Analysis
- max time kernel
180s - max time network
364s - platform
windows11-21h2_x64 - resource
win11-20240214-en - resource tags
- submitted
20/02/2024, 04:08
General
- Target LDPlayer9_ens_com.mojang.minecraftpe_3040_ld.exe
- Size 3.3MB
- Sample240220-eqlqgaaf7v
- SHA256 c753c236d5e600472ebcea1112d3c9099336a595eb1178532ed8d5ff16555f2a
Malware Config
Signatures
- Creates new service(s) 1 TTPs
- Manipulates Digital Signatures 1 TTPs 64 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Possible privilege escalation attempt 6 IoCs
- Modifies file permissions 1 TTPs 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Executes dropped EXE 21 IoCs
- Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Registers COM server for autorun 1 TTPs 23 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 4 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 16 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.mojang.minecraftpe_3040_ld.exe"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.mojang.minecraftpe_3040_ld.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM dnplayer.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM dnmultiplayer.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM dnmultiplayerex.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM bugreport.exe /T2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\LDPlayer\LDPlayer9\LDPlayer.exe"C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=3040 -language=en -path="C:\LDPlayer\LDPlayer9\"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\LDPlayer\LDPlayer9\dnrepairer.exe"C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=7866903⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"net" start cryptsvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start cryptsvc5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32" Softpub.dll /s4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32" Wintrust.dll /s4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32" Initpki.dll /s4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" Initpki.dll /s4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32" dssenh.dll /s4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32" rsaenh.dll /s4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32" cryptdlg.dll /s4⤵
- Manipulates Digital Signatures
-
-
C:\Windows\SysWOW64\takeown.exe"takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SysWOW64\takeown.exe"takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SysWOW64\dism.exeC:\Windows\system32\dism.exe /Online /English /Get-Features4⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\9C5B600C-BE71-417A-82D9-5BB44B3DEFC3\dismhost.exeC:\Users\Admin\AppData\Local\Temp\9C5B600C-BE71-417A-82D9-5BB44B3DEFC3\dismhost.exe {F250A2C5-EB09-4BCA-AA82-8DAC071F780E}5⤵
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\sc.exesc query HvHost4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc query vmms4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc query vmcompute4⤵
- Launches sc.exe
-
-
C:\Program Files\ldplayer9box\Ld9BoxSVC.exe"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\regsvr32.exe"regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s4⤵
-
-
C:\Windows\SYSTEM32\regsvr32.exe"regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s4⤵
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc" start Ld9BoxSup4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow4⤵
-
-
-
C:\Windows\SysWOW64\takeown.exe"takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\LDPlayer\LDPlayer9\driverconfig.exe"C:\LDPlayer\LDPlayer9\driverconfig.exe"3⤵
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\LDPlayer\LDPlayer9\dnplayer.exe"C:\LDPlayer\LDPlayer9\\dnplayer.exe" downloadpackage=com.mojang.minecraftpe|package=com.mojang.minecraftpe2⤵
-
C:\Windows\SysWOW64\sc.exesc query HvHost3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc query vmms3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc query vmcompute3⤵
- Launches sc.exe
-
-
C:\Program Files\ldplayer9box\vbox-img.exe"C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb000000003⤵
-
-
C:\Program Files\ldplayer9box\vbox-img.exe"C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-0000000000003⤵
-
-
C:\Program Files\ldplayer9box\vbox-img.exe"C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-0000000000003⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ldplayer.net/blog/how-to-enable-vt.html3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffa1fb83cb8,0x7ffa1fb83cc8,0x7ffa1fb83cd84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:14⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7980 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8808 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,16984793328529797575,4880741278749973657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8768 /prefetch:14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\saBSI.exe"C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true saBsiVersion=4.1.1.818 CountryCode=GB /no_self_update2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe"C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade3⤵
-
C:\Program Files\McAfee\Temp4049099880\installer.exe"C:\Program Files\McAfee\Temp4049099880\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\sc.exesc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"5⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"6⤵
- Loads dropped DLL
-
-
-
C:\Windows\SYSTEM32\sc.exesc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service"5⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
C:\Windows\SYSTEM32\sc.exesc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//05⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SYSTEM32\sc.exesc.exe start "McAfee WebAdvisor"5⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe"C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:operagx --launchopera=01⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exeC:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=97.0.4719.84 --initial-client-data=0x310,0x318,0x31c,0x314,0x320,0x6e8bb3f0,0x6e8bb400,0x6e8bb40c2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe" --version2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe"C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1572 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240220041058" --session-guid=f1966144-4087-4048-86ff-8c1eb5fe1255 --server-tracking-blob=MDgyNTU2NDdmZDIxZjdkMzJjNDUwNjE0OWI1MmQ1M2M2YzIzNzI2ZjViMTEzYjllYzM0OWJmNjg2YjM1NWEyNzp7ImNvdW50cnkiOiJJTCIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9YWlzJnV0bV9tZWRpdW09YXBiIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjgyNDA4MzY5Ljg4ODUiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTEyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvcGVyYWd4IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiYWlzIn0sInV1aWQiOiI2M2ZkNTRmNy0xZjBiLTQ0NDEtYmNjOC05ZTI0YzFjZDM3ZjAifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7C050000000000002⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exeC:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=97.0.4719.84 --initial-client-data=0x304,0x308,0x30c,0x2e0,0x314,0x6ddfb3f0,0x6ddfb400,0x6ddfb40c3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402200410581\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402200410581\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402200410581\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402200410581\assistant\assistant_installer.exe" --version2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402200410581\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402200410581\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x864f48,0x864f58,0x864f643⤵
- Executes dropped EXE
-
-
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
-
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000474 0x00000000000004D01⤵
-
C:\Program Files\ldplayer9box\Ld9BoxSVC.exe"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding1⤵
-
C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config2⤵
-
-
C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config2⤵
-
-
C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config2⤵
-
-
C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config2⤵
-
-
C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config2⤵
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
LDPlayer.exe
LDPlayer.exe
MSVCR120.dll
crashreport.dll
dnmultiplayer.exe
dnplayer.exe
dnrepairer.exe
dnrepairer.exe
dnresource.rcc
NotoSans-Regular.otf
Roboto-Regular.otf
7za.exe
cximagecrt.dll
dnresource.rcc
libcrypto-1_1.dll
libcurl.dll
libeay32.dll
libssh2.dll
libssl-1_1.dll
msvcp110.dll
msvcr110.dll
ssleay32.dll
msvcp120.dll
msvcr120.dll
sdcard.vmdk
msvcp120.dll
msvcr120.dll
analyticsmanager.cab
browserhost.cab
browserplugin.cab
downloadscan.cab
eventmanager.cab
installer.exe
l10n.cab
logicmodule.cab
logicscripts.cab
lookupmanager.cab
mfw-mwb.cab
mfw-nps.cab
mfw-webadvisor.cab
mfw.cab
resourcedll.cab
servicehost.cab
settingmanager.cab
taskmanager.cab
telemetry.cab
uihost.cab
uimanager.cab
uninstaller.cab
updater.cab
wataskmanager.cab
webadvisor.cab
wssdep.cab
dataConfig.cab
wssdep.dll
wssdep.dll
AnalyticsManager000.log
AnalyticsManager000.log
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
installer.exe
installer.exe
saBSI.exe
saBSI.exe
settings.dat
f_000027
f_000030
f_000033
the-real-index
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Secure Preferences
TransportSecurity
TransportSecurity
TransportSecurity~RFe5cbb87.TMP
CURRENT
CURRENT
Local State
Local State
Local State
OperaGXSetup.exe
additional_file0.tmp
opera_package
OperaGXSetup.exe
OperaGXSetup.exe
OperaGXSetup.exe
OperaGXSetup.exe
OperaGXSetup.exe
OperaGXSetup.exe
saBSI.exe
saBSI.exe
Opera_installer_2402200410576331572.dll
Opera_installer_2402200410578683508.dll
Opera_installer_2402200410582291616.dll
Opera_installer_2402200410582291616.dll
Opera_installer_2402200410587111840.dll
Opera_installer_2402200410588991892.dll
ds.dll
__PSScriptPolicyTest_gvsk5exa.33z.ps1
settings.dat
ldopengl32x.dll
dism.log
memory/1432-3005-0x000000007FA60000-0x000000007FA70000-memory.dmp
memory/1432-2922-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/1432-2921-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/1432-3011-0x000000006CF70000-0x000000006CFBC000-memory.dmp
memory/1432-3280-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/1432-2920-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/1572-61-0x0000000000C30000-0x0000000001209000-memory.dmp
memory/1572-128-0x0000000000C30000-0x0000000001209000-memory.dmp
memory/1616-83-0x0000000000B30000-0x0000000001109000-memory.dmp
memory/1616-81-0x0000000000B30000-0x0000000001109000-memory.dmp
memory/1840-133-0x0000000000C30000-0x0000000001209000-memory.dmp
memory/1840-87-0x0000000000C30000-0x0000000001209000-memory.dmp
memory/1892-94-0x0000000000C30000-0x0000000001209000-memory.dmp
memory/2348-21-0x0000000009090000-0x00000000090D4000-memory.dmp
memory/2348-18-0x00000000085A0000-0x0000000008B46000-memory.dmp
memory/2348-42-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/2348-45-0x0000000005BD0000-0x0000000005BE0000-memory.dmp
memory/2348-26-0x0000000005BD0000-0x0000000005BE0000-memory.dmp
memory/2348-12-0x0000000005BD0000-0x0000000005BE0000-memory.dmp
memory/2348-25-0x00000000097A0000-0x00000000097AA000-memory.dmp
memory/2348-24-0x00000000097B0000-0x0000000009CDC000-memory.dmp
memory/2348-23-0x0000000009210000-0x0000000009276000-memory.dmp
memory/2348-22-0x0000000009170000-0x000000000920C000-memory.dmp
memory/2348-4095-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/2348-20-0x0000000008190000-0x0000000008222000-memory.dmp
memory/2348-16-0x0000000005A00000-0x0000000005A14000-memory.dmp
memory/2348-41-0x0000000005BD0000-0x0000000005BE0000-memory.dmp
memory/2348-19-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/2348-17-0x0000000073C00000-0x0000000073C14000-memory.dmp
memory/3508-129-0x0000000000C30000-0x0000000001209000-memory.dmp
memory/3508-70-0x0000000000C30000-0x0000000001209000-memory.dmp
memory/4572-386-0x00007FF78FDE0000-0x00007FF78FDF0000-memory.dmp
memory/4572-466-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-674-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-1331-0x00007FF78FDE0000-0x00007FF78FDF0000-memory.dmp
memory/4572-1332-0x00007FF78FDE0000-0x00007FF78FDF0000-memory.dmp
memory/4572-1337-0x00007FF78FDE0000-0x00007FF78FDF0000-memory.dmp
memory/4572-1369-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-1436-0x00007FF72CC50000-0x00007FF72CC60000-memory.dmp
memory/4572-715-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-1454-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-730-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-1445-0x00007FF791220000-0x00007FF791230000-memory.dmp
memory/4572-747-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-742-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-792-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-839-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-908-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-723-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-706-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-884-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-809-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-661-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-596-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-583-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-1392-0x00007FF791220000-0x00007FF791230000-memory.dmp
memory/4572-1386-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-566-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-437-0x00007FF72CC50000-0x00007FF72CC60000-memory.dmp
memory/4572-795-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-487-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-755-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-495-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-783-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-759-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-520-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-777-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-580-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-589-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-626-0x00007FF786FF0000-0x00007FF787000000-memory.dmp
memory/4572-633-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-666-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-671-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-297-0x00007FF78FDE0000-0x00007FF78FDF0000-memory.dmp
memory/4572-1061-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-387-0x00007FF78FDE0000-0x00007FF78FDF0000-memory.dmp
memory/4572-389-0x00007FF78FDE0000-0x00007FF78FDF0000-memory.dmp
memory/4572-405-0x00007FF791220000-0x00007FF791230000-memory.dmp
memory/4572-525-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-570-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-557-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-543-0x00007FF745460000-0x00007FF745470000-memory.dmp
memory/4572-496-0x00007FF72CC50000-0x00007FF72CC60000-memory.dmp
memory/4572-388-0x00007FF78FDE0000-0x00007FF78FDF0000-memory.dmp
memory/4572-393-0x00007FF779720000-0x00007FF779730000-memory.dmp
memory/4572-456-0x00007FF791220000-0x00007FF791230000-memory.dmp
memory/4996-3292-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/4996-2974-0x00000000075B0000-0x00000000075CE000-memory.dmp
memory/4996-2861-0x0000000002DD0000-0x0000000002E06000-memory.dmp
memory/4996-2914-0x0000000006160000-0x00000000061C6000-memory.dmp
memory/4996-2916-0x00000000061D0000-0x0000000006527000-memory.dmp
memory/4996-3197-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/4996-3196-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/4996-3190-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/4996-2881-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/4996-2882-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/4996-2880-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/4996-2940-0x00000000065F0000-0x000000000660E000-memory.dmp
memory/4996-2946-0x0000000006680000-0x00000000066CC000-memory.dmp
memory/4996-2957-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/4996-2958-0x0000000007570000-0x00000000075A4000-memory.dmp
memory/4996-3074-0x0000000007C60000-0x0000000007C7A000-memory.dmp
memory/4996-2959-0x000000006CF70000-0x000000006CFBC000-memory.dmp
memory/4996-3073-0x0000000007B80000-0x0000000007B8E000-memory.dmp
memory/4996-3042-0x0000000007B40000-0x0000000007B51000-memory.dmp
memory/4996-3041-0x0000000007BC0000-0x0000000007C56000-memory.dmp
memory/4996-3020-0x00000000079B0000-0x00000000079BA000-memory.dmp
memory/4996-2874-0x00000000058C0000-0x0000000005EEA000-memory.dmp
memory/4996-2997-0x0000000007930000-0x000000000794A000-memory.dmp
memory/4996-2996-0x0000000007F80000-0x00000000085FA000-memory.dmp
memory/4996-2985-0x00000000075D0000-0x0000000007674000-memory.dmp
memory/4996-2905-0x0000000005F50000-0x0000000005F72000-memory.dmp
memory/5148-3127-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/5148-3128-0x0000000002620000-0x0000000002630000-memory.dmp
memory/5148-3537-0x0000000073340000-0x0000000073AF1000-memory.dmp
memory/5148-3134-0x0000000002620000-0x0000000002630000-memory.dmp
memory/5148-3213-0x000000007F430000-0x000000007F440000-memory.dmp
memory/5148-3214-0x000000006CF70000-0x000000006CFBC000-memory.dmp
memory/5268-4995-0x0000000076FC0000-0x00000000770B0000-memory.dmp
memory/5268-4153-0x0000000076FC0000-0x00000000770B0000-memory.dmp
memory/5268-4121-0x000000006F000000-0x000000006F024000-memory.dmp
memory/5268-4096-0x000000006CDE0000-0x000000006D031000-memory.dmp