Overview

overview

10

Static

static

10

2026-07-22...id.exe

windows10-2004-x64

10

2026-07-22...id.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 22:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
  • Size 420KB
  • Sample260722-2ecprawdle
  • SHA256 7ec31b49fc75424db7021eef455074b7b33121be6b268c6215b06521d3732caf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasionexecutionsheetratpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat Payload 4 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 12 IoCs
    defense_evasiontrojan
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 4 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 4 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 4 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 16 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 7 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 18 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • UAC bypass
    • Registers new Windows logon scripts automatically executed at logon.
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1804
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6032
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3456
    • C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" E: /S
      2⤵
        PID:5304
      • C:\Windows\SYSTEM32\sc.exe
        "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
        2⤵
        • Launches sc.exe
        PID:5784
      • C:\Windows\SYSTEM32\sc.exe
        "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
        2⤵
        • Launches sc.exe
        PID:5072
      • C:\Windows\SYSTEM32\sc.exe
        "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
        2⤵
        • Launches sc.exe
        PID:4744
      • C:\Windows\SYSTEM32\mountvol.exe
        "mountvol" E: /D
        2⤵
          PID:1724
        • C:\Windows\SYSTEM32\mountvol.exe
          "mountvol" F: /S
          2⤵
            PID:1284
          • C:\Windows\SYSTEM32\mountvol.exe
            "mountvol" F: /D
            2⤵
              PID:984
            • C:\Windows\SYSTEM32\mountvol.exe
              "mountvol" G: /S
              2⤵
                PID:3520
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks.exe" /Delete /TN "FamilySafetyMonitor_156cd548" /F
                2⤵
                  PID:6012
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks.exe" /Create /TN "FamilySafetyMonitor_156cd548" /XML "C:\Users\Admin\AppData\Local\Temp\c4fb7fd8-1792-4aec-8160-eca844727e94.xml" /F
                  2⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3420
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd" /c schtasks /create /f /sc minute /mo 14 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5600
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /f /sc minute /mo 14 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2912
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_196141e4" /F
                  2⤵
                    PID:2940
                  • C:\Windows\SYSTEM32\CMD.exe
                    "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
                    2⤵
                      PID:4612
                    • C:\Windows\SYSTEM32\CMD.exe
                      "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
                      2⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2560
                      • C:\Windows\system32\schtasks.exe
                        schtasks /delete /F /TN "Holy Check"
                        3⤵
                          PID:4380
                      • C:\Windows\SYSTEM32\schtasks.exe
                        "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_196141e4" /XML "C:\Users\Admin\AppData\Local\Temp\3ff69af8-e690-4c99-a30e-aab3f0dd86ad.xml" /F
                        2⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:1524
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3452
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:5712
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3684
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:5652
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:2864
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:4224
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:2256
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:2420
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:2812
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:6132
                      • C:\Windows\SYSTEM32\mountvol.exe
                        "mountvol" G: /D
                        2⤵
                        • Enumerates connected drives
                        PID:3876
                      • C:\Windows\SYSTEM32\schtasks.exe
                        "schtasks.exe" /Delete /TN "StartupAppTask_44594807" /F
                        2⤵
                          PID:1500
                        • C:\Windows\SYSTEM32\mountvol.exe
                          "mountvol" H: /S
                          2⤵
                            PID:3036
                          • C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                            "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3888
                          • C:\Windows\SYSTEM32\schtasks.exe
                            "schtasks.exe" /Create /TN "StartupAppTask_44594807" /XML "C:\Users\Admin\AppData\Local\Temp\b18dea44-55eb-45f1-ae3d-c9e61d29c2fa.xml" /F
                            2⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:2984
                        • C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
                          C:\Users\Admin\AppData\Local\Temp\2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
                          1⤵
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5316
                        • C:\Windows\System32\BootFiles\BootExecutor.exe
                          C:\Windows\System32\BootFiles\BootExecutor.exe
                          1⤵
                          • Modifies Windows Defender DisableAntiSpyware settings
                          • UAC bypass
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:1156
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit
                            2⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:2684
                            • C:\Windows\system32\netsh.exe
                              netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes
                              3⤵
                              • Modifies Windows Firewall
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:5832
                          • C:\Windows\SYSTEM32\mountvol.exe
                            "mountvol" E: /S
                            2⤵
                              PID:5144
                            • C:\Windows\SYSTEM32\sc.exe
                              "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                              2⤵
                              • Launches sc.exe
                              PID:4536
                            • C:\Windows\SYSTEM32\sc.exe
                              "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                              2⤵
                              • Launches sc.exe
                              PID:4284
                            • C:\Windows\SYSTEM32\sc.exe
                              "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                              2⤵
                              • Launches sc.exe
                              PID:5168
                            • C:\Windows\SYSTEM32\schtasks.exe
                              "schtasks.exe" /Delete /TN "FamilySafetyMonitor_6d03f620" /F
                              2⤵
                                PID:5260
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks.exe" /Create /TN "FamilySafetyMonitor_6d03f620" /XML "C:\Users\Admin\AppData\Local\Temp\f188771a-042d-465f-8025-824981c3f2c3.xml" /F
                                2⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:672
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_bb8ee263" /F
                                2⤵
                                  PID:2448
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  "schtasks.exe" /Create /TN "Intel PTT EK Recertification_bb8ee263" /XML "C:\Users\Admin\AppData\Local\Temp\2fde8a42-b1bf-4d82-9e41-472f3f83f654.xml" /F
                                  2⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5076
                                  • C:\Windows\System32\Conhost.exe
                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    3⤵
                                      PID:4224
                                  • C:\Windows\SYSTEM32\mountvol.exe
                                    "mountvol" E: /D
                                    2⤵
                                    • Enumerates connected drives
                                    PID:5836
                                  • C:\Windows\SYSTEM32\mountvol.exe
                                    "mountvol" F: /S
                                    2⤵
                                      PID:6012
                                    • C:\Windows\SYSTEM32\schtasks.exe
                                      "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_3c7ac5ad" /F
                                      2⤵
                                        PID:5752
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_3c7ac5ad" /XML "C:\Users\Admin\AppData\Local\Temp\3de0301c-568c-4009-9df5-c74fd2ec1799.xml" /F
                                        2⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3224
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        "schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_50142c36" /F
                                        2⤵
                                          PID:4540
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          "schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_50142c36" /XML "C:\Users\Admin\AppData\Local\Temp\4cd7d4c2-e6d5-48aa-b47b-30187f22b15f.xml" /F
                                          2⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4536
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_15a3a6a3" /F
                                          2⤵
                                            PID:4856
                                          • C:\Windows\SYSTEM32\mountvol.exe
                                            "mountvol" F: /D
                                            2⤵
                                            • Enumerates connected drives
                                            PID:3716
                                          • C:\Windows\SYSTEM32\mountvol.exe
                                            "mountvol" G: /S
                                            2⤵
                                              PID:3464
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              "schtasks.exe" /Create /TN "Intel PTT EK Recertification_15a3a6a3" /XML "C:\Users\Admin\AppData\Local\Temp\b773e9bd-cb11-4eb0-a9f7-705703e6386e.xml" /F
                                              2⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4992
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              "schtasks.exe" /Delete /TN "UsbCeip_f19706d6" /F
                                              2⤵
                                                PID:2820
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                "schtasks.exe" /Create /TN "UsbCeip_f19706d6" /XML "C:\Users\Admin\AppData\Local\Temp\dd08ff8f-e7c6-4f13-945a-784b30a4c2a1.xml" /F
                                                2⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4312
                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                "mountvol" G: /D
                                                2⤵
                                                • Enumerates connected drives
                                                PID:5784
                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                "mountvol" H: /S
                                                2⤵
                                                  PID:252
                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                  "mountvol" H: /D
                                                  2⤵
                                                    PID:2292
                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                    "mountvol" I: /S
                                                    2⤵
                                                      PID:1164
                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                      "mountvol" I: /D
                                                      2⤵
                                                      • Enumerates connected drives
                                                      PID:5816
                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                      "mountvol" J: /S
                                                      2⤵
                                                        PID:1232
                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                        "mountvol" J: /D
                                                        2⤵
                                                        • Enumerates connected drives
                                                        PID:4948
                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                        "mountvol" K: /S
                                                        2⤵
                                                          PID:5616
                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                          "mountvol" K: /D
                                                          2⤵
                                                          • Enumerates connected drives
                                                          PID:3944
                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                          "mountvol" L: /S
                                                          2⤵
                                                            PID:3336
                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                            "mountvol" L: /D
                                                            2⤵
                                                            • Enumerates connected drives
                                                            PID:5536
                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                            "mountvol" M: /S
                                                            2⤵
                                                              PID:596
                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                              "mountvol" M: /D
                                                              2⤵
                                                              • Enumerates connected drives
                                                              PID:672
                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                              "mountvol" N: /S
                                                              2⤵
                                                                PID:2880
                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                "mountvol" N: /D
                                                                2⤵
                                                                  PID:4624
                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                  "mountvol" O: /S
                                                                  2⤵
                                                                    PID:2012
                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                    "mountvol" O: /D
                                                                    2⤵
                                                                    • Enumerates connected drives
                                                                    PID:544
                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                    "mountvol" P: /S
                                                                    2⤵
                                                                      PID:6012
                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                      "mountvol" P: /D
                                                                      2⤵
                                                                      • Enumerates connected drives
                                                                      PID:5284
                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                      "mountvol" Q: /S
                                                                      2⤵
                                                                        PID:4436
                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                        "mountvol" Q: /D
                                                                        2⤵
                                                                        • Enumerates connected drives
                                                                        PID:5220
                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                        "mountvol" R: /S
                                                                        2⤵
                                                                          PID:256
                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                          "mountvol" R: /D
                                                                          2⤵
                                                                          • Enumerates connected drives
                                                                          PID:888
                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                          "mountvol" S: /S
                                                                          2⤵
                                                                            PID:1552
                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                            "mountvol" S: /D
                                                                            2⤵
                                                                            • Enumerates connected drives
                                                                            PID:932
                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                            "mountvol" T: /S
                                                                            2⤵
                                                                              PID:2096
                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                              "mountvol" T: /D
                                                                              2⤵
                                                                              • Enumerates connected drives
                                                                              PID:1196
                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                              "mountvol" U: /S
                                                                              2⤵
                                                                                PID:5712
                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                "mountvol" U: /D
                                                                                2⤵
                                                                                • Enumerates connected drives
                                                                                PID:4312
                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                "mountvol" V: /S
                                                                                2⤵
                                                                                  PID:1308
                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                  "mountvol" V: /D
                                                                                  2⤵
                                                                                    PID:4224
                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                    "mountvol" W: /S
                                                                                    2⤵
                                                                                      PID:2272
                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                      "mountvol" W: /D
                                                                                      2⤵
                                                                                      • Enumerates connected drives
                                                                                      PID:5804
                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                      "mountvol" X: /S
                                                                                      2⤵
                                                                                        PID:4156
                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                        "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
                                                                                        2⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:4964
                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                          schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
                                                                                          3⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:5740
                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                        "mountvol" X: /D
                                                                                        2⤵
                                                                                          PID:1200
                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                          "mountvol" Y: /S
                                                                                          2⤵
                                                                                            PID:3896
                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                            "mountvol" Y: /D
                                                                                            2⤵
                                                                                            • Enumerates connected drives
                                                                                            PID:4624
                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                            "mountvol" E: /S
                                                                                            2⤵
                                                                                              PID:3944
                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                              "mountvol" E: /D
                                                                                              2⤵
                                                                                              • Enumerates connected drives
                                                                                              PID:1232
                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                              "mountvol" F: /S
                                                                                              2⤵
                                                                                                PID:2292
                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                "mountvol" F: /D
                                                                                                2⤵
                                                                                                • Enumerates connected drives
                                                                                                PID:2396
                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                "mountvol" G: /S
                                                                                                2⤵
                                                                                                  PID:1644
                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                  "mountvol" G: /D
                                                                                                  2⤵
                                                                                                  • Enumerates connected drives
                                                                                                  PID:5304
                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                  "mountvol" H: /S
                                                                                                  2⤵
                                                                                                    PID:4164
                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                    "mountvol" H: /D
                                                                                                    2⤵
                                                                                                    • Enumerates connected drives
                                                                                                    PID:3316
                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                    "mountvol" I: /S
                                                                                                    2⤵
                                                                                                      PID:1248
                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                      "mountvol" I: /D
                                                                                                      2⤵
                                                                                                      • Enumerates connected drives
                                                                                                      PID:2096
                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                      "mountvol" J: /S
                                                                                                      2⤵
                                                                                                        PID:2592
                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                        "mountvol" J: /D
                                                                                                        2⤵
                                                                                                        • Enumerates connected drives
                                                                                                        PID:5616
                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                        "mountvol" K: /S
                                                                                                        2⤵
                                                                                                          PID:5076
                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                          "mountvol" K: /D
                                                                                                          2⤵
                                                                                                          • Enumerates connected drives
                                                                                                          PID:1196
                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                          "mountvol" L: /S
                                                                                                          2⤵
                                                                                                            PID:3172
                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                            "mountvol" L: /D
                                                                                                            2⤵
                                                                                                            • Enumerates connected drives
                                                                                                            PID:1936
                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                            "mountvol" M: /S
                                                                                                            2⤵
                                                                                                              PID:5300
                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                              "mountvol" M: /D
                                                                                                              2⤵
                                                                                                              • Enumerates connected drives
                                                                                                              PID:4216
                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                              "mountvol" N: /S
                                                                                                              2⤵
                                                                                                                PID:300
                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                "mountvol" N: /D
                                                                                                                2⤵
                                                                                                                • Enumerates connected drives
                                                                                                                PID:2040
                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                "mountvol" O: /S
                                                                                                                2⤵
                                                                                                                  PID:3760
                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                  "mountvol" O: /D
                                                                                                                  2⤵
                                                                                                                    PID:6012
                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                    "mountvol" P: /S
                                                                                                                    2⤵
                                                                                                                      PID:4136
                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                      "mountvol" P: /D
                                                                                                                      2⤵
                                                                                                                        PID:4364
                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                        "mountvol" Q: /S
                                                                                                                        2⤵
                                                                                                                          PID:2328
                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                          "mountvol" Q: /D
                                                                                                                          2⤵
                                                                                                                            PID:5420
                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                            "mountvol" R: /S
                                                                                                                            2⤵
                                                                                                                              PID:5440
                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                              "mountvol" R: /D
                                                                                                                              2⤵
                                                                                                                                PID:1644
                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                "mountvol" S: /S
                                                                                                                                2⤵
                                                                                                                                  PID:2940
                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                  "mountvol" S: /D
                                                                                                                                  2⤵
                                                                                                                                    PID:5876
                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                    "mountvol" T: /S
                                                                                                                                    2⤵
                                                                                                                                      PID:4492
                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                      "mountvol" T: /D
                                                                                                                                      2⤵
                                                                                                                                      • Enumerates connected drives
                                                                                                                                      PID:2512
                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                      "mountvol" U: /S
                                                                                                                                      2⤵
                                                                                                                                        PID:5396
                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                        "mountvol" U: /D
                                                                                                                                        2⤵
                                                                                                                                        • Enumerates connected drives
                                                                                                                                        PID:484
                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                        "mountvol" V: /S
                                                                                                                                        2⤵
                                                                                                                                          PID:5784
                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                          "mountvol" V: /D
                                                                                                                                          2⤵
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          PID:1304
                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                          "mountvol" W: /S
                                                                                                                                          2⤵
                                                                                                                                            PID:1500
                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                            "mountvol" W: /D
                                                                                                                                            2⤵
                                                                                                                                              PID:1724
                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                              "mountvol" X: /S
                                                                                                                                              2⤵
                                                                                                                                                PID:1196
                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                "mountvol" X: /D
                                                                                                                                                2⤵
                                                                                                                                                  PID:4960
                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                  "mountvol" Y: /S
                                                                                                                                                  2⤵
                                                                                                                                                    PID:300
                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                    "mountvol" Y: /D
                                                                                                                                                    2⤵
                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                    PID:5560
                                                                                                                                                • C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                                                                                                  C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                  • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                  • UAC bypass
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:2752
                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:1720
                                                                                                                                                    • C:\Windows\system32\netsh.exe
                                                                                                                                                      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                      PID:3356
                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                    "mountvol" E: /S
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5580
                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                      "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                      2⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:5712
                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                      "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                      2⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:5320
                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                      "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                                                                                                                                                      2⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:2968
                                                                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                      "schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_bcde0b60" /F
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4420
                                                                                                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                        "schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_bcde0b60" /XML "C:\Users\Admin\AppData\Local\Temp\672eaced-f1ad-4a00-acb3-b8544f4f87f7.xml" /F
                                                                                                                                                        2⤵
                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                        PID:5604
                                                                                                                                                      • C:\Windows\SYSTEM32\CMD.exe
                                                                                                                                                        "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:4588
                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2984
                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                            schtasks /delete /F /TN "Holy Check"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1940
                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                            "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:1544
                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                              schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
                                                                                                                                                              3⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:5628
                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                            "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:5064
                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                              schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
                                                                                                                                                              3⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:5552
                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                            "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:3616
                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                              schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
                                                                                                                                                              3⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:5856
                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                            "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:4864
                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                              schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
                                                                                                                                                              3⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:4112
                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                            "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_bab7a9aa" /F
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1304
                                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                              "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_bab7a9aa" /XML "C:\Users\Admin\AppData\Local\Temp\71b23991-561c-41bb-88d6-b6f75dc21d10.xml" /F
                                                                                                                                                              2⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:4908
                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                              "mountvol" E: /D
                                                                                                                                                              2⤵
                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                              PID:4380
                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                              "mountvol" F: /S
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1368
                                                                                                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                "schtasks.exe" /Delete /TN "UsbCeip_2172fa18" /F
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1500
                                                                                                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                  "schtasks.exe" /Create /TN "UsbCeip_2172fa18" /XML "C:\Users\Admin\AppData\Local\Temp\29ac8827-17ac-4749-ae21-767a8878a5d1.xml" /F
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                  PID:5284
                                                                                                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                  "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_cf04e280" /F
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4436
                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                    "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_cf04e280" /XML "C:\Users\Admin\AppData\Local\Temp\53abbb19-f002-4e92-9125-7f2c7a3a7a7a.xml" /F
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                    PID:5496
                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                    "mountvol" F: /D
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                    PID:4420
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5580
                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                      "mountvol" G: /S
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4684
                                                                                                                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                        "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_4f3d2c75" /F
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5948
                                                                                                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                          "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_4f3d2c75" /XML "C:\Users\Admin\AppData\Local\Temp\022936d8-9716-4fc3-9d5a-21828dfab679.xml" /F
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                          PID:5264
                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                          "mountvol" G: /D
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                          PID:3536
                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                          "mountvol" H: /S
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2808
                                                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                            "mountvol" H: /D
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4364
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5168
                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                "mountvol" I: /S
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1928
                                                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                  "mountvol" I: /D
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:6048
                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                    "mountvol" J: /S
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2328
                                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                      "mountvol" J: /D
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                      PID:4152
                                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                      "mountvol" K: /S
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3592
                                                                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                        "mountvol" K: /D
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                        PID:2940
                                                                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                        "mountvol" L: /S
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2408
                                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                          "mountvol" L: /D
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                          PID:4844
                                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                          "mountvol" M: /S
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5300
                                                                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                            "mountvol" M: /D
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                            PID:4348
                                                                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                            "mountvol" N: /S
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4700
                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                              "mountvol" N: /D
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                              PID:860
                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                              "mountvol" O: /S
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1000
                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                "mountvol" O: /D
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                PID:4540
                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                "mountvol" P: /S
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5372
                                                                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                  "mountvol" P: /D
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3448
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                    "mountvol" Q: /S
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3368
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                      "mountvol" Q: /D
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      PID:3172
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                      "mountvol" R: /S
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4560
                                                                                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                        "mountvol" R: /D
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                        PID:3708
                                                                                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                        "mountvol" S: /S
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5420
                                                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                          "mountvol" S: /D
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:756
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                            "mountvol" T: /S
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                              "mountvol" T: /D
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                              PID:944
                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                              "mountvol" U: /S
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5752
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                "mountvol" U: /D
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                "mountvol" V: /S
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5604
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                  "mountvol" V: /D
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                  "mountvol" W: /S
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                    "mountvol" W: /D
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                    PID:5440
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                    "mountvol" X: /S
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3020
                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                      "mountvol" X: /D
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2636
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                        "mountvol" Y: /S
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1228
                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                          "mountvol" Y: /D
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                          PID:2916
                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                          "mountvol" E: /S
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6060
                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                            "mountvol" E: /D
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                            PID:5836
                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                            "mountvol" F: /S
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1500
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                              "mountvol" F: /D
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                              PID:3448
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                              "mountvol" G: /S
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:4700
                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                "mountvol" G: /D
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                "mountvol" H: /S
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:356
                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                  "mountvol" H: /D
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                  "mountvol" I: /S
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4688
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                    "mountvol" I: /D
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                    PID:5384
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                    "mountvol" J: /S
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:2068
                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                      "mountvol" J: /D
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1368
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                        "mountvol" K: /S
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:5740
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                          "mountvol" K: /D
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:2916
                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                            "mountvol" L: /S
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2472
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                              "mountvol" L: /D
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                              PID:4292
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                              "mountvol" M: /S
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:4632
                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                "mountvol" M: /D
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4320
                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                  "mountvol" N: /S
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                    "mountvol" N: /D
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                    PID:5840
                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                    "mountvol" O: /S
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                      "mountvol" O: /D
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                      "mountvol" P: /S
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:4948
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                        "mountvol" P: /D
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                        "mountvol" Q: /S
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:5560
                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                          "mountvol" Q: /D
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:5836
                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                            "mountvol" R: /S
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:3316
                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                              "mountvol" R: /D
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                              PID:1368
                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                              "mountvol" S: /S
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:860
                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                "mountvol" S: /D
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                  "mountvol" T: /S
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:4604
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                    "mountvol" T: /D
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                    "mountvol" U: /S
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:4208
                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                      "mountvol" U: /D
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1968
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                        "mountvol" V: /S
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:5580
                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                          "mountvol" V: /D
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:5744
                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                            "mountvol" W: /S
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:6048
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                              "mountvol" W: /D
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                              PID:3020
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                              "mountvol" X: /S
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                                "mountvol" X: /D
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                                "mountvol" Y: /S
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:5440
                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\mountvol.exe
                                                                                                                                                                                                                                                                                  "mountvol" Y: /D
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                  PID:2592
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ApplicationFrameHost.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ApplicationFrameHost.exe"
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Badlisted process makes network request
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                PID:4992

                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                                                    Windows Command Shell

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1059.003

                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                                                                    System Services

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1569

                                                                                                                                                                                                                                                                                    Service Execution

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1569.002

                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                    Winlogon Helper DLL

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1547.004

                                                                                                                                                                                                                                                                                    Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1037

                                                                                                                                                                                                                                                                                    Logon Script (Windows)

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1037.001

                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1546.007

                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                    Winlogon Helper DLL

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1547.004

                                                                                                                                                                                                                                                                                    Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1037

                                                                                                                                                                                                                                                                                    Logon Script (Windows)

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1037.001

                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1546.007

                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                                                                    Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1562.004

                                                                                                                                                                                                                                                                                    Disable or Modify Tools

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1562.001

                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                    Service Stop

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1489

                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                    022936d8-9716-4fc3-9d5a-21828dfab679.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\022936d8-9716-4fc3-9d5a-21828dfab679.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 4d180449bda2a6ac896e8cd0971ab779989c88611bf43362c9e57573ad3c6dae
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    29ac8827-17ac-4749-ae21-767a8878a5d1.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\29ac8827-17ac-4749-ae21-767a8878a5d1.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 f5b30412ffb636b93be1edcd42fe9bddf2ce0e49dfea3728d708c39f9e581e60
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    2fde8a42-b1bf-4d82-9e41-472f3f83f654.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2fde8a42-b1bf-4d82-9e41-472f3f83f654.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 a62b51f3ebaa4049b1e56899ca345a887f25535257d7e53254589a5cd083be33
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    3de0301c-568c-4009-9df5-c74fd2ec1799.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3de0301c-568c-4009-9df5-c74fd2ec1799.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 11732e763352e1d2b5ce778a8239a0493dca1a212fab01154fe4f889ab261922
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    3ff69af8-e690-4c99-a30e-aab3f0dd86ad.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3ff69af8-e690-4c99-a30e-aab3f0dd86ad.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 eaa168662b4076060ad0fcb28e1a423c4a180e7fb4100e52b9cd69ba54073359
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    4cd7d4c2-e6d5-48aa-b47b-30187f22b15f.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\4cd7d4c2-e6d5-48aa-b47b-30187f22b15f.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 1e99076fbbcf8e6c3fedde81d4c56d829f89b7612d352c00d378ce95fc3dd630
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    4e25c41a52984737bb1093dc62a5ec08.dll
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\4e25c41a52984737bb1093dc62a5ec08.dll
                                                                                                                                                                                                                                                                                    • Size 147KB
                                                                                                                                                                                                                                                                                    • SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    53abbb19-f002-4e92-9125-7f2c7a3a7a7a.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\53abbb19-f002-4e92-9125-7f2c7a3a7a7a.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 6ca13c14a7faa1cf0932688a55352fda4d00b9f4378e5ad9f799c8ee6994e92d
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    672eaced-f1ad-4a00-acb3-b8544f4f87f7.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\672eaced-f1ad-4a00-acb3-b8544f4f87f7.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 53f124be48b551e75a2efe8182a8b8d01a11e17857a7d2ed7168656df6e26890
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    71b23991-561c-41bb-88d6-b6f75dc21d10.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\71b23991-561c-41bb-88d6-b6f75dc21d10.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 b9b56df5d59ff99ee61ac187673d311f4aba113fc528dc74b335a53334a251af
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    b18dea44-55eb-45f1-ae3d-c9e61d29c2fa.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\b18dea44-55eb-45f1-ae3d-c9e61d29c2fa.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 8d2711e8cda61280042862eecd998d5f19081ae247fe19d6b5a38cdceb970402
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    b773e9bd-cb11-4eb0-a9f7-705703e6386e.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\b773e9bd-cb11-4eb0-a9f7-705703e6386e.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 5df8d79e62984dae91fe8d5d4429f3456f5b4dc700c773e9df5516259ff4cee5
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    c4fb7fd8-1792-4aec-8160-eca844727e94.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c4fb7fd8-1792-4aec-8160-eca844727e94.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 bfa819798bb001ed44da6539196596ab77afd9cb179a7d143da9f8cc6648df20
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    dd08ff8f-e7c6-4f13-945a-784b30a4c2a1.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd08ff8f-e7c6-4f13-945a-784b30a4c2a1.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 5d53dfa645fa2aa4470076b538060767691ba0a8c2e78ab2e6bf53e4b1c5604f
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    f188771a-042d-465f-8025-824981c3f2c3.xml
                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\f188771a-042d-465f-8025-824981c3f2c3.xml
                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                    • SHA256 17ce9270fc10b46e947232ab0542f5f08d327b8df2dab4d29f4a1174c7aeb4b4
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    BootExecutor.exe
                                                                                                                                                                                                                                                                                    • Path C:\Windows\System32\BootFiles\BootExecutor.exe
                                                                                                                                                                                                                                                                                    • Size 420KB
                                                                                                                                                                                                                                                                                    • SHA256 7ec31b49fc75424db7021eef455074b7b33121be6b268c6215b06521d3732caf
                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                    memory/1156-94-0x00007FFCCE790000-0x00007FFCCEB31000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-92-0x00007FFCCFB80000-0x00007FFCCFC47000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-49-0x000001A4D2930000-0x000001A4D2955000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-62-0x000001A4D2CA0000-0x000001A4D2CCB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-63-0x00007FFC90F20000-0x00007FFC90F30000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-65-0x000001A4D2850000-0x000001A4D28BE000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-91-0x00007FFCD0DE0000-0x00007FFCD1043000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-58-0x000001A4D2CA0000-0x000001A4D2CCB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-61-0x000001A4D2CA0000-0x000001A4D2CCB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-59-0x000001A4D2CA0000-0x000001A4D2CCB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-53-0x000001A4D2CA0000-0x000001A4D2CCB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-52-0x000001A4D2CA0000-0x000001A4D2CCB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1156-60-0x000001A4D2CA0000-0x000001A4D2CCB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-26-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-48-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-1-0x00007FFCAE0EF000-0x00007FFCAE0F0000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-2-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-3-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-4-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-5-0x00007FFCD0DE0000-0x00007FFCD1043000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-6-0x00007FFCCFB80000-0x00007FFCCFC47000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-8-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-66-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-89-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-7-0x00007FFCCE790000-0x00007FFCCEB31000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-67-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/1804-0-0x00000167F6F30000-0x00000167F6F9E000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-93-0x00007FFCD0DE0000-0x00007FFCD1043000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-87-0x000001B27CE80000-0x000001B27CEEE000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-84-0x000001B27D2C0000-0x000001B27D2EB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-83-0x000001B27D2C0000-0x000001B27D2EB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-85-0x00007FFC90F20000-0x00007FFC90F30000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-82-0x000001B27D2C0000-0x000001B27D2EB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-96-0x00007FFCCE790000-0x00007FFCCEB31000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-95-0x00007FFCCFB80000-0x00007FFCCFC47000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-75-0x000001B27D2C0000-0x000001B27D2EB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-80-0x000001B27D2C0000-0x000001B27D2EB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/2752-81-0x000001B27D2C0000-0x000001B27D2EB000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/3404-12-0x00007FFC90F20000-0x00007FFC90F30000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/3404-43-0x0000000003BA0000-0x0000000003BA1000-memory.dmp
                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                    memory/3404-42-0x0000000003B90000-0x0000000003B91000-memory.dmp
                                                                                                                                                                                                                                                                                    Download