E: /S
          4⤵
            PID:3396
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c mountvol E: /D
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5232
          • C:\Windows\system32\mountvol.exe
            mountvol E: /D
            4⤵
            • Enumerates connected drives
            PID:5900
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c mountvol F: /S
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5832
          • C:\Windows\system32\mountvol.exe
            mountvol F: /S
            4⤵
              PID:116
          • C:\Windows\SYSTEM32\CMD.exe
            "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\Videos\AntiMalware Services.exe" enable=yes & exit
            3⤵
            • Loads dropped DLL
            PID:1256
          • C:\Windows\SYSTEM32\CMD.exe
            "CMD" /c schtasks /delete /F /TN "system" & exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /F /TN "system"
              4⤵
                PID:3536
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd" /c schtasks /create /f /sc onlogon /tn "system" /tr "C:\Users\Admin\Videos\AntiMalware Services.exe" & exit
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4700
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /sc onlogon /tn "system" /tr "C:\Users\Admin\Videos\AntiMalware Services.exe"
                4⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5224
            • C:\Windows\SYSTEM32\sc.exe
              "sc" stop WinDefend
              3⤵
              • Launches sc.exe
              PID:3076
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c net stop WinDefend
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3624
              • C:\Windows\system32\net.exe
                net stop WinDefend
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4264
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop WinDefend
                  5⤵
                    PID:2336
              • C:\Windows\SYSTEM32\sc.exe
                "sc" config WinDefend start= demand
                3⤵
                • Launches sc.exe
                PID:3836
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /c net start WinDefend
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2884
                • C:\Windows\system32\net.exe
                  net start WinDefend
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5496
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 start WinDefend
                    5⤵
                      PID:1648
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /c mountvol F: /D
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4164
                  • C:\Windows\system32\mountvol.exe
                    mountvol F: /D
                    4⤵
                      PID:4224
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /c mountvol G: /S
                    3⤵
                      PID:3096
                      • C:\Windows\system32\mountvol.exe
                        mountvol G: /S
                        4⤵
                          PID:5352
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c bcdedit /set testsigning on
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5076
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set testsigning on
                          4⤵
                          • Modifies boot configuration data using bcdedit
                          PID:3564
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c bcdedit /set nointegritychecks on
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2244
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set nointegritychecks on
                          4⤵
                          • Modifies boot configuration data using bcdedit
                          PID:5876
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4964
                        • C:\Windows\system32\icacls.exe
                          icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
                          4⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:5488
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\null.sys" /a
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3304
                        • C:\Windows\system32\takeown.exe
                          takeown /f "C:\Windows\system32\drivers\null.sys" /a
                          4⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:5676
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2360
                        • C:\Windows\system32\icacls.exe
                          icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F
                          4⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:2648
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c move /y "C:\Windows\system32\drivers\null.sys" "C:\Windows\system32\drivers\null.sys.bak"
                        3⤵
                          PID:5724
                        • C:\Windows\SYSTEM32\sc.exe
                          "sc" stop WinDefend
                          3⤵
                          • Launches sc.exe
                          PID:3792
                        • C:\Windows\SYSTEM32\sc.exe
                          "sc" config WinDefend start= demand
                          3⤵
                          • Launches sc.exe
                          PID:452
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5164
                          • C:\Windows\system32\icacls.exe
                            icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
                            4⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:2724
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\beep.sys" /a
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1836
                          • C:\Windows\system32\takeown.exe
                            takeown /f "C:\Windows\system32\drivers\beep.sys" /a
                            4⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:1852
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3464
                          • C:\Windows\system32\icacls.exe
                            icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
                            4⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:5968
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c move /y "C:\Windows\system32\drivers\beep.sys" "C:\Windows\system32\drivers\beep.sys.bak"
                          3⤵
                            PID:1112
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1804
                            • C:\Windows\system32\icacls.exe
                              icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
                              4⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              PID:4100
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\rasl2tp.sys" /a
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2596
                            • C:\Windows\system32\takeown.exe
                              takeown /f "C:\Windows\system32\drivers\rasl2tp.sys" /a
                              4⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              PID:3384
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5708
                            • C:\Windows\system32\icacls.exe
                              icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F
                              4⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              PID:548
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /c move /y "C:\Windows\system32\drivers\rasl2tp.sys" "C:\Windows\system32\drivers\rasl2tp.sys.bak"
                            3⤵
                              PID:412
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5804
                              • C:\Windows\system32\icacls.exe
                                icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
                                4⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                PID:924
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\raspppoe.sys" /a
                              3⤵
                              • Loads dropped DLL
                              PID:6036
                              • C:\Windows\system32\takeown.exe
                                takeown /f "C:\Windows\system32\drivers\raspppoe.sys" /a
                                4⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                PID:5448
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /c mountvol G: /D
                              3⤵
                                PID:3044
                                • C:\Windows\system32\mountvol.exe
                                  mountvol G: /D
                                  4⤵
                                    PID:5656
                                • C:\Windows\SYSTEM32\cmd.exe
                                  "cmd.exe" /c mountvol H: /S
                                  3⤵
                                    PID:4816
                                    • C:\Windows\system32\mountvol.exe
                                      mountvol H: /S
                                      4⤵
                                        PID:4740
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F
                                      3⤵
                                        PID:5500
                                        • C:\Windows\system32\icacls.exe
                                          icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F
                                          4⤵
                                          • Possible privilege escalation attempt
                                          • Modifies file permissions
                                          PID:5180
                                      • C:\Windows\SYSTEM32\cmd.exe
                                        "cmd.exe" /c move /y "C:\Windows\system32\drivers\raspppoe.sys" "C:\Windows\system32\drivers\raspppoe.sys.bak"
                                        3⤵
                                          PID:4488
                                        • C:\Windows\SYSTEM32\cmd.exe
                                          "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
                                          3⤵
                                            PID:5140
                                            • C:\Windows\system32\icacls.exe
                                              icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
                                              4⤵
                                              • Possible privilege escalation attempt
                                              • Modifies file permissions
                                              PID:5876
                                          • C:\Windows\SYSTEM32\cmd.exe
                                            "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\raspptp.sys" /a
                                            3⤵
                                              PID:3564
                                              • C:\Windows\system32\takeown.exe
                                                takeown /f "C:\Windows\system32\drivers\raspptp.sys" /a
                                                4⤵
                                                • Possible privilege escalation attempt
                                                • Modifies file permissions
                                                PID:2544
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
                                              3⤵
                                                PID:2872
                                                • C:\Windows\system32\icacls.exe
                                                  icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
                                                  4⤵
                                                  • Possible privilege escalation attempt
                                                  • Modifies file permissions
                                                  PID:3740
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                "cmd.exe" /c move /y "C:\Windows\system32\drivers\raspptp.sys" "C:\Windows\system32\drivers\raspptp.sys.bak"
                                                3⤵
                                                  PID:3784
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  "cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
                                                  3⤵
                                                    PID:4612
                                                    • C:\Windows\system32\icacls.exe
                                                      icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
                                                      4⤵
                                                      • Possible privilege escalation attempt
                                                      • Modifies file permissions
                                                      PID:4992
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\modem.sys" /a
                                                    3⤵
                                                      PID:3788
                                                      • C:\Windows\system32\takeown.exe
                                                        takeown /f "C:\Windows\system32\drivers\modem.sys" /a
                                                        4⤵
                                                        • Possible privilege escalation attempt
                                                        • Modifies file permissions
                                                        PID:3364
                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                      "cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
                                                      3⤵
                                                        PID:1268
                                                        • C:\Windows\system32\icacls.exe
                                                          icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
                                                          4⤵
                                                          • Possible privilege escalation attempt
                                                          • Modifies file permissions
                                                          PID:3988
                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                        "cmd.exe" /c move /y "C:\Windows\system32\drivers\modem.sys" "C:\Windows\system32\drivers\modem.sys.bak"
                                                        3⤵
                                                          PID:3224
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
                                                          3⤵
                                                            PID:2628
                                                            • C:\Windows\system32\icacls.exe
                                                              icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:928
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            "cmd.exe" /c icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
                                                            3⤵
                                                              PID:3696
                                                              • C:\Windows\system32\icacls.exe
                                                                icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
                                                                4⤵
                                                                • Possible privilege escalation attempt
                                                                • Modifies file permissions
                                                                PID:2308
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              "cmd.exe" /c icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
                                                              3⤵
                                                                PID:5968
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
                                                                  4⤵
                                                                  • Possible privilege escalation attempt
                                                                  • Modifies file permissions
                                                                  PID:4516
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                "cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
                                                                3⤵
                                                                  PID:3236
                                                                  • C:\Windows\system32\icacls.exe
                                                                    icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
                                                                    4⤵
                                                                    • Possible privilege escalation attempt
                                                                    • Modifies file permissions
                                                                    PID:5380
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  "cmd.exe" /c bcdedit /set {current} testsigning off
                                                                  3⤵
                                                                    PID:1756
                                                                    • C:\Windows\system32\bcdedit.exe
                                                                      bcdedit /set {current} testsigning off
                                                                      4⤵
                                                                      • Modifies boot configuration data using bcdedit
                                                                      PID:4660
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    "cmd.exe" /c bcdedit /set testsigning on
                                                                    3⤵
                                                                      PID:3024
                                                                      • C:\Windows\system32\bcdedit.exe
                                                                        bcdedit /set testsigning on
                                                                        4⤵
                                                                        • Modifies boot configuration data using bcdedit
                                                                        PID:6040
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive Downloader" /tr "C:\Windows\BootExecutor.exe" /RL HIGHEST & exit
                                                                      3⤵
                                                                        PID:548
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks /create /f /sc minute /mo 30 /tn "OneDrive Downloader" /tr "C:\Windows\BootExecutor.exe" /RL HIGHEST
                                                                          4⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:5896
                                                                      • C:\Users\Admin\Videos\AntiMalware Services.exe
                                                                        "C:\Users\Admin\Videos\AntiMalware Services.exe"
                                                                        3⤵
                                                                        • Modifies Windows Defender DisableAntiSpyware settings
                                                                        • Modifies Windows Defender TamperProtection settings
                                                                        • UAC bypass
                                                                        • Drops file in Drivers directory
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Windows security modification
                                                                        • Checks whether UAC is enabled
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • System policy modification
                                                                        PID:5960
                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                          "cmd.exe" /c net stop WinDefend
                                                                          4⤵
                                                                          • Loads dropped DLL
                                                                          PID:5240
                                                                          • C:\Windows\system32\net.exe
                                                                            net stop WinDefend
                                                                            5⤵
                                                                              PID:2600
                                                                              • C:\Windows\system32\net1.exe
                                                                                C:\Windows\system32\net1 stop WinDefend
                                                                                6⤵
                                                                                  PID:3644
                                                                            • C:\Windows\SYSTEM32\CMD.exe
                                                                              "CMD" /c schtasks /delete /F /TN "system" & exit
                                                                              4⤵
                                                                                PID:3988
                                                                                • C:\Windows\system32\schtasks.exe
                                                                                  schtasks /delete /F /TN "system"
                                                                                  5⤵
                                                                                    PID:1364
                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                  "cmd" /c schtasks /create /f /sc onlogon /tn "system" /tr "C:\Users\Admin\Videos\AntiMalware Services.exe" & exit
                                                                                  4⤵
                                                                                    PID:1128
                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                      schtasks /create /f /sc onlogon /tn "system" /tr "C:\Users\Admin\Videos\AntiMalware Services.exe"
                                                                                      5⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:5748
                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                    "cmd.exe" /c mountvol E: /S
                                                                                    4⤵
                                                                                      PID:5012
                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                        mountvol E: /S
                                                                                        5⤵
                                                                                          PID:5048
                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                        "cmd.exe" /c net start WinDefend
                                                                                        4⤵
                                                                                          PID:4136
                                                                                          • C:\Windows\system32\net.exe
                                                                                            net start WinDefend
                                                                                            5⤵
                                                                                              PID:5656
                                                                                              • C:\Windows\system32\net1.exe
                                                                                                C:\Windows\system32\net1 start WinDefend
                                                                                                6⤵
                                                                                                  PID:936
                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                              "cmd.exe" /c mountvol E: /D
                                                                                              4⤵
                                                                                                PID:1036
                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                  mountvol E: /D
                                                                                                  5⤵
                                                                                                  • Enumerates connected drives
                                                                                                  PID:5948
                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                "cmd.exe" /c bcdedit /set testsigning on
                                                                                                4⤵
                                                                                                  PID:1364
                                                                                                  • C:\Windows\system32\bcdedit.exe
                                                                                                    bcdedit /set testsigning on
                                                                                                    5⤵
                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                    PID:5568
                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                  "cmd.exe" /c mountvol F: /S
                                                                                                  4⤵
                                                                                                    PID:852
                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                      mountvol F: /S
                                                                                                      5⤵
                                                                                                        PID:2700
                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                      "cmd.exe" /c bcdedit /set nointegritychecks on
                                                                                                      4⤵
                                                                                                        PID:2032
                                                                                                        • C:\Windows\system32\bcdedit.exe
                                                                                                          bcdedit /set nointegritychecks on
                                                                                                          5⤵
                                                                                                          • Modifies boot configuration data using bcdedit
                                                                                                          PID:3284
                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                        "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F
                                                                                                        4⤵
                                                                                                          PID:2448
                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                            icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F
                                                                                                            5⤵
                                                                                                            • Possible privilege escalation attempt
                                                                                                            • Modifies file permissions
                                                                                                            PID:5988
                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                          "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys.bak" /grant administrators:F
                                                                                                          4⤵
                                                                                                            PID:4696
                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                              icacls "C:\Windows\system32\drivers\null.sys.bak" /grant administrators:F
                                                                                                              5⤵
                                                                                                              • Possible privilege escalation attempt
                                                                                                              • Modifies file permissions
                                                                                                              PID:3296
                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                            "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
                                                                                                            4⤵
                                                                                                              PID:2324
                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
                                                                                                                5⤵
                                                                                                                • Possible privilege escalation attempt
                                                                                                                • Modifies file permissions
                                                                                                                PID:3724
                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                              "cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
                                                                                                              4⤵
                                                                                                                PID:1432
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  5⤵
                                                                                                                    PID:3644
                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                    icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
                                                                                                                    5⤵
                                                                                                                    • Possible privilege escalation attempt
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:1248
                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                  "cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys.bak" /grant administrators:F
                                                                                                                  4⤵
                                                                                                                    PID:4740
                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                      icacls "C:\Windows\system32\drivers\beep.sys.bak" /grant administrators:F
                                                                                                                      5⤵
                                                                                                                      • Possible privilege escalation attempt
                                                                                                                      • Modifies file permissions
                                                                                                                      PID:1260
                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                    "cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
                                                                                                                    4⤵
                                                                                                                      PID:3472
                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                        icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
                                                                                                                        5⤵
                                                                                                                        • Possible privilege escalation attempt
                                                                                                                        • Modifies file permissions
                                                                                                                        PID:5364
                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                      "cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F
                                                                                                                      4⤵
                                                                                                                        PID:3884
                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                          icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F
                                                                                                                          5⤵
                                                                                                                          • Possible privilege escalation attempt
                                                                                                                          • Modifies file permissions
                                                                                                                          PID:5016
                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                        "cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F
                                                                                                                        4⤵
                                                                                                                          PID:3296
                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                            icacls "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F
                                                                                                                            5⤵
                                                                                                                            • Possible privilege escalation attempt
                                                                                                                            • Modifies file permissions
                                                                                                                            PID:2308
                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                          "cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
                                                                                                                          4⤵
                                                                                                                            PID:3536
                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                              icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
                                                                                                                              5⤵
                                                                                                                              • Possible privilege escalation attempt
                                                                                                                              • Modifies file permissions
                                                                                                                              PID:552
                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                            "cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F
                                                                                                                            4⤵
                                                                                                                              PID:1648
                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F
                                                                                                                                5⤵
                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:4108
                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                              "cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F
                                                                                                                              4⤵
                                                                                                                                PID:5540
                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                  icacls "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F
                                                                                                                                  5⤵
                                                                                                                                  • Possible privilege escalation attempt
                                                                                                                                  • Modifies file permissions
                                                                                                                                  PID:2700
                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                "cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
                                                                                                                                4⤵
                                                                                                                                  PID:5424
                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                    icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
                                                                                                                                    5⤵
                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:5572
                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                  "cmd.exe" /c mountvol F: /D
                                                                                                                                  4⤵
                                                                                                                                    PID:1392
                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                      mountvol F: /D
                                                                                                                                      5⤵
                                                                                                                                      • Enumerates connected drives
                                                                                                                                      PID:5376
                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                    "cmd.exe" /c mountvol G: /S
                                                                                                                                    4⤵
                                                                                                                                      PID:3184
                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                        mountvol G: /S
                                                                                                                                        5⤵
                                                                                                                                          PID:5224
                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                        "cmd.exe" /c mountvol G: /D
                                                                                                                                        4⤵
                                                                                                                                          PID:1260
                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                            mountvol G: /D
                                                                                                                                            5⤵
                                                                                                                                              PID:2676
                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                            "cmd.exe" /c mountvol H: /S
                                                                                                                                            4⤵
                                                                                                                                              PID:2044
                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                mountvol H: /S
                                                                                                                                                5⤵
                                                                                                                                                  PID:2496
                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                "cmd.exe" /c mountvol H: /D
                                                                                                                                                4⤵
                                                                                                                                                  PID:5236
                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                    mountvol H: /D
                                                                                                                                                    5⤵
                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                    PID:3092
                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                  "cmd.exe" /c mountvol I: /S
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1324
                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      5⤵
                                                                                                                                                        PID:6056
                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                        mountvol I: /S
                                                                                                                                                        5⤵
                                                                                                                                                          PID:4644
                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                        "cmd.exe" /c mountvol I: /D
                                                                                                                                                        4⤵
                                                                                                                                                          PID:4276
                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                            mountvol I: /D
                                                                                                                                                            5⤵
                                                                                                                                                              PID:5568
                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                            "cmd.exe" /c mountvol J: /S
                                                                                                                                                            4⤵
                                                                                                                                                              PID:3476
                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                mountvol J: /S
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5732
                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                "cmd.exe" /c mountvol J: /D
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:3168
                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                    mountvol J: /D
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                    PID:3864
                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                  "cmd.exe" /c mountvol K: /S
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:5068
                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                      mountvol K: /S
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:5900
                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                      "cmd.exe" /c mountvol K: /D
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:4520
                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                          mountvol K: /D
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:772
                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                          "cmd.exe" /c mountvol L: /S
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:2888
                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                              mountvol L: /S
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:3728
                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                              "cmd.exe" /c mountvol L: /D
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:4560
                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                  mountvol L: /D
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:3712
                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                  "cmd.exe" /c mountvol M: /S
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:4956
                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                      mountvol M: /S
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:3984
                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                      "cmd.exe" /c mountvol M: /D
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:5808
                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                          mountvol M: /D
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                          PID:2356
                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                        "cmd.exe" /c mountvol N: /S
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:5212
                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                            mountvol N: /S
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:5824
                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                            "cmd.exe" /c mountvol N: /D
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:4268
                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                mountvol N: /D
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                PID:3728
                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                              "cmd.exe" /c mountvol O: /S
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:5592
                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                  mountvol O: /S
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                  "cmd.exe" /c mountvol O: /D
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:5292
                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                      mountvol O: /D
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:924
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                      "cmd.exe" /c mountvol P: /S
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:3016
                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                          mountvol P: /S
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                          "cmd.exe" /c mountvol P: /D
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:5580
                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                              mountvol P: /D
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:1584
                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                              "cmd.exe" /c mountvol Q: /S
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:3364
                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                  mountvol Q: /S
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:1460
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                  "cmd.exe" /c mountvol Q: /D
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:5484
                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                      mountvol Q: /D
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                      PID:3784
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                    "cmd.exe" /c mountvol R: /S
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:1544
                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                        mountvol R: /S
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:4588
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                        "cmd.exe" /c mountvol R: /D
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:2296
                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                            mountvol R: /D
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                            PID:628
                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                          "cmd.exe" /c mountvol S: /S
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:3880
                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                              mountvol S: /S
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:4808
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                              "cmd.exe" /c mountvol S: /D
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:3268
                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                  mountvol S: /D
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:5452
                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                  "cmd.exe" /c mountvol T: /S
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:3400
                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                      mountvol T: /S
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:5200
                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                      "cmd.exe" /c mountvol T: /D
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                          mountvol T: /D
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                          PID:5256
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                        "cmd.exe" /c mountvol U: /S
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:4900
                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                            mountvol U: /S
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:5308
                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                            "cmd.exe" /c mountvol U: /D
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:4116
                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                mountvol U: /D
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                PID:5572
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                              "cmd.exe" /c mountvol V: /S
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:3684
                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                  mountvol V: /S
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol V: /D
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:6012
                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                      mountvol V: /D
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                      PID:924
                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol W: /S
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:3720
                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                        mountvol W: /S
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:3032
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol W: /D
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                            mountvol W: /D
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                            PID:3036
                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol X: /S
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:1620
                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                              mountvol X: /S
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:5572
                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol X: /D
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:5996
                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                  mountvol X: /D
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                  PID:5732
                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol Y: /S
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:1780
                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                    mountvol Y: /S
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:4576
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol Y: /D
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:2664
                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                        mountvol Y: /D
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                        PID:2304
                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol E: /S
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                          mountvol E: /S
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:2496
                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol E: /D
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:632
                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                              mountvol E: /D
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                              PID:5740
                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol F: /S
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:5720
                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                mountvol F: /S
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol F: /D
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                    mountvol F: /D
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol G: /S
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:5780
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                      mountvol G: /S
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:5736
                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol G: /D
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:2864
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                          mountvol G: /D
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                          PID:4364
                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol H: /S
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                            mountvol H: /S
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:4236
                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol H: /D
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                mountvol H: /D
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                PID:4968
                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol I: /S
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:1992
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                  mountvol I: /S
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:5888
                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol I: /D
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                      mountvol I: /D
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:4384
                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol J: /S
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                          mountvol J: /S
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:452
                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol J: /D
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:4012
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                              mountvol J: /D
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                              PID:1848
                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol K: /S
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:3756
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                mountvol K: /S
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:856
                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol K: /D
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:5444
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                    mountvol K: /D
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:888
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol L: /S
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                        mountvol L: /S
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:5336
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol L: /D
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                            mountvol L: /D
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:5568
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol M: /S
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                mountvol M: /S
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:5740
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol M: /D
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                    mountvol M: /D
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:1884
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol N: /S
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                        mountvol N: /S
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:6088
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol N: /D
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:5336
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                            mountvol N: /D
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                            PID:3820
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol O: /S
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:6076
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                              mountvol O: /S
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                PID:828
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol O: /D
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                  mountvol O: /D
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                  PID:6112
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol P: /S
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3804
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                    mountvol P: /S
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5732
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol P: /D
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:908
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                        mountvol P: /D
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol Q: /S
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6080
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                            mountvol Q: /S
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4248
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol Q: /D
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4284
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                mountvol Q: /D
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol R: /S
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3740
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                  mountvol R: /S
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1296
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol R: /D
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1516
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                      mountvol R: /D
                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                      PID:4660
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol S: /S
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5712
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                        mountvol S: /S
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3260
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol S: /D
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3376
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                            mountvol S: /D
                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                            PID:3736
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol T: /S
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2980
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                              mountvol T: /S
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol T: /D
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3836
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                  mountvol T: /D
                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5296
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol U: /S
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5404
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                      mountvol U: /S
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4636
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol U: /D
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2060
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                          mountvol U: /D
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1144
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol V: /S
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5008
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                              mountvol V: /S
                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:928
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol V: /D
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                  mountvol V: /D
                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4836
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol W: /S
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:552
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                    mountvol W: /S
                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol W: /D
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                        mountvol W: /D
                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol X: /S
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                            mountvol X: /S
                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol X: /D
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                mountvol X: /D
                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol Y: /S
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol Y: /S
                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol Y: /D
                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol Y: /D
                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\BootExecutor.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\BootExecutor.exe
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Windows Defender TamperProtection settings
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                              • Windows security modification
                                                                                                                                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol E: /S
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    mountvol E: /S
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol E: /D
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        mountvol E: /D
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol F: /S
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            mountvol F: /S
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol F: /D
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol F: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol G: /S
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol G: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol G: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol G: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol H: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol H: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol H: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:668
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol H: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol I: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol I: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol I: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol I: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol J: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        mountvol J: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol J: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            mountvol J: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol K: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:368
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol K: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol K: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mountvol K: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol L: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol L: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol L: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol L: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol M: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            mountvol M: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol M: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol M: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol N: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol N: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol N: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol N: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol O: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol O: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol O: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol O: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol P: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol P: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol P: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol P: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol Q: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        mountvol Q: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol Q: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            mountvol Q: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol R: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol R: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol R: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mountvol R: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol S: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol S: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol S: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol S: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol T: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            mountvol T: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol T: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol T: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol U: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol U: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol U: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol U: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol V: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        mountvol V: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol V: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            mountvol V: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol W: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol W: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol W: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol W: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol X: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol X: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol X: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol X: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol Y: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol Y: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol Y: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol Y: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol E: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mountvol E: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol E: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        mountvol E: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol F: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol F: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol F: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol F: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol G: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol G: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol G: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol G: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol H: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol H: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol H: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol H: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol I: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol I: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol I: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mountvol I: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol J: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol J: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol J: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol J: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol K: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            mountvol K: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol K: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol K: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol L: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol L: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol L: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol L: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol M: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol M: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol M: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol M: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol N: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol N: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol N: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mountvol N: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol O: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol O: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol O: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol O: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol P: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            mountvol P: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol P: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol P: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol Q: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mountvol Q: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol Q: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        mountvol Q: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol R: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol R: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol R: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol R: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol S: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol S: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol S: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol S: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol T: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        mountvol T: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c mountvol T: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            mountvol T: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c mountvol U: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                mountvol U: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol U: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mountvol U: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "cmd.exe" /c mountvol V: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mountvol V: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol V: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol V: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol W: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol W: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c mountvol W: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mountvol W: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "cmd.exe" /c mountvol X: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mountvol X: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c mountvol X: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        mountvol X: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c mountvol Y: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mountvol Y: /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c mountvol Y: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\mountvol.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mountvol Y: /D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\UsoClient.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\usoclient.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6124

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                System Services

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1569

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1542

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Bootkit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1542.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1547.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1222

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Windows File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1222.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1070

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Clear Windows Event Logs

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1070.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1542

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Bootkit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1542.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1490

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Service Stop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1489

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                config.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\Microsoft\Windows\OneSettings\config.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 6aeb047c25f849092a6bb615e14c4ea8842609bfa83a991ee46f8ed3778eed12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                AppCache134207020037952121.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134207020037952121.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 83KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 23630a40dcdacbad803de2ad9a520e2b13bee1eb5889e9f1e5b57266f73de2db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dca169d8-be49-40a1-9da8-52279d8c1700.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$77temp\dca169d8-be49-40a1-9da8-52279d8c1700.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 147KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                driver_infector.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\Desktop\driver_infector.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c5d198c4f1cc2b4e0899c43afce09727aa4819c079a5f2e1153209ee11aa1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                driver_infector.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\Desktop\driver_infector.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 575f139dacd66b3d7330d347f9e72dd6e9f958f49a2eae014750d286bff96203
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                driver_infector.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\Desktop\driver_infector.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3c8ef5fc4aa172b4300c355b9fc9a59a3359605127dde51cad0a7ae762bf1af7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Boot.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Administrator\AppData\Local\Boot.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 375KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 eba9ea797869c23eae4e6c78a5b5290ad1c0e50dcfc10ca216063cbd79c73195
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Schedule Work
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Schedule Work
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/556-226-0x000002064F950000-0x000002064F951000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/564-59-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/616-87-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/676-97-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/752-107-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/792-181-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1008-167-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1012-173-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-193-0x000001BDC1830000-0x000001BDC185B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-198-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-188-0x000001BDC1830000-0x000001BDC185B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-187-0x000001BDC1830000-0x000001BDC185B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-186-0x000001BDC16D0000-0x000001BDC16F5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-195-0x000001BDC1830000-0x000001BDC185B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-194-0x000001BDC1830000-0x000001BDC185B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-200-0x000001BDC1830000-0x000001BDC185B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-196-0x000001BDC1830000-0x000001BDC185B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-197-0x000001BDC1830000-0x000001BDC185B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1060-201-0x00007FF6E3F10000-0x00007FF6E3F27000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1168-67-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1204-165-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1344-103-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1376-183-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1512-608-0x000002310E960000-0x000002310E9C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1548-57-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1672-143-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1772-32-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1784-158-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1800-185-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1812-182-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1856-141-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/1980-155-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2120-184-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2200-180-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2340-62-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2384-161-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2416-179-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2520-122-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2564-149-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2568-152-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2584-139-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/2880-125-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/3228-223-0x0000000003470000-0x0000000003471000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/3228-17-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/3360-68-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/3432-30-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/3768-170-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/3968-178-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-245-0x00000189BE490000-0x00000189BE4A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-234-0x00000189BE490000-0x00000189BE4A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-212-0x00000189BE1D0000-0x00000189BE1FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-211-0x00000189BE1D0000-0x00000189BE1FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-209-0x00000189BE1D0000-0x00000189BE1FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-205-0x00000189BE1D0000-0x00000189BE1FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-214-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-210-0x00000189BE1D0000-0x00000189BE1FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-232-0x00000189BE490000-0x00000189BE4A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4272-213-0x00000189BE1D0000-0x00000189BE1FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/4856-137-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/5248-9-0x00007FFF03EE0000-0x00007FFF041A9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/5248-0-0x000001F75C2E0000-0x000001F75C342000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/5248-7-0x00007FFF06370000-0x00007FFF06565000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/5248-8-0x00007FFF054D0000-0x00007FFF0558E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/5248-2-0x000001F776940000-0x000001F776C95000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/5248-3-0x000001F75C6E0000-0x000001F75C6EC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/5248-4-0x000001F75C720000-0x000001F75C730000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/5248-1-0x000001F75C720000-0x000001F75C730000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                memory/5680-63-0x00007FFEC63F0000-0x00007FFEC6400000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download