Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 07:30
General
- Target 2026-11-01_d5643bf2da344daaff9d86a0c1cc2e74_amadey_darkgate_glassworm_icedid.exe
- Size 19.0MB
- Sample261102-jb73daas3p
- SHA256 5a6d35a355a8d82ce3754cb4b6c777eb57eee46358fd6f1d99d0ebda90e27757
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 3 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 4 IoCs
- Modifies security service 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 16 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 3 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 3 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 3 IoCs
- Executes dropped EXE 41 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 8 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 12 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies data under HKEY_USERS 15 IoCs
- Modifies registry class 9 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of UnmapMainImage 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 24 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_d5643bf2da344daaff9d86a0c1cc2e74_amadey_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_d5643bf2da344daaff9d86a0c1cc2e74_amadey_darkgate_glassworm_icedid.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\12.exe" enable=yes & exit3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Loads dropped DLL
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Users\Admin\AppData\Roaming\WindowsControl\WindowsControlW.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Users\Admin\AppData\Roaming\WindowsControl\WindowsControlW.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol I: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol I: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol J: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol J: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol K: /S4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\12.exe"C:\Users\Admin\AppData\Roaming\12.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
- Enumerates connected drives
-
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsControl\WindowsControlW.exeC:\Users\Admin\AppData\Roaming\WindowsControl\WindowsControlW.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Process Injection
1Process Hollowing
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
4Disable or Modify Tools
3Indicator Removal
1Clear Windows Event Logs
1Modify Registry
6Pre-OS Boot
1Bootkit
1Process Injection
1Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
f75f1ed9-e75f-434d-9fad-3993a19f590d.dll
12
12
WindowsControlW
dberr.txt
memory/744-45-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/952-57-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/1032-197-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/1288-105-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/1320-110-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/1424-191-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/1476-198-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/1544-60-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/1932-61-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/1972-261-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/2036-138-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/2180-199-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/2268-128-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/2380-202-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/2476-87-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/2604-169-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/2716-280-0x0000000001520000-0x0000000001521000-memory.dmp
memory/2716-222-0x0000000003CF0000-0x0000000003CF1000-memory.dmp
memory/2716-27-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/2764-262-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/2980-195-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3060-93-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3124-56-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3356-193-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3452-109-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3592-200-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3640-187-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3676-264-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3684-196-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3696-69-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3712-58-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3816-263-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/3840-101-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/4172-176-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/4356-194-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/4408-132-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/4452-118-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/4580-624-0x0000018CFC610000-0x0000018CFC672000-memory.dmp
memory/4680-76-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/4796-179-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/4808-82-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/4884-285-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-294-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-1-0x00007FFEFB8BF000-0x00007FFEFB8C0000-memory.dmp
memory/4884-0-0x0000029417450000-0x00000294174B2000-memory.dmp
memory/4884-316-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-12-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-11-0x00007FFF1B9F0000-0x00007FFF1BD91000-memory.dmp
memory/4884-10-0x00007FFF1DC90000-0x00007FFF1DD57000-memory.dmp
memory/4884-9-0x00007FFF1E3C0000-0x00007FFF1E623000-memory.dmp
memory/4884-2-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-3-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-4-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-5-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-6-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-7-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4884-8-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4996-130-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/5268-117-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/5352-292-0x00007FF62D360000-0x00007FF62D36A000-memory.dmp
memory/5352-291-0x00000229620E0000-0x000002296210B000-memory.dmp
memory/5352-218-0x00000229620E0000-0x000002296210B000-memory.dmp
memory/5352-219-0x00000229620E0000-0x000002296210B000-memory.dmp
memory/5352-220-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/5352-209-0x00000229620E0000-0x000002296210B000-memory.dmp
memory/5352-208-0x0000022961FB0000-0x0000022961FD5000-memory.dmp
memory/5352-215-0x00000229620E0000-0x000002296210B000-memory.dmp
memory/5352-210-0x00000229620E0000-0x000002296210B000-memory.dmp
memory/5352-217-0x00000229620E0000-0x000002296210B000-memory.dmp
memory/5352-216-0x00000229620E0000-0x000002296210B000-memory.dmp
memory/5720-99-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/5840-306-0x000001A592A90000-0x000001A592ABB000-memory.dmp
memory/5840-307-0x000001A592A90000-0x000001A592ABB000-memory.dmp
memory/5840-305-0x000001A592A90000-0x000001A592ABB000-memory.dmp
memory/5840-304-0x000001A592A90000-0x000001A592ABB000-memory.dmp
memory/5840-299-0x000001A592A90000-0x000001A592ABB000-memory.dmp
memory/5840-311-0x000001A592660000-0x000001A5926C2000-memory.dmp
memory/5920-201-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp
memory/5944-188-0x00007FFEDE500000-0x00007FFEDE510000-memory.dmp