Analysis
- max time kernel
79s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 18:11
General
- Target Realtek.exe
- Size 402KB
- Sample260628-ws12lsaz7y
- SHA256 827f8b6b929845378fe3b1c0a382953b4f32416ad9cb5f4d786e4ae706bb4ba9
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 7 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 9 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs
- Modifies firewall policy service 3 TTPs 4 IoCs
- Modifies security service 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 36 IoCs
- Modifies Windows Firewall 2 TTPs 9 IoCs
- Creates new service(s) 2 TTPs
- Executes dropped EXE 47 IoCs
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 5 IoCs
- Checks whether UAC is enabled 1 TTPs 18 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 28 IoCs
- Drops file in Windows directory 64 IoCs
- Launches sc.exe 31 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 29 IoCs
- Modifies registry class 7 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 51 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 54 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek.exe"C:\Users\Admin\AppData\Local\Temp\Realtek.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- UAC bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Realtek.exe" enable=yes & exit3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Realtek.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\Realtek.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dab706d4" /F3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dab706d4" /XML "C:\Users\Admin\AppData\Local\Temp\db97b0e8-0a96-4d71-8154-84d95476458c.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_17727dc2" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_17727dc2" /XML "C:\Users\Admin\AppData\Local\Temp\c7711060-9f3f-44ad-9266-512762f3fc09.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_99828c18" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_99828c18" /XML "C:\Users\Admin\AppData\Local\Temp\727fbabe-f7da-4f91-85b1-9e3f6bd2e038.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 6 /tn "Realtek.exe" /tr "C:\Windows\Realtek.exe" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 6 /tn "Realtek.exe" /tr "C:\Windows\Realtek.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "Realtek" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Realtek"4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" start TrustedInstaller3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "Realtek" /tr "C:\Windows\Realtek.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "Realtek" /tr "C:\Windows\Realtek.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\Realtek.exe"C:\Windows\Realtek.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes & exit4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S4⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Realtek.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_3bd99de8" /F4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_3bd99de8" /XML "C:\Users\Admin\AppData\Local\Temp\81f45267-1ed2-4470-b4e0-495c94768ac2.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_c4969644" /F4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_c4969644" /XML "C:\Users\Admin\AppData\Local\Temp\83979bc0-fcf4-4e81-ade1-f5ff28313bbe.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_1f98cd83" /F4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_1f98cd83" /XML "C:\Users\Admin\AppData\Local\Temp\7ae394de-7635-40ae-9336-1f69b915244e.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Realtek.exeC:\Users\Admin\AppData\Local\Temp\Realtek.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Realtek.exe" enable=yes & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\Realtek.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\Realtek.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_a8040525" /F2⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 14 /tn "Realtek.exe" /tr "C:\Windows\Realtek.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /f /sc minute /mo 14 /tn "Realtek.exe" /tr "C:\Windows\Realtek.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_a8040525" /XML "C:\Windows\SystemTemp\b4b4708b-2312-4ac7-8cfb-5a5eceeaad99.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "Realtek" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /delete /F /TN "Realtek"3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "Realtek" /tr "C:\Windows\Realtek.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /f /sc onlogon /tn "Realtek" /tr "C:\Windows\Realtek.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\sc.exe"sc" start TrustedInstaller2⤵
- Launches sc.exe
-
-
C:\Windows\Realtek.exe"C:\Windows\Realtek.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes & exit3⤵
-
C:\Windows\System32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Realtek.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_9f1d3ade" /F3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_9f1d3ade" /XML "C:\Windows\SystemTemp\f6c671c1-141e-4ef2-a45d-19ebd757e50b.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_8f8be688" /F3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_8f8be688" /XML "C:\Windows\SystemTemp\f0b26f14-410b-4c46-ac3d-f02618da47c9.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_88462159" /F3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_88462159" /XML "C:\Windows\SystemTemp\954fb220-f42e-4841-958b-7185faa2d2d2.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D3⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\system32\CMD.exe"CMD" /c schtasks /run /i /tn "Realtek"3⤵
-
C:\Windows\System32\schtasks.exeschtasks /run /i /tn "Realtek"4⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D3⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\Realtek.exe"C:\Windows\Realtek.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes & exit4⤵
-
C:\Windows\System32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S4⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Realtek.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Intel PTT EK Recertification_faea4715" /F4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Intel PTT EK Recertification_faea4715" /XML "C:\Windows\SystemTemp\b583aa21-101e-40a5-91c2-f3c13d39f7de.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_c1fc5985" /F4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_c1fc5985" /XML "C:\Windows\SystemTemp\ca2220ee-7e24-45c0-8fb4-db7c68863d8d.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_69ef7a81" /F4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_69ef7a81" /XML "C:\Windows\SystemTemp\01f59327-d327-4278-a120-892cb2c1778a.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D4⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D3⤵
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\Realtek.exeC:\Windows\Realtek.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\System32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes & exit2⤵
-
C:\Windows\System32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Realtek.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_c8712320" /F2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_c8712320" /XML "C:\Users\Admin\AppData\Local\Temp\176784f1-2f65-4eae-bb00-f82929ab8c1f.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_dc0e0fdd" /F2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_dc0e0fdd" /XML "C:\Users\Admin\AppData\Local\Temp\fb95b48a-60e8-4118-9943-633cdec1a689.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_5c1cf42d" /F2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_5c1cf42d" /XML "C:\Users\Admin\AppData\Local\Temp\313216e2-85d9-42c6-ba7b-c20ee1d8b00e.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" V: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\System32\CMD.exe"CMD" /c schtasks /run /i /tn "Realtek"2⤵
-
C:\Windows\System32\schtasks.exeschtasks /run /i /tn "Realtek"3⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" W: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" X: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" Y: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\Realtek.exe"C:\Windows\Realtek.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\System32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes & exit3⤵
-
C:\Windows\System32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Realtek.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_91004269" /F3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_91004269" /XML "C:\Users\Admin\AppData\Local\Temp\3aebbfd9-67e1-4b8a-9e7a-e7f5ef6f34c2.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_8ba33ea1" /F3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_8ba33ea1" /XML "C:\Users\Admin\AppData\Local\Temp\f016b678-71a8-4903-a138-89bb15239ab4.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_1cda1121" /F3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_1cda1121" /XML "C:\Users\Admin\AppData\Local\Temp\b7a1e355-4983-4da9-83c8-14e5aea3847e.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Q: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" R: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" R: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" S: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" T: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" U: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" V: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" W: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" X: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Y: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Y: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /S3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Q: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" R: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" R: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" S: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" T: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" U: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" V: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" W: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" X: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Y: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Y: /D3⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" Y: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Q: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" S: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" T: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" U: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" V: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" W: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" X: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Y: /D2⤵
-
-
C:\Windows\Realtek.exeC:\Windows\Realtek.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\Realtek.exe"C:\Windows\Realtek.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes & exit2⤵
-
C:\Windows\System32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Realtek.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_b0c5ad4d" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_b0c5ad4d" /XML "C:\Users\Admin\AppData\Local\Temp\a452a699-a691-48ac-b0c4-5811f3582050.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_3276292c" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_3276292c" /XML "C:\Users\Admin\AppData\Local\Temp\4f75243e-84fe-4ea4-b630-fb3bad395759.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_f0bc2772" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_f0bc2772" /XML "C:\Users\Admin\AppData\Local\Temp\714c78b6-3a29-4700-9289-3f88b41e9379.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D2⤵
-
-
C:\Windows\Realtek.exe"C:\Windows\Realtek.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes & exit2⤵
-
C:\Windows\System32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Realtek.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Realtek.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_e981ac98" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_e981ac98" /XML "C:\Users\Admin\AppData\Local\Temp\99fd99dc-13ad-4149-b2aa-ac102fb6023e.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_4152cae9" /F2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyRefreshTask_4152cae9" /XML "C:\Users\Admin\AppData\Local\Temp\af12e463-eb55-41e7-b9f8-5443547f5fa1.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_0d051da9" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_0d051da9" /XML "C:\Users\Admin\AppData\Local\Temp\e55d500d-6776-40ad-b06d-ab93c4bcbc6f.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D2⤵
-
-
C:\Windows\Realtek.exeC:\Windows\Realtek.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\Realtek.exeC:\Windows\Realtek.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
7Windows Service
7Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
7Windows Service
7Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
7Disable or Modify System Firewall
2Disable or Modify Tools
4Modify Registry
8Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
aae0f6c6806840749b12b738d5b01e89.dll
db97b0e8-0a96-4d71-8154-84d95476458c.xml
Realtek.exe
dberr.txt
memory/952-56-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/1316-85-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/1352-40-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/1516-296-0x00000181B4D20000-0x00000181B4D4B000-memory.dmp
memory/1516-298-0x00000181B4D20000-0x00000181B4D4B000-memory.dmp
memory/1516-299-0x00000181B4D20000-0x00000181B4D4B000-memory.dmp
memory/1516-290-0x00000181B4D20000-0x00000181B4D4B000-memory.dmp
memory/1516-297-0x00000181B4D20000-0x00000181B4D4B000-memory.dmp
memory/1516-295-0x00000181B4D20000-0x00000181B4D4B000-memory.dmp
memory/1556-35-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/1600-102-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/1860-2341-0x0000028316B50000-0x0000028316BB8000-memory.dmp
memory/2000-131-0x0000022EBB940000-0x0000022EBB96B000-memory.dmp
memory/2000-142-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/2000-130-0x0000022EBB620000-0x0000022EBB645000-memory.dmp
memory/2000-132-0x0000022EBB940000-0x0000022EBB96B000-memory.dmp
memory/2000-141-0x0000022EBB940000-0x0000022EBB96B000-memory.dmp
memory/2000-139-0x0000022EBB940000-0x0000022EBB96B000-memory.dmp
memory/2000-140-0x0000022EBB940000-0x0000022EBB96B000-memory.dmp
memory/2000-138-0x0000022EBB940000-0x0000022EBB96B000-memory.dmp
memory/2000-137-0x0000022EBB940000-0x0000022EBB96B000-memory.dmp
memory/2156-26-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/2292-91-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/2908-72-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/3116-60-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/3132-52-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/3140-30-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/3228-64-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/3232-410-0x000001F7D45D0000-0x000001F7D4638000-memory.dmp
memory/3488-81-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/3496-250-0x0000000001170000-0x0000000001171000-memory.dmp
memory/3496-19-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/3652-122-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/3700-68-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/4408-44-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/4444-116-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/4500-48-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/5224-127-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/5240-108-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/5248-266-0x00007FF649C90000-0x00007FF649CCE000-memory.dmp
memory/5248-265-0x00000132555A0000-0x00000132555CB000-memory.dmp
memory/5248-260-0x00000132555A0000-0x00000132555CB000-memory.dmp
memory/5248-258-0x00000132555A0000-0x00000132555CB000-memory.dmp
memory/5248-253-0x00000132555A0000-0x00000132555CB000-memory.dmp
memory/5248-259-0x00000132555A0000-0x00000132555CB000-memory.dmp
memory/5248-261-0x00000132555A0000-0x00000132555CB000-memory.dmp
memory/5248-263-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/5248-262-0x00000132555A0000-0x00000132555CB000-memory.dmp
memory/5264-77-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/5440-275-0x00000257243D0000-0x00000257243FB000-memory.dmp
memory/5440-277-0x00000257243D0000-0x00000257243FB000-memory.dmp
memory/5440-270-0x00000257243D0000-0x00000257243FB000-memory.dmp
memory/5440-276-0x00000257243D0000-0x00000257243FB000-memory.dmp
memory/5440-280-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/5440-279-0x00000257243D0000-0x00000257243FB000-memory.dmp
memory/5440-278-0x00000257243D0000-0x00000257243FB000-memory.dmp
memory/5440-287-0x00007FF649C90000-0x00007FF649CCE000-memory.dmp
memory/5440-286-0x00000257243D0000-0x00000257243FB000-memory.dmp
memory/5508-2051-0x0000029266180000-0x00000292661E8000-memory.dmp
memory/5532-157-0x00007FFAC08E0000-0x00007FFAC0B43000-memory.dmp
memory/5532-158-0x00007FFABF310000-0x00007FFABF3D7000-memory.dmp
memory/5532-159-0x00007FFABE3B0000-0x00007FFABE751000-memory.dmp
memory/5624-11-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-411-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-10-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-9-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-8-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-12-0x00007FFAC08E0000-0x00007FFAC0B43000-memory.dmp
memory/5624-1-0x00007FFA9D87F000-0x00007FFA9D880000-memory.dmp
memory/5624-13-0x00007FFABF310000-0x00007FFABF3D7000-memory.dmp
memory/5624-14-0x00007FFABE3B0000-0x00007FFABE751000-memory.dmp
memory/5624-7-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-6-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-5-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-4-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-3-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-2-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-15-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp
memory/5624-0-0x0000013E59DB0000-0x0000013E59E18000-memory.dmp
memory/5624-239-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/6032-97-0x00007FFA80A20000-0x00007FFA80A30000-memory.dmp
memory/6468-2529-0x0000026988EF0000-0x0000026988F58000-memory.dmp
memory/6880-2683-0x000002B544940000-0x000002B5449A8000-memory.dmp