Analysis
- max time kernel
36s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 20:52
General
- Target 2026-08-08_17a2aedc8f4145d9453847fa52256602_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 396KB
- Sample260808-znw4msvbnb
- SHA256 bb62439ef702cdeb86fdabe19e74559181553d9a21c82578e5ebc896cb36c448
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 7 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 5 IoCs
- Modifies security service 2 TTPs 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- UAC bypass 3 TTPs 20 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 7 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 7 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 7 IoCs
- Executes dropped EXE 42 IoCs
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 10 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 58 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 15 IoCs
- Drops file in Windows directory 3 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 16 IoCs
- Modifies registry class 50 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 28 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 30 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_17a2aedc8f4145d9453847fa52256602_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_17a2aedc8f4145d9453847fa52256602_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- UAC bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_cc8be8e1" /F3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_cc8be8e1" /XML "C:\Users\Admin\AppData\Local\Temp\895101d7-bea5-4e6b-84c7-06910df6c243.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S4⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_4fd91b82" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_4fd91b82" /XML "C:\Users\Admin\AppData\Local\Temp\efdc1c67-0d5d-47db-9c85-cc7355113a4e.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_f55eef40" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_f55eef40" /XML "C:\Users\Admin\AppData\Local\Temp\160ce2fd-1785-4256-8c05-3e50806ab8ef.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe" enable=yes & exit3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "Runtime Broker" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Runtime Broker"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "Runtime Broker" /tr "C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "Runtime Broker" /tr "C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S3⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S4⤵
-
-
-
C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe"C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_7fbe656d" /F4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_7fbe656d" /XML "C:\Users\Admin\AppData\Local\Temp\ae43a085-5058-4063-adfb-d9f0d9a42fd3.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_b626ebde" /F4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_b626ebde" /XML "C:\Users\Admin\AppData\Local\Temp\8552b784-a531-4d13-b725-3b6f303b365b.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_6b2c2b93" /F4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_6b2c2b93" /XML "C:\Users\Admin\AppData\Local\Temp\524e2035-d674-4e98-aa7c-97dad0658dee.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\MicrosoftEdgeCP.exe"C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\MicrosoftEdgeCP.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "Runtime Broker" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /delete /F /TN "Runtime Broker"3⤵
-
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_4b4ccef4" /F2⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\BootFiles\BootExecutor.exe" /RL HIGHEST & exit2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\BootFiles\BootExecutor.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\StartMenuExperienceHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\StartMenuExperienceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e45f73bc" /F2⤵
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e45f73bc" /XML "C:\Users\Admin\AppData\Local\Temp\36e220ea-279a-4a24-b10b-a9c40ca94407.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4b475466" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4b475466" /XML "C:\Users\Admin\AppData\Local\Temp\5d22dd54-58fe-4f8b-9b06-51ae429a906f.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_52390bde" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_52390bde" /XML "C:\Users\Admin\AppData\Local\Temp\82d0a8df-9394-4646-a972-02538c68156f.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\System32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exeC:\Windows\IdentityCRL\production\WlidSvcGroupconfig.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "ProgramDataUpdater_254a7cc7" /F2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "Runtime Broker" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Runtime Broker"3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\BootFiles\BootExecutor.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\BootFiles\BootExecutor.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "ProgramDataUpdater_254a7cc7" /XML "C:\Users\Admin\AppData\Local\Temp\127683e8-87c3-45d9-942b-e4b3f39796f5.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_9d52ec17" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_9d52ec17" /XML "C:\Users\Admin\AppData\Local\Temp\3659cf1a-1a15-4461-a0dd-e16b43e01076.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_2bc8b949" /F2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_2bc8b949" /XML "C:\Users\Admin\AppData\Local\Temp\a416e1db-dd32-4489-beeb-b5feaeecea26.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\BootFiles\BootExecutor.exeC:\Windows\BootFiles\BootExecutor.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_ba2a7d64" /F2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_ba2a7d64" /XML "C:\Users\Admin\AppData\Local\Temp\f780dafd-2624-48a4-acf5-b5773d21ab8e.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_d3490893" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_d3490893" /XML "C:\Users\Admin\AppData\Local\Temp\85cc70b6-1ad9-44db-bacd-fabd00def074.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.RulesEngine.AppXgphnekvm0vv49drvfehh4b6kyf6ckafp.mca1⤵
- Modifies registry class
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:WebExperienceHost.AppXt2rk6m02ana976jna04hdq35jfnzy7f7.mca1⤵
- Modifies registry class
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:OobeHost.AppXdcwkjpb46w3zw4hbmx5jfxajhymjka0d.mca1⤵
- Modifies registry class
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Modify Registry
6Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
FB0D848F74F70BB2EAA93746D24D9749
d1a94fa8-adb1-4106-a625-12dabf9f6908.dll
Boot.exe
dberr.txt
memory/556-26-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/704-314-0x00000273E0E40000-0x00000273E0EA8000-memory.dmp
memory/748-51-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/956-64-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1028-190-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1308-108-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1492-264-0x0000029E2DBF0000-0x0000029E2DC1B000-memory.dmp
memory/1492-267-0x0000029E2D9A0000-0x0000029E2DA08000-memory.dmp
memory/1492-265-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1492-263-0x0000029E2DBF0000-0x0000029E2DC1B000-memory.dmp
memory/1492-261-0x0000029E2DBF0000-0x0000029E2DC1B000-memory.dmp
memory/1492-262-0x0000029E2DBF0000-0x0000029E2DC1B000-memory.dmp
memory/1492-260-0x0000029E2DBF0000-0x0000029E2DC1B000-memory.dmp
memory/1492-255-0x0000029E2DBF0000-0x0000029E2DC1B000-memory.dmp
memory/1520-102-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1572-49-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/1664-148-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2000-213-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2016-191-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2144-53-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2200-212-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2208-211-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2272-184-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2480-104-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2560-293-0x000001F5C4360000-0x000001F5C438B000-memory.dmp
memory/2560-292-0x000001F5C4360000-0x000001F5C438B000-memory.dmp
memory/2560-291-0x000001F5C4360000-0x000001F5C438B000-memory.dmp
memory/2560-290-0x000001F5C4360000-0x000001F5C438B000-memory.dmp
memory/2560-285-0x000001F5C4360000-0x000001F5C438B000-memory.dmp
memory/2672-162-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/2984-225-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3200-189-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3396-214-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3460-187-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3548-224-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3604-153-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3624-188-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3632-185-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3640-66-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/3840-176-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4076-106-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4372-222-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4492-92-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4604-192-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4812-196-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4824-7-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-5-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-1-0x0000029D85D10000-0x0000029D85D78000-memory.dmp
memory/4824-2-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-971-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-701-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-3-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-320-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-4-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-299-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-6-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-8-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-9-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-10-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-11-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-12-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4824-13-0x00007FFD11240000-0x00007FFD114A3000-memory.dmp
memory/4824-0-0x00007FFCEE58F000-0x00007FFCEE590000-memory.dmp
memory/4824-14-0x00007FFD101F0000-0x00007FFD102B7000-memory.dmp
memory/4824-15-0x00007FFD0EBC0000-0x00007FFD0EF61000-memory.dmp
memory/4824-16-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/4856-970-0x00000225238E0000-0x0000022523948000-memory.dmp
memory/4944-62-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/4976-164-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/5228-629-0x00000119FED90000-0x00000119FEDF8000-memory.dmp
memory/5260-101-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/5608-273-0x000002C44EA10000-0x000002C44EA11000-memory.dmp
memory/5608-243-0x000002C44EA00000-0x000002C44EA01000-memory.dmp
memory/6424-55-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/6468-68-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/6480-90-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/6796-182-0x00007FFCD08C0000-0x00007FFCD08D0000-memory.dmp
memory/7028-238-0x000002243C650000-0x000002243C67B000-memory.dmp
memory/7028-237-0x000002243C650000-0x000002243C67B000-memory.dmp
memory/7028-239-0x000002243C650000-0x000002243C67B000-memory.dmp
memory/7028-242-0x000002243C1F0000-0x000002243C258000-memory.dmp
memory/7028-229-0x000002243C650000-0x000002243C67B000-memory.dmp
memory/7028-236-0x000002243C650000-0x000002243C67B000-memory.dmp
memory/7028-227-0x000002243C2D0000-0x000002243C2F5000-memory.dmp
memory/7028-240-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp
memory/7028-230-0x000002243C650000-0x000002243C67B000-memory.dmp
memory/7028-235-0x000002243C650000-0x000002243C67B000-memory.dmp