Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 16:18
General
- Target 2026-07-05_22d0b07a69f1f00b5a655d63251d231e_amadey_cloudeye_darkgate_elex_glassworm_icedid.exe
- Size 2.2MB
- Sample260705-tsfpkadz2v
- SHA256 60021065d3576450ec76835687cfcac4b1d5cc4a08b4f528f6f4eb3b7c0fb2ec
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 4 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
- UAC bypass 3 TTPs 12 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 4 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 4 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 4 IoCs
- Executes dropped EXE 43 IoCs
- Loads dropped DLL 64 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies data under HKEY_USERS 14 IoCs
- Modifies registry class 7 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_22d0b07a69f1f00b5a655d63251d231e_amadey_cloudeye_darkgate_elex_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_22d0b07a69f1f00b5a655d63251d231e_amadey_cloudeye_darkgate_elex_glassworm_icedid.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Íà ïðîâó ÷èòîâ.exe"C:\Users\Admin\AppData\Local\Temp\Íà ïðîâó ÷èòîâ.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\12.exe" enable=yes & exit4⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\12.exe"C:\Users\Admin\AppData\Roaming\12.exe"4⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol I: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol I: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol J: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol J: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol K: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol K: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol L: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol L: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol M: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol M: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol N: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol N: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D6⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S5⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D5⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1032.x86-Setup.exe"C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1032.x86-Setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
98849e48-7fc1-4e23-8875-421ec02a078f.dll
Everything-1.4.1.1032.x86-Setup.exe
InstallOptions.dll
InstallOptions.ini
InstallOptions.ini
InstallOptions.ini
LangDLL.dll
Íà ïðîâó ÷èòîâ.exe
dberr.txt
memory/760-114-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/964-185-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/996-447-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/1040-260-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/1204-286-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/1324-180-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/1332-150-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/1436-461-0x00000208D4890000-0x00000208D48BB000-memory.dmp
memory/1436-468-0x00000208D4890000-0x00000208D48BB000-memory.dmp
memory/1436-467-0x00000208D4890000-0x00000208D48BB000-memory.dmp
memory/1436-466-0x00000208D4890000-0x00000208D48BB000-memory.dmp
memory/1456-242-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/1588-276-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/1604-266-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/1872-235-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/2060-228-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/2200-273-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/2256-226-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/2264-221-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/2396-274-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/2592-287-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/2716-172-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/2896-190-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3108-155-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3128-121-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3180-144-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3224-230-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3264-207-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3436-234-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3456-212-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3532-101-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3544-90-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3556-288-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3704-291-0x0000000003270000-0x0000000003271000-memory.dmp
memory/3704-96-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3712-142-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3892-298-0x00000274ED130000-0x00000274ED155000-memory.dmp
memory/3892-312-0x00000274ED050000-0x00000274ED0B2000-memory.dmp
memory/3892-307-0x00000274ED490000-0x00000274ED4BB000-memory.dmp
memory/3892-300-0x00000274ED490000-0x00000274ED4BB000-memory.dmp
memory/3892-310-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/3892-305-0x00000274ED490000-0x00000274ED4BB000-memory.dmp
memory/3892-306-0x00000274ED490000-0x00000274ED4BB000-memory.dmp
memory/3892-299-0x00000274ED490000-0x00000274ED4BB000-memory.dmp
memory/3892-308-0x00000274ED490000-0x00000274ED4BB000-memory.dmp
memory/3892-309-0x00000274ED490000-0x00000274ED4BB000-memory.dmp
memory/4108-117-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/4400-241-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/4448-169-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/4512-119-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/4600-251-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/5204-247-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/5304-103-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/5348-275-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/5360-278-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/5488-316-0x0000021509570000-0x0000021509571000-memory.dmp
memory/5488-292-0x0000021508E50000-0x0000021508E51000-memory.dmp
memory/5500-326-0x00007FFB229D0000-0x00007FFB22D71000-memory.dmp
memory/5500-325-0x00007FFB23750000-0x00007FFB23817000-memory.dmp
memory/5500-324-0x00007FFB251C0000-0x00007FFB25423000-memory.dmp
memory/6772-21-0x0000000000400000-0x0000000000638000-memory.dmp
memory/7132-271-0x00007FFAE5300000-0x00007FFAE5310000-memory.dmp
memory/7140-47-0x00007FFB23750000-0x00007FFB23817000-memory.dmp
memory/7140-41-0x00007FFB01D60000-0x00007FFB02704000-memory.dmp
memory/7140-44-0x00007FFB01D60000-0x00007FFB02704000-memory.dmp
memory/7140-46-0x00007FFB251C0000-0x00007FFB25423000-memory.dmp
memory/7140-45-0x00007FFB01D60000-0x00007FFB02704000-memory.dmp
memory/7140-295-0x00007FFB01D60000-0x00007FFB02704000-memory.dmp
memory/7140-42-0x00007FFB01D60000-0x00007FFB02704000-memory.dmp
memory/7140-48-0x00007FFB229D0000-0x00007FFB22D71000-memory.dmp
memory/7140-43-0x00007FFB01D60000-0x00007FFB02704000-memory.dmp
memory/7140-26-0x00007FFB01D60000-0x00007FFB02704000-memory.dmp
memory/7140-18-0x00007FFB01D60000-0x00007FFB02704000-memory.dmp
memory/7140-17-0x00007FFB01D60000-0x00007FFB02704000-memory.dmp
memory/7140-10-0x00000215D3D30000-0x00000215D3D92000-memory.dmp
memory/7140-15-0x00007FFB01EEF000-0x00007FFB01EF0000-memory.dmp