Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 10:36
General
- Target x479xdoy1zzw27g5 (1).exe
- Size 375KB
- Sample260804-mnn2tahf64
- SHA256 55b251d15b2e00c05b8bc2c52ccaedecb3819879a39b4ec9d2105ddd3b805ac1
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 3 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Modifies security service 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 8 IoCs
- Executes dropped EXE 38 IoCs
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 4 IoCs
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies data under HKEY_USERS 57 IoCs
- Modifies registry class 9 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x479xdoy1zzw27g5 (1).exe"C:\Users\Admin\AppData\Local\Temp\x479xdoy1zzw27g5 (1).exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- UAC bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Loads dropped DLL
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\xdwdDefeneder.exe" enable=yes & exit3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Windows\xdwdDefeneder.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "12" /tr "C:\Windows\xdwdDefeneder.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol I: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol I: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol J: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D3⤵
- Loads dropped DLL
-
C:\Windows\system32\mountvol.exemountvol M: /D4⤵
- Loads dropped DLL
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol U: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D3⤵
- Loads dropped DLL
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol U: /D4⤵
- Loads dropped DLL
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\mountvol.exemountvol V: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol E: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\mountvol.exemountvol L: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\mountvol.exemountvol N: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\mountvol.exemountvol P: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\mountvol.exemountvol T: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol X: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D4⤵
- Enumerates connected drives
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
-
C:\Windows\xdwdDefeneder.exeC:\Windows\xdwdDefeneder.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "msegde" /tr "C:\Program Files\xdwdDefeneder" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "msegde" /tr "C:\Program Files\xdwdDefeneder" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
- Loads dropped DLL
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
- Loads dropped DLL
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Modify Registry
6Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
12.exe
5a006aa6-49a9-4402-bd06-032a8d23a078.dll
dberr.txt
memory/556-237-0x0000000000FA0000-0x0000000000FA1000-memory.dmp
memory/556-19-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/748-41-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/956-59-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1028-190-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1308-108-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1520-81-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1572-22-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1664-165-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2000-214-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2016-208-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2144-49-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2200-216-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2208-210-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2272-119-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2480-110-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2508-8-0x00007FFD0EBC0000-0x00007FFD0EF61000-memory.dmp
memory/2508-6-0x00007FFD11240000-0x00007FFD114A3000-memory.dmp
memory/2508-0-0x000001F8773E0000-0x000001F877442000-memory.dmp
memory/2508-1-0x00007FFCEE58F000-0x00007FFCEE590000-memory.dmp
memory/2508-263-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/2508-517-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/2508-12-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/2508-238-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/2508-7-0x00007FFD101F0000-0x00007FFD102B7000-memory.dmp
memory/2508-5-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/2508-4-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/2508-3-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/2508-2-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/2672-117-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2984-197-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3200-203-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3396-178-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3460-135-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3548-217-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3604-187-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3624-189-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3632-146-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3640-53-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3792-255-0x000001CD477F0000-0x000001CD477F1000-memory.dmp
memory/3840-153-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4076-96-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4372-204-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4428-137-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4492-60-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4604-163-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4812-188-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4944-78-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4976-168-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/5044-284-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/5252-289-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/5260-93-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/5668-247-0x000001D92B0B0000-0x000001D92B0DB000-memory.dmp
memory/5668-249-0x000001D92B0B0000-0x000001D92B0DB000-memory.dmp
memory/5668-618-0x000001D92D030000-0x000001D92D03C000-memory.dmp
memory/5668-290-0x00007FFD11240000-0x00007FFD114A3000-memory.dmp
memory/5668-291-0x00007FFD101F0000-0x00007FFD102B7000-memory.dmp
memory/5668-254-0x000001D92AC80000-0x000001D92ACE2000-memory.dmp
memory/5668-242-0x000001D92B0B0000-0x000001D92B0DB000-memory.dmp
memory/5668-248-0x000001D92B0B0000-0x000001D92B0DB000-memory.dmp
memory/5668-252-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/5668-251-0x000001D92B0B0000-0x000001D92B0DB000-memory.dmp
memory/5668-250-0x000001D92B0B0000-0x000001D92B0DB000-memory.dmp
memory/6280-231-0x00000244A9D20000-0x00000244A9D4B000-memory.dmp
memory/6280-235-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/6280-223-0x00000244A9BF0000-0x00000244A9C15000-memory.dmp
memory/6280-232-0x00000244A9D20000-0x00000244A9D4B000-memory.dmp
memory/6280-224-0x00000244A9D20000-0x00000244A9D4B000-memory.dmp
memory/6280-233-0x00000244A9D20000-0x00000244A9D4B000-memory.dmp
memory/6280-234-0x00000244A9D20000-0x00000244A9D4B000-memory.dmp
memory/6280-230-0x00000244A9D20000-0x00000244A9D4B000-memory.dmp
memory/6280-225-0x00000244A9D20000-0x00000244A9D4B000-memory.dmp
memory/6380-288-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/6424-54-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/6796-171-0x00007FFCD08C0000-0x00007FFCD08D0000-memory.dmp
memory/7076-91-0x00007FFD1139F000-0x00007FFD113A0000-memory.dmp
memory/7076-46-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/7076-97-0x00007FFD11240000-0x00007FFD114A3000-memory.dmp
memory/7076-2353-0x00007FFD11240000-0x00007FFD114A3000-memory.dmp