Analysis
- max time kernel
150s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 17:11
General
- Target o434ky1hwg376xjq.exe
- Size 394KB
- Sample260628-vqgphsaw9l
- SHA256 3292d85d585785a836a6befee0383af7d2c4e7369dc2dd16bbc91f5196e3fd1d
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 3 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
- Modifies security service 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 12 IoCs
- Executes dropped EXE 41 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 5 IoCs
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 17 IoCs
- Modifies registry class 9 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\o434ky1hwg376xjq.exe"C:\Users\Admin\AppData\Local\Temp\o434ky1hwg376xjq.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Program Files\Steam.exe" enable=yes & exit3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "Steam.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Steam.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "Steam.exe" /tr "C:\Program Files\Steam.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "Steam.exe" /tr "C:\Program Files\Steam.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Windows\SteamRecoveryService.exe" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Windows\SteamRecoveryService.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Steam.exe"C:\Program Files\Steam.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "Steam.exe" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Steam.exe"5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
- Enumerates connected drives
-
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
-
C:\Windows\SteamRecoveryService.exeC:\Windows\SteamRecoveryService.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Indicator Removal
1Clear Windows Event Logs
1Modify Registry
6Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
c7238d05-aa01-44d5-abf1-c2449af022c7.dll
wsappx.exe
dberr.txt
memory/588-31-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/740-69-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/944-95-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/1324-25-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/1336-61-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/1392-256-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/1600-198-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/1624-192-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/1728-193-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/1916-83-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/1960-29-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/1984-203-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/2064-125-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/2200-199-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/2216-200-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/2240-152-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/2484-109-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/2696-105-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/2732-188-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/2828-255-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/2996-175-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3076-127-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3120-97-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3304-85-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3416-296-0x0000019076480000-0x00000190764AB000-memory.dmp
memory/3416-295-0x0000019076480000-0x00000190764AB000-memory.dmp
memory/3416-298-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3416-294-0x0000019076480000-0x00000190764AB000-memory.dmp
memory/3416-297-0x0000019076480000-0x00000190764AB000-memory.dmp
memory/3416-293-0x0000019076480000-0x00000190764AB000-memory.dmp
memory/3416-288-0x0000019076480000-0x00000190764AB000-memory.dmp
memory/3416-300-0x0000019076020000-0x0000019076086000-memory.dmp
memory/3440-129-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3448-280-0x0000000006160000-0x0000000006161000-memory.dmp
memory/3448-223-0x00000000036F0000-0x00000000036F1000-memory.dmp
memory/3448-19-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3516-87-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3548-246-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp
memory/3548-281-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp
memory/3548-6-0x00007FFD8C5A0000-0x00007FFD8C803000-memory.dmp
memory/3548-0-0x00000211247E0000-0x0000021124846000-memory.dmp
memory/3548-8-0x00007FFD89D80000-0x00007FFD8A121000-memory.dmp
memory/3548-5-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp
memory/3548-4-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp
memory/3548-257-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp
memory/3548-3-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp
memory/3548-20-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp
memory/3548-7-0x00007FFD8B2A0000-0x00007FFD8B367000-memory.dmp
memory/3548-1-0x00007FFD69B9F000-0x00007FFD69BA0000-memory.dmp
memory/3548-2-0x00007FFD69A10000-0x00007FFD6A3B4000-memory.dmp
memory/3604-191-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3620-184-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3688-103-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3696-115-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/3712-88-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/4104-218-0x0000025DC25A0000-0x0000025DC25CB000-memory.dmp
memory/4104-211-0x0000025DC25A0000-0x0000025DC25CB000-memory.dmp
memory/4104-220-0x0000025DC25A0000-0x0000025DC25CB000-memory.dmp
memory/4104-217-0x0000025DC25A0000-0x0000025DC25CB000-memory.dmp
memory/4104-210-0x0000025DC25A0000-0x0000025DC25CB000-memory.dmp
memory/4104-216-0x0000025DC25A0000-0x0000025DC25CB000-memory.dmp
memory/4104-209-0x0000025DC2290000-0x0000025DC22B5000-memory.dmp
memory/4104-221-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/4104-219-0x0000025DC25A0000-0x0000025DC25CB000-memory.dmp
memory/4344-202-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/4396-172-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/4448-111-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/4464-123-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/4580-278-0x0000013BDE260000-0x0000013BDE261000-memory.dmp
memory/4580-301-0x0000013BDE270000-0x0000013BDE271000-memory.dmp
memory/4604-84-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/4968-166-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/5080-160-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/5112-190-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp
memory/5308-33-0x00007FFD4C6E0000-0x00007FFD4C6F0000-memory.dmp