Analysis
- max time kernel
59s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 05:11
General
- Target x8e5f732c14ec30e0cc27d276b8cd68eead3e5704c4656341f870995b13b842ca.exe
- Size 374KB
- Sample260705-fvd2vsdv7r
- SHA256 8e5f732c14ec30e0cc27d276b8cd68eead3e5704c4656341f870995b13b842ca
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 4 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
- Modifies security service 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 12 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 40 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Enumerates connected drives 3 TTPs 56 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 4 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 14 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 63 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x8e5f732c14ec30e0cc27d276b8cd68eead3e5704c4656341f870995b13b842ca.exe"C:\Users\Admin\AppData\Local\Temp\x8e5f732c14ec30e0cc27d276b8cd68eead3e5704c4656341f870995b13b842ca.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- UAC bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\svchost.exe" enable=yes & exit3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /D4⤵
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
-
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /delete /F /TN "12"3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\mobsync.exeC:\Windows\System32\mobsync.exe -Embedding1⤵
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Indicator Removal
1Clear Windows Event Logs
1Modify Registry
8Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
FB0D848F74F70BB2EAA93746D24D9749
prep_Activatable Class_Hermes_perf.cache
80db963f-acf2-4038-a044-29495f7fbc64.dll
12.exe
dberr.txt
memory/744-62-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/956-86-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1032-573-0x000001C6AA680000-0x000001C6AA6E2000-memory.dmp
memory/1036-166-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1108-85-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1252-140-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1280-193-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1360-40-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1372-33-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1556-76-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1648-149-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1824-191-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/1920-194-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/2204-189-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/2228-176-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/2268-118-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/2304-83-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/2564-190-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/2820-153-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/2824-175-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/2996-2-0x00007FFEBE840000-0x00007FFEBF1E4000-memory.dmp
memory/2996-7-0x00007FFEBE840000-0x00007FFEBF1E4000-memory.dmp
memory/2996-12-0x00007FFEBE840000-0x00007FFEBF1E4000-memory.dmp
memory/2996-11-0x00007FFEDEF30000-0x00007FFEDF2D1000-memory.dmp
memory/2996-9-0x00007FFEE1660000-0x00007FFEE18C3000-memory.dmp
memory/2996-746-0x00007FFEBE840000-0x00007FFEBF1E4000-memory.dmp
memory/2996-4-0x00007FFEBE840000-0x00007FFEBF1E4000-memory.dmp
memory/2996-6-0x00007FFEBE840000-0x00007FFEBF1E4000-memory.dmp
memory/2996-1-0x00007FFEBE9CF000-0x00007FFEBE9D0000-memory.dmp
memory/2996-8-0x00007FFEBE840000-0x00007FFEBF1E4000-memory.dmp
memory/2996-10-0x00007FFEE1320000-0x00007FFEE13E7000-memory.dmp
memory/2996-5-0x00007FFEBE840000-0x00007FFEBF1E4000-memory.dmp
memory/2996-3-0x00007FFEBE840000-0x00007FFEBF1E4000-memory.dmp
memory/2996-0-0x00000226C8D10000-0x00000226C8D72000-memory.dmp
memory/3028-177-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3076-105-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3184-184-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3476-192-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3492-77-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3500-24-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3500-214-0x0000000003830000-0x0000000003831000-memory.dmp
memory/3596-167-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3676-187-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3688-103-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3704-102-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3716-60-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3772-188-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3872-130-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3912-226-0x0000010E2B7F0000-0x0000010E2B81B000-memory.dmp
memory/3912-225-0x0000010E2B7F0000-0x0000010E2B81B000-memory.dmp
memory/3912-224-0x0000010E2B7F0000-0x0000010E2B81B000-memory.dmp
memory/3912-230-0x0000010E2B540000-0x0000010E2B5A2000-memory.dmp
memory/3912-223-0x0000010E2B7F0000-0x0000010E2B81B000-memory.dmp
memory/3912-218-0x0000010E2B7F0000-0x0000010E2B81B000-memory.dmp
memory/3912-228-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/3912-227-0x0000010E2B7F0000-0x0000010E2B81B000-memory.dmp
memory/4384-119-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/4440-108-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/4516-30-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/4720-38-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/5184-101-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/5360-178-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/5524-258-0x000001A749DB0000-0x000001A749DDB000-memory.dmp
memory/5524-251-0x000001A749DB0000-0x000001A749DDB000-memory.dmp
memory/5524-256-0x000001A749DB0000-0x000001A749DDB000-memory.dmp
memory/5524-257-0x000001A749DB0000-0x000001A749DDB000-memory.dmp
memory/5524-259-0x000001A749DB0000-0x000001A749DDB000-memory.dmp
memory/5816-201-0x000001C42B9B0000-0x000001C42B9DB000-memory.dmp
memory/5816-208-0x000001C42B9B0000-0x000001C42B9DB000-memory.dmp
memory/5816-200-0x000001C42B6A0000-0x000001C42B6C5000-memory.dmp
memory/5816-207-0x000001C42B9B0000-0x000001C42B9DB000-memory.dmp
memory/5816-209-0x000001C42B9B0000-0x000001C42B9DB000-memory.dmp
memory/5816-210-0x000001C42B9B0000-0x000001C42B9DB000-memory.dmp
memory/5816-211-0x000001C42B9B0000-0x000001C42B9DB000-memory.dmp
memory/5816-212-0x00007FFEA17A0000-0x00007FFEA17B0000-memory.dmp
memory/5816-202-0x000001C42B9B0000-0x000001C42B9DB000-memory.dmp
memory/6116-231-0x000001F14D8E0000-0x000001F14D8E1000-memory.dmp