Analysis
- max time kernel
114s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 12:20
General
- Target Docpac.exe
- Size 4.2MB
- Sample260508-phtffsct3m
- SHA256 ce175cd1e1c2513fd569cc0a49b5097d1a8e2b0b5f6cf8d48ec70af3f36ae4a4
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 33 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 7 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks for any installed AV software in registry 1 TTPs 35 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 7 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 43 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 27 IoCs
- Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 39 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Kills process with taskkill 2 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 59 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Docpac.exe"C:\Users\Admin\AppData\Local\Temp\Docpac.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KFC59.tmp\agent.tmp"C:\Users\Admin\AppData\Local\Temp\is-KFC59.tmp\agent.tmp" /SL5="$A0242,3999367,56832,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\agent.exe" /VERYSILENT /norestart3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe"C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe" package.zip4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe"C:\Program Files (x86)\Advanced Monitoring Agent\unzip.exe"4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe"C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe" /autoinstall4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~2\ADVANC~1\downloads\FmPlugin\vcredist_x86.exe"C:\PROGRA~2\ADVANC~1\downloads\FmPlugin\vcredist_x86.exe" /install /quiet /norestart /log "C:\PROGRA~2\ADVANC~1\downloads\FmPlugin\..\..\vcredist_2019_x86.log"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{806321B3-54F4-4FA2-AC8B-4B721FE6F771}\.cr\vcredist_x86.exe"C:\Windows\Temp\{806321B3-54F4-4FA2-AC8B-4B721FE6F771}\.cr\vcredist_x86.exe" -burn.clean.room="C:\PROGRA~2\ADVANC~1\downloads\FmPlugin\vcredist_x86.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /install /quiet /norestart /log "C:\PROGRA~2\ADVANC~1\downloads\FmPlugin\..\..\vcredist_2019_x86.log"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{FA4A2BE6-06C2-4BC1-9C90-DEE0BF87A872}\.be\VC_redist.x86.exe"C:\Windows\Temp\{FA4A2BE6-06C2-4BC1-9C90-DEE0BF87A872}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{18240B33-CCDF-457D-981A-CC784DCF6AFB} {1C14355C-CC9A-4F20-84DE-2D4230DCE638} 46407⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\PROGRA~2\ADVANC~1\downloads\ScriptRunnerInstaller-2.98.2.2.exe"C:\PROGRA~2\ADVANC~1\downloads\ScriptRunnerInstaller-2.98.2.2.exe" /silent /log "C:\PROGRA~2\ADVANC~1\scriptrunner-installer-output.log" /norestart InstallPath="C:\PROGRA~2\ADVANC~1\ScriptRunner"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{2F0F8896-0C7F-4517-B4D7-7795EE4787F2}\.cr\ScriptRunnerInstaller-2.98.2.2.exe"C:\Windows\Temp\{2F0F8896-0C7F-4517-B4D7-7795EE4787F2}\.cr\ScriptRunnerInstaller-2.98.2.2.exe" -burn.clean.room="C:\PROGRA~2\ADVANC~1\downloads\ScriptRunnerInstaller-2.98.2.2.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /silent /log "C:\PROGRA~2\ADVANC~1\scriptrunner-installer-output.log" /norestart InstallPath="C:\PROGRA~2\ADVANC~1\ScriptRunner"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{7CD32BED-0E70-4855-96B6-D7B05327E235}\.be\ScriptRunner.Installer.exe"C:\Windows\Temp\{7CD32BED-0E70-4855-96B6-D7B05327E235}\.be\ScriptRunner.Installer.exe" -q -burn.elevated BurnPipe.{50CBAF10-6036-42AF-97CA-CFBFE7ADFDEC} {F84C24D7-3E19-41E4-ABBD-35FA899BB8AD} 63527⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe"C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 208D67631BC75140A81FE2FB7CF3154C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\\System32\taskkill.exe" /T /F /IM ScriptRunner.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6D24EEBD641E82CFD3D2ABA42FEB8D472⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\\System32\taskkill.exe" /T /F /IM ScriptRunner.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Program Files (x86)\Msp Agent\msp-agent-core.exe"C:\Program Files (x86)\Msp Agent\msp-agent-core.exe" -service=install2⤵
-
-
C:\ProgramData\Package Cache\{453ebf40-12e8-45ff-9b3f-05cd1a25e839}\ScriptRunner.Installer.exe"C:\ProgramData\Package Cache\{453ebf40-12e8-45ff-9b3f-05cd1a25e839}\ScriptRunner.Installer.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{453ebf40-12e8-45ff-9b3f-05cd1a25e839}\ScriptRunner.Installer.exe"C:\ProgramData\Package Cache\{453ebf40-12e8-45ff-9b3f-05cd1a25e839}\ScriptRunner.Installer.exe" /quiet /norestart /burn.log.append "C:\PROGRA~2\ADVANC~1\scriptrunner-installer-output.log" InstallPath=C:\PROGRA~2\ADVANC~1\ScriptRunner2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{453ebf40-12e8-45ff-9b3f-05cd1a25e839}\ScriptRunner.Installer.exe"C:\ProgramData\Package Cache\{453ebf40-12e8-45ff-9b3f-05cd1a25e839}\ScriptRunner.Installer.exe" -burn.clean.room="C:\ProgramData\Package Cache\{453ebf40-12e8-45ff-9b3f-05cd1a25e839}\ScriptRunner.Installer.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 /quiet /norestart /burn.log.append "C:\PROGRA~2\ADVANC~1\scriptrunner-installer-output.log" InstallPath=C:\PROGRA~2\ADVANC~1\ScriptRunner3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{453ebf40-12e8-45ff-9b3f-05cd1a25e839}\ScriptRunner.Installer.exe"C:\ProgramData\Package Cache\{453ebf40-12e8-45ff-9b3f-05cd1a25e839}\ScriptRunner.Installer.exe" -q -burn.elevated BurnPipe.{4FFB826F-6DCC-404D-8131-20D34E79EB81} {5F7045EC-4AFE-4C07-BB1D-9A1FAAA945F8} 70964⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe"C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe"1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~2\ADVANC~1\assetscan.exe"C:\PROGRA~2\ADVANC~1\assetscan.exe" -M SCAN2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\PROGRA~2\ADVANC~1\featureres\MSP_Connect.exe"C:\PROGRA~2\ADVANC~1\featureres\MSP_Connect.exe" /S /R /mspid af9bf5edf96de93ee095dcc819c54e53 /mspcountry LN_1_US2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Take Control Agent\BASupSrvc.exe"C:\Program Files (x86)\Take Control Agent\BASupSrvc.exe" /install /silent3⤵
- Sets service image path in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Take Control Agent\TCLauncherHelper.exe"C:\Program Files (x86)\Take Control Agent\TCLauncherHelper.exe" /register3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Take Control Agent\BASupSrvcCnfg.exe"C:\Program Files (x86)\Take Control Agent\BASupSrvcCnfg.exe" /register3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Take Control Agent\BASupSrvcCnfg.exeC:\Program Files (x86)\Take Control Agent\BASupSrvcCnfg.exe /silent4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Program Files (x86)\Take Control Agent\TCSettingsHlp.exe"C:\Program Files (x86)\Take Control Agent\TCSettingsHlp.exe" -a -i LOGICnow3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\PROGRA~2\ADVANC~1\featureres\PMESetup.exe"C:\PROGRA~2\ADVANC~1\featureres\PMESetup.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /CLOSEAPPLICATIONS /DIR="C:\PROGRA~2\ADVANC~1\patchman" /LOG="C:\PROGRA~2\ADVANC~1\feature_2_install.log"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemTemp\is-0Z1VDNC9XA.tmp\PMESetup.tmp"C:\Windows\SystemTemp\is-0Z1VDNC9XA.tmp\PMESetup.tmp" /SL5="$50066,9760698,938496,C:\Program Files (x86)\Advanced Monitoring Agent\featureres\PMESetup.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /CLOSEAPPLICATIONS /DIR="C:\PROGRA~2\ADVANC~1\patchman" /LOG="C:\PROGRA~2\ADVANC~1\feature_2_install.log"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" qdescription SolarWinds.MSP.PME.Agent.PmeService4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" qdescription SolarWinds.MSP.PME.Agent.PmeService4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" qdescription PME.Agent.PmeService4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" qdescription SolarWinds.MSP.RpcServerService4⤵
- Launches sc.exe
-
-
C:\PROGRA~2\ADVANC~1\patchman\Installers\RequestHandlerAgentSetup.exe"C:\PROGRA~2\ADVANC~1\patchman\Installers\RequestHandlerAgentSetup.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SKIPDOTNET=0 /DIR="C:\PROGRA~2\ADVANC~1\patchman\..\RequestHandlerAgent\" /LOG="C:\PROGRA~2\ADVANC~1\feature_2_install_RpcServer.log"4⤵
-
C:\Windows\SystemTemp\is-DCPCLVWCEB.tmp\RequestHandlerAgentSetup.tmp"C:\Windows\SystemTemp\is-DCPCLVWCEB.tmp\RequestHandlerAgentSetup.tmp" /SL5="$40076,4311083,938496,C:\Program Files (x86)\Advanced Monitoring Agent\patchman\Installers\RequestHandlerAgentSetup.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SKIPDOTNET=0 /DIR="C:\PROGRA~2\ADVANC~1\patchman\..\RequestHandlerAgent\" /LOG="C:\PROGRA~2\ADVANC~1\feature_2_install_RpcServer.log"5⤵
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\ProgramData\MspPlatform\RequestHandlerAgent\log" /remove:g *S-1-1-06⤵
- Modifies file permissions
-
-
C:\PROGRA~2\ADVANC~1\RequestHandlerAgent\RequestHandlerAgent.exe"C:\PROGRA~2\ADVANC~1\RequestHandlerAgent\RequestHandlerAgent" install6⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" failure "SolarWinds.MSP.RpcServerService" actions= restart/20000/restart/60000// reset= 2407⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" qdescription SolarWinds.MSP.RpcServerService6⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start SolarWinds.MSP.RpcServerService6⤵
- Launches sc.exe
-
-
-
-
C:\PROGRA~2\ADVANC~1\patchman\Installers\FileCacheServiceAgentSetup.exe"C:\PROGRA~2\ADVANC~1\patchman\Installers\FileCacheServiceAgentSetup.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SKIPDOTNET=0 /DIR="C:\PROGRA~2\ADVANC~1\patchman\..\FileCacheServiceAgent\" /APPLIANCEVERSION=2.13.14.5671 /LOG="C:\PROGRA~2\ADVANC~1\feature_2_install_FileCacheServiceAgent.log"4⤵
-
C:\Windows\SystemTemp\is-LM2L9O00GR.tmp\FileCacheServiceAgentSetup.tmp"C:\Windows\SystemTemp\is-LM2L9O00GR.tmp\FileCacheServiceAgentSetup.tmp" /SL5="$50076,2492682,938496,C:\Program Files (x86)\Advanced Monitoring Agent\patchman\Installers\FileCacheServiceAgentSetup.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SKIPDOTNET=0 /DIR="C:\PROGRA~2\ADVANC~1\patchman\..\FileCacheServiceAgent\" /APPLIANCEVERSION=2.13.14.5671 /LOG="C:\PROGRA~2\ADVANC~1\feature_2_install_FileCacheServiceAgent.log"5⤵
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\ProgramData\MspPlatform\FileCacheServiceAgent" /remove:g *S-1-5-32-5456⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\ProgramData\MspPlatform\FileCacheServiceAgent\log" /remove:g *S-1-1-06⤵
- Modifies file permissions
-
-
C:\PROGRA~2\ADVANC~1\FileCacheServiceAgent\FileCacheServiceAgent.exe"C:\PROGRA~2\ADVANC~1\FileCacheServiceAgent\FileCacheServiceAgent" install6⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" failure "SolarWinds.MSP.CacheService" actions= restart/20000/restart/60000// reset= 2407⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" qdescription SolarWinds.MSP.CacheService6⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start SolarWinds.MSP.CacheService6⤵
- Launches sc.exe
-
-
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\ProgramData\MspPlatform\PME\archives" /remove:g *S-1-1-04⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\ProgramData\MspPlatform\PME\Persistence" /remove:g *S-1-1-04⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\ProgramData\MspPlatform\PME\ThirdPartyPatch" /remove:g *S-1-1-04⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:\ProgramData\MspPlatform\PME\log" /remove:g *S-1-1-04⤵
- Modifies file permissions
-
-
C:\PROGRA~2\ADVANC~1\patchman\PME.Agent.exe"C:\PROGRA~2\ADVANC~1\patchman\PME.Agent.exe" install4⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" failure "PME.Agent.PmeService" actions= restart/20000/restart/60000// reset= 2405⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" qdescription PME.Agent.PmeService4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start PME.Agent.PmeService4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" qdescription SolarWinds.MSP.RpcServerService4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start SolarWinds.MSP.RpcServerService4⤵
- Launches sc.exe
-
-
-
-
C:\PROGRA~2\ADVANC~1\FmPlugin\fmplugin.exe"C:\PROGRA~2\ADVANC~1\FmPlugin\fmplugin.exe" 3894602 5bc39a03b2c9ff11556536f2a02c98e7 https://upload1.am.remote.management/2⤵
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i "C:\Program Files (x86)\Advanced Monitoring Agent\featureres\msp-agent-core.msi" /qn /l*v "C:\Program Files (x86)\Advanced Monitoring Agent\fusion_feature_install.log"2⤵
-
-
C:\Program Files (x86)\MSP Agent\msp-agent-core.exe"C:\Program Files (x86)\MSP Agent\msp-agent-core.exe" --provisioning_state2⤵
-
-
C:\Program Files (x86)\MSP Agent\msp-agent-core.exe"C:\Program Files (x86)\MSP Agent\msp-agent-core.exe" --provision_existing=eyJ0b2tlbiI6ImMyMWQ0OTQ4LTYwM2MtNDVhMi1iNGU3LTlkYWQ2YzMxMWI1MSIsInByb3Zpc2lvbkNvbmZpZ1VybCI6Imh0dHBzOi8vcHJvdmlzaW9uaW5nLmNvbmZpZy51cy13ZXN0LTIucHJkLmNkby5zeXN0ZW0tbW9uaXRvci5jb20iLCJndWlkIjoiNWJjMzlhMDMtYjJjOS1mZjExLTU1NjUtMzZmMmEwMmM5OGU3IiwicHJveHkiOnsiZW5hYmxlZCI6ImZhbHNlIiwiaG9zdCI6IiIsInBvcnQiOiIiLCJ1c2VyIjoiIiwia2V5IjoiIn192⤵
-
-
C:\Program Files (x86)\MSP Agent\msp-agent-core.exe"C:\Program Files (x86)\MSP Agent\msp-agent-core.exe" --provisioning_state2⤵
-
-
C:\Program Files (x86)\MSP Agent\msp-agent-core.exe"C:\Program Files (x86)\MSP Agent\msp-agent-core.exe" --provisioning_state2⤵
-
-
C:\Program Files (x86)\MSP Agent\msp-agent-core.exe"C:\Program Files (x86)\MSP Agent\msp-agent-core.exe" --provisioning_state2⤵
-
-
C:\Program Files (x86)\Take Control Agent\BASupSrvc.exe"C:\Program Files (x86)\Take Control Agent\BASupSrvc.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Take Control Agent\BASupSrvcCnfg.exe"C:\Program Files (x86)\Take Control Agent\BASupSrvcCnfg.exe" /silent1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Program Files (x86)\Take Control Agent\BASupSrvc.exe"C:\Program Files (x86)\Take Control Agent\BASupSrvc.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Take Control Agent\TCLauncherHelper.exeTCLauncherHelper.exe /runtask2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Take Control Agent\basupsysinf.exebasupsysinf.exe /video_controller /from_service2⤵
-
-
C:\PROGRA~2\TAKECO~1\BASupSysInf.exeC:\PROGRA~2\TAKECO~1\BASupSysInf.exe -pldpipeid 3grikWmRyUCnnFmtkF4CWM6cFXwHFMHpdIfMFAo57XBcpgO9OkXVK7ZxY0Y4k0Ii2⤵
-
-
C:\Program Files (x86)\Take Control Agent\TCLauncherHelper.exe"C:\Program Files (x86)\Take Control Agent\TCLauncherHelper.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Take Control Agent\TCLauncherHelper.exe"C:\Program Files (x86)\Take Control Agent\TCLauncherHelper.exe" /start2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Take Control Agent\BASupSrvcUpdater.exe"C:\Program Files (x86)\Take Control Agent\BASupSrvcUpdater.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Advanced Monitoring Agent\RequestHandlerAgent\RequestHandlerAgent.exe"C:\Program Files (x86)\Advanced Monitoring Agent\RequestHandlerAgent\RequestHandlerAgent.exe"1⤵
-
C:\Program Files (x86)\Advanced Monitoring Agent\RequestHandlerAgent\RequestHandlerAgent.exe"C:\Program Files (x86)\Advanced Monitoring Agent\RequestHandlerAgent\RequestHandlerAgent.exe"1⤵
-
C:\Program Files (x86)\Advanced Monitoring Agent\FileCacheServiceAgent\FileCacheServiceAgent.exe"C:\Program Files (x86)\Advanced Monitoring Agent\FileCacheServiceAgent\FileCacheServiceAgent.exe"1⤵
-
C:\Program Files (x86)\Advanced Monitoring Agent\FileCacheServiceAgent\FileCacheServiceAgent.exe"C:\Program Files (x86)\Advanced Monitoring Agent\FileCacheServiceAgent\FileCacheServiceAgent.exe"1⤵
-
C:\Program Files (x86)\Advanced Monitoring Agent\patchman\PME.Agent.exe"C:\Program Files (x86)\Advanced Monitoring Agent\patchman\PME.Agent.exe"1⤵
-
C:\Program Files (x86)\Advanced Monitoring Agent\patchman\PME.Agent.exe"C:\Program Files (x86)\Advanced Monitoring Agent\patchman\PME.Agent.exe"1⤵
-
C:\Program Files (x86)\Msp Agent\msp-agent-core.exe"C:\Program Files (x86)\Msp Agent\msp-agent-core.exe"1⤵
-
C:\Windows\SysWOW64\cmd.execmd ver2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "(Get-CimInstance -Class Win32_ComputerSystemProduct).UUID"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files (x86)\Msp Agent\components\msp-agent-core-upgrade\1.0.32\msp-agent-core-upgrade.exe"C:\Program Files (x86)\Msp Agent\components\msp-agent-core-upgrade\1.0.32\msp-agent-core-upgrade.exe" --version2⤵
-
-
C:\Program Files (x86)\Msp Agent\components\msp-agent-core-upgrade\1.0.32\msp-agent-core-upgrade.exe"C:\Program Files (x86)\Msp Agent\components\msp-agent-core-upgrade\1.0.32\msp-agent-core-upgrade.exe" --upgrade=eyJhcnRlZmFjdF9uYW1lIjoibXNwLWFnZW50LWNvcmUuZXhlIiwiZG93bmxvYWRfcGF0aCI6IkM6XFxQcm9ncmFtIEZpbGVzICh4ODYpXFxNc3AgQWdlbnRcXGRvd25sb2Fkc1xcbXNwLWFnZW50LWNvcmVcXHdpbmRvd3NcXHYzLjMxLjgiLCJleGlzdGluZ19wYXRoIjoiQzpcXFByb2dyYW0gRmlsZXMgKHg4NilcXE1zcCBBZ2VudFxcIn0=2⤵
-
-
C:\Program Files (x86)\Msp Agent\msp-agent-core.exe"C:\Program Files (x86)\Msp Agent\msp-agent-core.exe"1⤵
-
C:\Windows\SysWOW64\cmd.execmd ver2⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "(Get-CimInstance -Class Win32_ComputerSystemProduct).UUID"2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e58b6db.rbs
e58b6e0.rbs
e58b718.rbs
1.lng
247_Config.xml
DSC_Config.xml
DSC_Config.xml
Castle.Core.dll
is-3QR9TQSPIG.tmp
is-91J1G9A8IN.tmp
is-E5S76KDVLC.tmp
is-G2F2CCWX2X.tmp
is-MT559F2HQF.tmp
is-SZD0PJ7G6W.tmp
Debug.log
Debug.log
Informational.log
Informational.log
fmplugin.exe
settings.ini
settings.ini.lock
7z.dll
AMX.exe
AMX.exe.config
AutomationManager.Common.dll
AutomationManager.Engine.Common.dll
AutomationManager.Engine.Monitoring.dll
AutomationManager.Engine.Monitoring.dll.config
AutomationManager.Engine.Update.dll
AutomationManager.Engine.Update.dll.config
AutomationManager.Engine.dll
AutomationManager.Logging.dll
AutomationManager.PromptPresenter.exe
AutomationManager.PromptPresenter.exe.config
AutomationManager.RebootManager.exe
AutomationManager.RebootManager.exe.config
AutomationManager.ScriptRunner.dll
AutomationManager.ScriptRunner32.exe
AutomationManager.ScriptRunner32.exe.config
AutomationManager.ScriptRunner64.exe
AutomationManager.ScriptRunner64.exe.config
BouncyCastle.Cryptography.dll
FluentCommandLineParser.dll
FluentFTP.dll
ICSharpCode.SharpZipLib.dll
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.Win32.TaskScheduler.dll
NUSClientPublic.dll
NUSPublic.dll
Newtonsoft.Json.dll
PSLogging.dll
PolicyExecutionEngine.dll
PolicyExecutionEngine.dll.config
Polly.dll
Renci.SshNet.dll
ScriptBuilder.Common.dll
ScriptRunner.exe
ScriptRunner.exe.config
Settings.xml
SevenZipSharp.dll
System.Buffers.dll
System.Formats.Asn1.dll
System.Memory.dll
System.Numerics.Vectors.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Threading.Tasks.Extensions.dll
System.ValueTuple.dll
TelnetCSharp.dll
WindowsInput.dll
ZetaLongPaths.dll
bc-fips-1.0.2.dll
log4net.dll
_tmp_agentconfig.xml
AV.dll
CheckUtils.js
CimDate.js
Errors.js
Results.js
agent_uptime.js
av_avast.js
av_bitdefender.js
av_check_identifiers.js
av_default.js
av_eset.js
av_fsecure.js
av_grisoft.js
av_kaspersky.js
av_mcafee.js
av_panda.js
av_products.js
av_security_center.js
av_sophos_v2.js
av_symantec.js
av_trend.js
av_windows.js
check_antivirus.js
check_automated_task.js
check_backup.js
check_bandwidth.js
check_critical_events.js
check_disk_space.js
check_disk_space_change.js
check_echo_bandwidth.js
check_event_log.js
check_exchange.js
check_file_size.js
check_hacker.js
check_legacy.js
check_performance_disk.js
check_performance_memory.js
check_performance_network.js
check_performance_processor_queue.js
check_performance_processor_utilisation.js
check_physical_disk.js
check_physical_disk_smart.js
check_ping.js
check_script.js
check_service.js
check_snmp.js
check_tcp.js
check_web_page.js
check_web_protection_bandwidth.js
check_wsus.js
FMPluginCore.dll
Qt5Core.dll
Qt5Network.dll
Qt5Qml.dll
ScriptLauncher.js
backup.dll
checkapi.dll
externalapi.dll
legacy.dll
libeay32.dll
libssl32.dll
logger.dll
network.dll
performance.dll
ssleay32.dll
update_8_23.zip
feature_23.dll
localhost.xml
scriptrunner-installer-output.log
scriptrunner-installer-output_000_MainPackage.log
services.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
_new_settings.ini
ce_excludes.ini
msp-agent-core.msi
winagentrcl_6.exe
snmp_sys.xml
debug.log
debug.log
debug.log
debug.log
debug.log
debug.log
debug.log
debugfeature.log
debugfeature.log
debugfeature.log
debugfeature.log
debugfeature.log
debugfmagentfromwinagent.log
debugfmpluginupgrade.log
debugrbm.log
vcredist_x86.exe
ScriptRunnerInstaller-2.98.2.2.exe
feature_23.log
feature_23.log
feature_23.log
feature_23.log
header.bmp
splash.bmp
settings.ini
unzip.exe
update.log
update.log
update.log
winagent.exe
msp-agent-core-upgrade.log
msp-agent-core-upgrade.exe
msp-agent-core.json
msp-agent-core.json
msp-ufa-core-failover.json
volatile-store.json
database.log
database.log
msp-agent-core.log
ufa.lock
BASupSrvc.ini
BASupSrvc.ini
BASupSrvc.ini
TCLaunchHelper_20260508.log
TCLaunchHelper_20260508.log
TCLaunchHelper_20260508.log
TCLaunchHelper_20260508.log
TCLaunchHelper_20260508.log
TCLaunchHelper_20260508.log
UpdateCheck.ini
DailyMetadata_details.json
MonthlyMetadata_details.json
PmeConfiguration_details.json
SemiAnnualMetadata_details.json
FileCacheServiceAgent.log
FileCacheServiceAgent.log
FileCacheServiceAgent.log
FileCacheServiceAgent.log
SendManager.log
GlobalTrace.log
GlobalTrace.log
GlobalTrace.log
GlobalTrace.log
RequestHandlerAgent.log
RequestHandlerAgent.log
RequestHandlerAgent.log
SolarWinds.MSP.RpcServerService_install.log
state.rsm
agent.exe
package.zip
agent.tmp
MSIB774.tmp
FileCacheServiceAgentSetup.tmp
idp.dll
__PSScriptPolicyTest_b3kyjmzp.y5p.ps1
AccessControl.dll
CPUFeaturesPlugIn.dll
GraphicsCardPlugIn.dll
LogEx.dll
SimpleFC.dll
System.dll
TerminateProcessPlugin.dll
WinVersion.dll
XMLConfigPlugIn.dll
nsExec.dll
nsisdt.dll
services.dll
ScriptRunnerInstaller-2.98.2.2.exe
BootstrapperCore.config
BootstrapperCore.dll
ScriptBuilder.CustomBootstrapper.dll
mbahost.dll
MainPackage
vcredist_x86.exe
logo.png
wixstdba.dll
memory/772-25056-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/1212-8353-0x0000000000F60000-0x0000000000FAA000-memory.dmp
memory/2044-25731-0x0000000071240000-0x000000007128C000-memory.dmp
memory/2044-25730-0x0000000004800000-0x000000000484C000-memory.dmp
memory/2044-25723-0x00000000041C0000-0x0000000004517000-memory.dmp
memory/2044-25738-0x0000000071350000-0x00000000716A7000-memory.dmp
memory/2332-103-0x0000000002150000-0x000000000219A000-memory.dmp
memory/2724-24369-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/2724-23751-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/3016-16039-0x0000000000190000-0x00000000007BE000-memory.dmp
memory/3096-3756-0x00000000030F0000-0x000000000313A000-memory.dmp
memory/3096-3750-0x00000000030F0000-0x000000000313A000-memory.dmp
memory/3740-3753-0x00000000033C0000-0x000000000340A000-memory.dmp
memory/3740-3752-0x00000000033C0000-0x000000000340A000-memory.dmp
memory/3872-3749-0x0000000001D00000-0x0000000001DDF000-memory.dmp
memory/3872-4283-0x0000000001D00000-0x0000000001DDF000-memory.dmp
memory/4136-22785-0x0000023EC1840000-0x0000023EC1866000-memory.dmp
memory/4136-22773-0x0000023EA83C0000-0x0000023EA83E6000-memory.dmp
memory/4136-22775-0x0000023EA8DB0000-0x0000023EA8DC2000-memory.dmp
memory/4136-22774-0x0000023EC1680000-0x0000023EC16E6000-memory.dmp
memory/4256-24272-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/4256-25235-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/4256-25613-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/4588-24491-0x00000191481E0000-0x0000019148230000-memory.dmp
memory/4588-24218-0x0000019148130000-0x00000191481E0000-memory.dmp
memory/4588-24284-0x00000191480D0000-0x00000191480F2000-memory.dmp
memory/4588-22712-0x000001912F220000-0x000001912F228000-memory.dmp
memory/4640-3751-0x0000000003510000-0x000000000355A000-memory.dmp
memory/4640-3755-0x0000000003510000-0x000000000355A000-memory.dmp
memory/4664-14-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4664-102-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4916-8357-0x0000000003030000-0x000000000307A000-memory.dmp
memory/5560-101-0x0000000000700000-0x000000000074A000-memory.dmp
memory/5560-100-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/5560-20-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/6196-7156-0x0000000000A70000-0x0000000000ABA000-memory.dmp
memory/6352-4198-0x0000000003530000-0x000000000357A000-memory.dmp
memory/6352-4054-0x0000000006690000-0x00000000066E0000-memory.dmp
memory/6352-4045-0x00000000040A0000-0x00000000040B8000-memory.dmp
memory/6352-4052-0x0000000004200000-0x000000000420A000-memory.dmp
memory/6352-4053-0x0000000006BB0000-0x0000000007156000-memory.dmp
memory/6352-4199-0x0000000006A30000-0x0000000006A3B000-memory.dmp
memory/6704-4189-0x0000000002840000-0x000000000288A000-memory.dmp
memory/6868-4200-0x0000000003030000-0x000000000307A000-memory.dmp
memory/6936-4079-0x0000000001690000-0x00000000016DA000-memory.dmp
memory/6988-4187-0x0000000000760000-0x00000000007AA000-memory.dmp
memory/7008-16890-0x0000000007850000-0x000000000785E000-memory.dmp
memory/7008-16889-0x00000000071B0000-0x0000000007201000-memory.dmp
memory/7008-16888-0x0000000001230000-0x000000000127A000-memory.dmp
memory/7008-15361-0x00000000071B0000-0x0000000007201000-memory.dmp
memory/7032-4083-0x00000000030C0000-0x000000000310A000-memory.dmp
memory/7068-8354-0x0000000003280000-0x00000000032CA000-memory.dmp
memory/7068-8366-0x0000000003280000-0x00000000032CA000-memory.dmp
memory/7096-8355-0x0000000002B30000-0x0000000002B7A000-memory.dmp
memory/7096-8365-0x0000000002B30000-0x0000000002B7A000-memory.dmp
memory/7280-25668-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/7348-25538-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/7356-8367-0x0000000002350000-0x000000000242F000-memory.dmp
memory/7428-25035-0x0000000004160000-0x000000000478A000-memory.dmp
memory/7428-25065-0x0000000005F40000-0x0000000005F74000-memory.dmp
memory/7428-25034-0x0000000003AF0000-0x0000000003B26000-memory.dmp
memory/7428-25037-0x0000000004990000-0x00000000049F6000-memory.dmp
memory/7428-25036-0x00000000040B0000-0x00000000040D2000-memory.dmp
memory/7428-25048-0x0000000004AF0000-0x0000000004E47000-memory.dmp
memory/7428-25054-0x0000000004F70000-0x0000000004F8E000-memory.dmp
memory/7428-25080-0x0000000071210000-0x0000000071567000-memory.dmp
memory/7428-25055-0x0000000004FB0000-0x0000000004FFC000-memory.dmp
memory/7428-25038-0x0000000004A00000-0x0000000004A66000-memory.dmp
memory/7428-25066-0x00000000711C0000-0x000000007120C000-memory.dmp
memory/7428-25073-0x0000000005530000-0x000000000554E000-memory.dmp
memory/7428-25074-0x0000000006130000-0x00000000061D4000-memory.dmp
memory/7428-25075-0x0000000006A90000-0x000000000710A000-memory.dmp
memory/7428-25077-0x00000000064C0000-0x00000000064CA000-memory.dmp
memory/7428-25078-0x0000000006650000-0x000000000667A000-memory.dmp
memory/7428-25079-0x0000000006680000-0x00000000066A4000-memory.dmp
memory/7824-3441-0x0000000002100000-0x00000000021DF000-memory.dmp
memory/7876-15346-0x0000000000D40000-0x0000000000D8A000-memory.dmp
memory/7876-15288-0x0000000000F10000-0x0000000001292000-memory.dmp
memory/7876-15345-0x0000000000F10000-0x0000000001292000-memory.dmp
memory/7892-21941-0x0000021218240000-0x000002121824A000-memory.dmp
memory/7892-21940-0x0000021218210000-0x000002121821A000-memory.dmp
memory/7892-21935-0x00000212180B0000-0x00000212180C0000-memory.dmp
memory/7892-21937-0x0000021230A00000-0x0000021230A72000-memory.dmp
memory/7892-21942-0x00000212309A0000-0x00000212309BA000-memory.dmp
memory/7892-21943-0x0000021230980000-0x000002123098E000-memory.dmp
memory/7892-21933-0x00000212177C0000-0x0000021217806000-memory.dmp
memory/7892-21934-0x0000021230920000-0x000002123097C000-memory.dmp
memory/7892-21939-0x0000021218220000-0x0000021218232000-memory.dmp
memory/7892-21938-0x00000212181F0000-0x00000212181FA000-memory.dmp
memory/7892-21936-0x00000212180C0000-0x00000212180D0000-memory.dmp
memory/7892-21947-0x0000021230AD0000-0x0000021230B16000-memory.dmp
memory/7892-21957-0x0000021230B20000-0x0000021230B66000-memory.dmp
memory/7892-22279-0x0000021230AA0000-0x0000021230AB2000-memory.dmp
memory/7892-22280-0x0000021230E10000-0x0000021230E4C000-memory.dmp
memory/8028-25365-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/8104-14747-0x0000000001D60000-0x0000000001D6F000-memory.dmp
memory/8104-14989-0x0000000001D60000-0x0000000001D90000-memory.dmp
memory/8104-14534-0x0000000001D60000-0x0000000001DC6000-memory.dmp
memory/8104-15030-0x0000000001D60000-0x0000000001D75000-memory.dmp
memory/8104-14605-0x0000000000EB0000-0x0000000000EFA000-memory.dmp
memory/8104-14652-0x0000000001D60000-0x0000000001D6F000-memory.dmp
memory/8104-15369-0x0000000000EB0000-0x0000000000EFA000-memory.dmp
memory/8104-15176-0x0000000001D60000-0x0000000001DC4000-memory.dmp
memory/8248-16075-0x0000000000400000-0x0000000000C45000-memory.dmp
memory/8248-15267-0x0000000008F00000-0x0000000008F51000-memory.dmp
memory/8248-16076-0x0000000002C00000-0x0000000002C4A000-memory.dmp
memory/8248-15259-0x0000000008C80000-0x0000000008CD1000-memory.dmp
memory/8248-15207-0x0000000000400000-0x0000000000C45000-memory.dmp
memory/8248-16077-0x0000000008F00000-0x0000000008F51000-memory.dmp
memory/8968-14976-0x0000000000190000-0x00000000007BE000-memory.dmp
memory/8968-14980-0x0000000002280000-0x00000000022CA000-memory.dmp
memory/8968-14977-0x0000000000190000-0x00000000007BE000-memory.dmp
memory/8968-14979-0x0000000073FE0000-0x0000000074018000-memory.dmp
memory/8968-14978-0x0000000074070000-0x00000000740C4000-memory.dmp
memory/9072-15013-0x0000000000310000-0x00000000006C5000-memory.dmp
memory/9072-15014-0x0000000000E50000-0x0000000000E9A000-memory.dmp
memory/9072-14993-0x0000000000310000-0x00000000006C5000-memory.dmp
memory/9268-15205-0x0000000073F00000-0x0000000073F38000-memory.dmp
memory/9268-15203-0x0000000000190000-0x00000000007BE000-memory.dmp
memory/9268-15204-0x0000000000190000-0x00000000007BE000-memory.dmp
memory/9268-15206-0x0000000073EA0000-0x0000000073EF4000-memory.dmp
memory/9340-21071-0x0000000004190000-0x00000000041AA000-memory.dmp
memory/9340-21053-0x0000000003E60000-0x0000000003E70000-memory.dmp
memory/9340-21086-0x0000000004290000-0x00000000042A2000-memory.dmp
memory/9340-21060-0x0000000003F60000-0x0000000003F6A000-memory.dmp
memory/9340-21059-0x0000000003F50000-0x0000000003F5C000-memory.dmp
memory/9340-21052-0x0000000003EC0000-0x0000000003F1C000-memory.dmp
memory/9340-21087-0x00000000043A0000-0x00000000043DC000-memory.dmp
memory/9340-21136-0x0000000004FC0000-0x0000000004FD4000-memory.dmp
memory/9340-21061-0x00000000040A0000-0x00000000040E6000-memory.dmp
memory/9340-21081-0x0000000004300000-0x0000000004392000-memory.dmp
memory/9340-21054-0x0000000003F20000-0x0000000003F42000-memory.dmp
memory/9340-21055-0x0000000003E70000-0x0000000003E80000-memory.dmp
memory/9340-21056-0x0000000003FD0000-0x0000000004042000-memory.dmp
memory/9340-21057-0x0000000003EA0000-0x0000000003EAA000-memory.dmp
memory/9340-21058-0x0000000003F70000-0x0000000003F8A000-memory.dmp
memory/9340-21051-0x0000000000820000-0x0000000000842000-memory.dmp
memory/9556-25570-0x0000000000CD0000-0x0000000001A6D000-memory.dmp
memory/10076-13756-0x00000000016D0000-0x00000000017AF000-memory.dmp