Analysis
-
max time kernel
84s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
10-01-2023 15:42
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk.msi
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
AnyDesk.msi
Resource
win7-20221111-en
Behavioral task
behavioral3
Sample
AnyDesk.msi
Resource
win10v2004-20220812-en
General
-
Target
AnyDesk.msi
-
Size
5.2MB
-
MD5
8b5c001d696ec2cd730280496a311895
-
SHA1
a1ad08a895037a8fc8a5fa7fda7bfba9894a9eac
-
SHA256
e9d32103b6e9ab8fed7f6824525026119a5c5e9674522bdf0ebca8f242af10b1
-
SHA512
1901f730d02d23fdc81ff7bda7d9a7d4deb37596cce076bb1555a391419f2520577fe8872cb5795f2ff64eede2d6e9bf72f4840696001a2f25acc5e8ddca86db
-
SSDEEP
98304:dYGKdAHTgvVVqPvZpgvXM/N3qZBO0cY2YPGvhP0JGom:R8VqPvZ6v6NH0l7PXm
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Meelarguir.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Meelarguir.exe -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 4 1864 powershell.exe -
Executes dropped EXE 2 IoCs
Processes:
Meelarguir.exesetup.exepid process 928 Meelarguir.exe 2020 setup.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Meelarguir.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Meelarguir.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Meelarguir.exe -
Loads dropped DLL 8 IoCs
Processes:
MsiExec.exepowershell.exeMeelarguir.exepid process 1716 MsiExec.exe 1716 MsiExec.exe 1716 MsiExec.exe 1716 MsiExec.exe 1864 powershell.exe 928 Meelarguir.exe 928 Meelarguir.exe 1864 powershell.exe -
Processes:
Meelarguir.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Meelarguir.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Meelarguir.exepid process 928 Meelarguir.exe -
Drops file in Windows directory 13 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc process File opened for modification C:\Windows\Installer\MSI72E5.tmp msiexec.exe File created C:\Windows\Installer\6c6ae4.msi msiexec.exe File opened for modification C:\Windows\Installer\6c6ae4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6D36.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI71BA.tmp msiexec.exe File created C:\Windows\Installer\6c6ae6.ipi msiexec.exe File created C:\Windows\Installer\6c6ae8.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI6B23.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6DC3.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9C1A741-9105-11ED-8A0C-D60BF964997B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe -
Modifies registry class 23 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12295A05ADE7CA84990A61EE08BAE229\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\Language = "1046" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51\12295A05ADE7CA84990A61EE08BAE229 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\ProductName = "AnyDesk" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\PackageCode = "105C82585A7BDA148991FD2FEB5DCB00" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12295A05ADE7CA84990A61EE08BAE229 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12295A05ADE7CA84990A61EE08BAE229\SourceList\PackageName = "AnyDesk.msi" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
msiexec.exepowershell.exepid process 936 msiexec.exe 936 msiexec.exe 1864 powershell.exe 1864 powershell.exe 1864 powershell.exe 1864 powershell.exe 1864 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 2024 msiexec.exe Token: SeIncreaseQuotaPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 936 msiexec.exe Token: SeTakeOwnershipPrivilege 936 msiexec.exe Token: SeSecurityPrivilege 936 msiexec.exe Token: SeCreateTokenPrivilege 2024 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2024 msiexec.exe Token: SeLockMemoryPrivilege 2024 msiexec.exe Token: SeIncreaseQuotaPrivilege 2024 msiexec.exe Token: SeMachineAccountPrivilege 2024 msiexec.exe Token: SeTcbPrivilege 2024 msiexec.exe Token: SeSecurityPrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeLoadDriverPrivilege 2024 msiexec.exe Token: SeSystemProfilePrivilege 2024 msiexec.exe Token: SeSystemtimePrivilege 2024 msiexec.exe Token: SeProfSingleProcessPrivilege 2024 msiexec.exe Token: SeIncBasePriorityPrivilege 2024 msiexec.exe Token: SeCreatePagefilePrivilege 2024 msiexec.exe Token: SeCreatePermanentPrivilege 2024 msiexec.exe Token: SeBackupPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeShutdownPrivilege 2024 msiexec.exe Token: SeDebugPrivilege 2024 msiexec.exe Token: SeAuditPrivilege 2024 msiexec.exe Token: SeSystemEnvironmentPrivilege 2024 msiexec.exe Token: SeChangeNotifyPrivilege 2024 msiexec.exe Token: SeRemoteShutdownPrivilege 2024 msiexec.exe Token: SeUndockPrivilege 2024 msiexec.exe Token: SeSyncAgentPrivilege 2024 msiexec.exe Token: SeEnableDelegationPrivilege 2024 msiexec.exe Token: SeManageVolumePrivilege 2024 msiexec.exe Token: SeImpersonatePrivilege 2024 msiexec.exe Token: SeCreateGlobalPrivilege 2024 msiexec.exe Token: SeBackupPrivilege 1492 vssvc.exe Token: SeRestorePrivilege 1492 vssvc.exe Token: SeAuditPrivilege 1492 vssvc.exe Token: SeBackupPrivilege 936 msiexec.exe Token: SeRestorePrivilege 936 msiexec.exe Token: SeRestorePrivilege 1860 DrvInst.exe Token: SeRestorePrivilege 1860 DrvInst.exe Token: SeRestorePrivilege 1860 DrvInst.exe Token: SeRestorePrivilege 1860 DrvInst.exe Token: SeRestorePrivilege 1860 DrvInst.exe Token: SeRestorePrivilege 1860 DrvInst.exe Token: SeRestorePrivilege 1860 DrvInst.exe Token: SeLoadDriverPrivilege 1860 DrvInst.exe Token: SeLoadDriverPrivilege 1860 DrvInst.exe Token: SeLoadDriverPrivilege 1860 DrvInst.exe Token: SeRestorePrivilege 936 msiexec.exe Token: SeTakeOwnershipPrivilege 936 msiexec.exe Token: SeRestorePrivilege 936 msiexec.exe Token: SeTakeOwnershipPrivilege 936 msiexec.exe Token: SeRestorePrivilege 936 msiexec.exe Token: SeTakeOwnershipPrivilege 936 msiexec.exe Token: SeRestorePrivilege 936 msiexec.exe Token: SeTakeOwnershipPrivilege 936 msiexec.exe Token: SeRestorePrivilege 936 msiexec.exe Token: SeTakeOwnershipPrivilege 936 msiexec.exe Token: SeRestorePrivilege 936 msiexec.exe Token: SeTakeOwnershipPrivilege 936 msiexec.exe Token: SeRestorePrivilege 936 msiexec.exe Token: SeTakeOwnershipPrivilege 936 msiexec.exe Token: SeRestorePrivilege 936 msiexec.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
msiexec.exepowershell.exeiexplore.exepid process 2024 msiexec.exe 1864 powershell.exe 1864 powershell.exe 1864 powershell.exe 1864 powershell.exe 1888 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1888 iexplore.exe 1888 iexplore.exe 1212 IEXPLORE.EXE 1212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
msiexec.exeMsiExec.exepowershell.exeiexplore.exedescription pid process target process PID 936 wrote to memory of 1716 936 msiexec.exe MsiExec.exe PID 936 wrote to memory of 1716 936 msiexec.exe MsiExec.exe PID 936 wrote to memory of 1716 936 msiexec.exe MsiExec.exe PID 936 wrote to memory of 1716 936 msiexec.exe MsiExec.exe PID 936 wrote to memory of 1716 936 msiexec.exe MsiExec.exe PID 936 wrote to memory of 1716 936 msiexec.exe MsiExec.exe PID 936 wrote to memory of 1716 936 msiexec.exe MsiExec.exe PID 1716 wrote to memory of 1864 1716 MsiExec.exe powershell.exe PID 1716 wrote to memory of 1864 1716 MsiExec.exe powershell.exe PID 1716 wrote to memory of 1864 1716 MsiExec.exe powershell.exe PID 1716 wrote to memory of 1864 1716 MsiExec.exe powershell.exe PID 1864 wrote to memory of 928 1864 powershell.exe Meelarguir.exe PID 1864 wrote to memory of 928 1864 powershell.exe Meelarguir.exe PID 1864 wrote to memory of 928 1864 powershell.exe Meelarguir.exe PID 1864 wrote to memory of 928 1864 powershell.exe Meelarguir.exe PID 1888 wrote to memory of 1212 1888 iexplore.exe IEXPLORE.EXE PID 1888 wrote to memory of 1212 1888 iexplore.exe IEXPLORE.EXE PID 1888 wrote to memory of 1212 1888 iexplore.exe IEXPLORE.EXE PID 1888 wrote to memory of 1212 1888 iexplore.exe IEXPLORE.EXE PID 1864 wrote to memory of 2020 1864 powershell.exe setup.exe PID 1864 wrote to memory of 2020 1864 powershell.exe setup.exe PID 1864 wrote to memory of 2020 1864 powershell.exe setup.exe PID 1864 wrote to memory of 2020 1864 powershell.exe setup.exe PID 1864 wrote to memory of 2020 1864 powershell.exe setup.exe PID 1864 wrote to memory of 2020 1864 powershell.exe setup.exe PID 1864 wrote to memory of 2020 1864 powershell.exe setup.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AnyDesk.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8EA5B10354B65C567D53740EC1D09FA42⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss785F.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi781D.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr782E.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr782F.txt" -propSep " :<->: " -testPrefix "_testValue."3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\interação\problema\Meelarguir.exe"C:\interação\problema\Meelarguir.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Public\Documents\AnyDesk\setup.exe"C:\Users\Public\Documents\AnyDesk\setup.exe"4⤵
- Executes dropped EXE
-
C:\Users\Public\Documents\AnyDesk\setup.exe"C:\Users\Public\Documents\AnyDesk\setup.exe" --local-service5⤵
-
C:\Users\Public\Documents\AnyDesk\setup.exe"C:\Users\Public\Documents\AnyDesk\setup.exe" --local-control5⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000049C" "0000000000000320"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pss785F.ps1Filesize
5KB
MD5fc1bb6c87fd1f08b534e52546561c53c
SHA1db402c5c1025cf8d3e79df7b868fd186243aa9d1
SHA256a04750ed5f05b82b90f6b8ea3748ba246af969757a5a4b74a0e25b186add520b
SHA5125495f4ac3c8f42394a82540449526bb8ddd91adf0a1a852a9e1f2d32a63858b966648b4099d9947d8ac68ee43824dacda24c337c5b97733905e36c4921280e86
-
C:\Users\Admin\AppData\Local\Temp\scr782E.ps1Filesize
17KB
MD5c67846c507bf7950e4bc2d266f91471d
SHA1c4ebed1f716a6a3747dd04988b3349c4860fc0e2
SHA2565c8fa4f1456d769f17a2688048a11683f94f3199d30dcb51f35cdf4949f0cae8
SHA512463d0d4dd1faddf278981c913d07764cdd0c4d7c645a2d38234e3468986625f6a3e3367d44503be71b032562bb0154c5a546d0dde6e4f00db09ceb43a2f769ae
-
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.traceFilesize
8KB
MD5317cf1eae285893b4c490069cc5dbecf
SHA15bfb9debdfe4c49e95e38d568dd8bc918f1b4362
SHA256ffc584919cb857302274b98fd565d5b41205fccd7087d119210d9124d975b91e
SHA512049f36a0756050713761f82c912feb997e4214eecab62999fba182ff277467305757863abf249a4ec912757ed262eb52451f6758b667703d9fd704adb314fc30
-
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.traceFilesize
8KB
MD5317cf1eae285893b4c490069cc5dbecf
SHA15bfb9debdfe4c49e95e38d568dd8bc918f1b4362
SHA256ffc584919cb857302274b98fd565d5b41205fccd7087d119210d9124d975b91e
SHA512049f36a0756050713761f82c912feb997e4214eecab62999fba182ff277467305757863abf249a4ec912757ed262eb52451f6758b667703d9fd704adb314fc30
-
C:\Users\Admin\AppData\Roaming\AnyDesk\system.confFilesize
424B
MD530596779cd0fb764be4f93ead6129440
SHA1d151562a7627162823998bd5284c693dcaefb661
SHA256054aa1a4128b3aebd9716bf27e9916a0becce006b63e10776edee510e4efd63a
SHA512b814b37da1e14d088be7d8a0bab12ad0a641c15367572ae328a3bc0c96522c2bee22d2e91049ed5d388727a2b0bd78e885df66b79ea34980990e91451107675d
-
C:\Users\Admin\AppData\Roaming\AnyDesk\user.confFilesize
1KB
MD54cb03713a2ca7d1ba50312f1e182b527
SHA131bc6b894c7935580ab158b30dca17c8510fb077
SHA25657d45cab1f3e601d775a0013fe86a98d05a447fbc10343dd07aa8a6b92e758eb
SHA5120e98d5b257b94eb56223798fa5f65c2f876dd83494bccc6826fdc5116a32502dc6287fb9b8877e105b7ff65b7e22c6421d8605d1aadd19a2987576a2a2022477
-
C:\Users\Public\Documents\AnyDesk\setup.exeFilesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
C:\Users\Public\Documents\AnyDesk\setup.exeFilesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
C:\Users\Public\Documents\AnyDesk\setup.exeFilesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
C:\Users\Public\Documents\AnyDesk\setup.exeFilesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
C:\Windows\Installer\MSI6B23.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSI6D36.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSI6DC3.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSI72E5.tmpFilesize
574KB
MD57b7d9e2c9b8236e7155f2f97254cb40e
SHA199621fc9d14511428d62d91c31865fb2c4625663
SHA256df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897
SHA512fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228
-
C:\interação\problema\ChromeDls21Filesize
85.4MB
MD5a2c34329ee5234755040c3ef0a6728b0
SHA18734fead0d1c79fd459cf0830d12d477081f9fb3
SHA25694f915ac633b0ccd7dbe5b007b6be1582eefa1c798214d9a96ffaca623dd142c
SHA51224d52d43c0bbc92d485046d37474c4790cdf3e9968922ff45fc07cd5018d6815fc6dc9afbb2218bc4869c3e3a9ce0096e33ca73568969c64db8e8488a94d780c
-
C:\interação\problema\LIBEAY32.DLLFilesize
3.5MB
MD54abfe433e39932ba3642a87f7b75f5ff
SHA1c13f41ccfbd4b115108ff288d1d2e89ee8c5f88d
SHA256a50ef797044e0d975916290a7c284eb41e7a8fd5122fcfebcc2fb18e247342a2
SHA51262945f7b7c2db8f3543523a60a2eccdc164322581335b14ffb1fbb2ff0977fa27cd5d9b64685d38aad7d2a080cfbf3d48804c25fbf8e35b03a25a1c5db9c57c6
-
C:\interação\problema\Meelarguir.exeFilesize
15.1MB
MD5a88098f4d2d7866410b428572a3c113e
SHA1a8b6f921b2c0b08b1d5f0766e9d03c4932bd0155
SHA2561c04e379b31b6edd40354af97aeb9046863ae15e3ddac18022836f15db07f421
SHA512c07beeffd780d8d91e79e73997f163fc571ad30e8e7b1e5247f6ada4437621e794b3fc0301061fda7589b1a97ea885b95111e3dbf67f6b2a5aeea84f63d81ff5
-
C:\interação\problema\Meelarguir.exeFilesize
15.1MB
MD5a88098f4d2d7866410b428572a3c113e
SHA1a8b6f921b2c0b08b1d5f0766e9d03c4932bd0155
SHA2561c04e379b31b6edd40354af97aeb9046863ae15e3ddac18022836f15db07f421
SHA512c07beeffd780d8d91e79e73997f163fc571ad30e8e7b1e5247f6ada4437621e794b3fc0301061fda7589b1a97ea885b95111e3dbf67f6b2a5aeea84f63d81ff5
-
C:\interação\problema\PROFILE.DLLFilesize
241KB
MD524aae6bcc99f29b0b4e1db6ea1e8e902
SHA1ef6eb3f8fea180b36252fd85d8ab0d6842d0f32d
SHA256199498a70290ba14947f8fbde13840499f07e63d9b3b79ced03928fca9c009b9
SHA51251f3ccefcf0f562c502fbf789f40e21b4ecd99599fd857841938f7e2d6529f2640360f0e7947441b2aed7e611905b03fe9cac246a874d54bf545acdfa4ce24d8
-
\Users\Public\Documents\AnyDesk\setup.exeFilesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
\Users\Public\Documents\AnyDesk\setup.exeFilesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
\Users\Public\Documents\AnyDesk\setup.exeFilesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
\Windows\Installer\MSI6B23.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
\Windows\Installer\MSI6D36.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
\Windows\Installer\MSI6DC3.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
\Windows\Installer\MSI72E5.tmpFilesize
574KB
MD57b7d9e2c9b8236e7155f2f97254cb40e
SHA199621fc9d14511428d62d91c31865fb2c4625663
SHA256df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897
SHA512fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228
-
\interação\problema\Meelarguir.exeFilesize
15.1MB
MD5a88098f4d2d7866410b428572a3c113e
SHA1a8b6f921b2c0b08b1d5f0766e9d03c4932bd0155
SHA2561c04e379b31b6edd40354af97aeb9046863ae15e3ddac18022836f15db07f421
SHA512c07beeffd780d8d91e79e73997f163fc571ad30e8e7b1e5247f6ada4437621e794b3fc0301061fda7589b1a97ea885b95111e3dbf67f6b2a5aeea84f63d81ff5
-
\interação\problema\libeay32.dllFilesize
3.5MB
MD54abfe433e39932ba3642a87f7b75f5ff
SHA1c13f41ccfbd4b115108ff288d1d2e89ee8c5f88d
SHA256a50ef797044e0d975916290a7c284eb41e7a8fd5122fcfebcc2fb18e247342a2
SHA51262945f7b7c2db8f3543523a60a2eccdc164322581335b14ffb1fbb2ff0977fa27cd5d9b64685d38aad7d2a080cfbf3d48804c25fbf8e35b03a25a1c5db9c57c6
-
\interação\problema\profile.dllFilesize
241KB
MD524aae6bcc99f29b0b4e1db6ea1e8e902
SHA1ef6eb3f8fea180b36252fd85d8ab0d6842d0f32d
SHA256199498a70290ba14947f8fbde13840499f07e63d9b3b79ced03928fca9c009b9
SHA51251f3ccefcf0f562c502fbf789f40e21b4ecd99599fd857841938f7e2d6529f2640360f0e7947441b2aed7e611905b03fe9cac246a874d54bf545acdfa4ce24d8
-
memory/928-87-0x00000000002E0000-0x00000000002ED000-memory.dmpFilesize
52KB
-
memory/928-81-0x0000000001570000-0x0000000002035000-memory.dmpFilesize
10.8MB
-
memory/928-88-0x000000000F220000-0x000000000F3B0000-memory.dmpFilesize
1.6MB
-
memory/928-89-0x000000000F3B0000-0x000000000F573000-memory.dmpFilesize
1.8MB
-
memory/928-86-0x00000000002C0000-0x00000000002CD000-memory.dmpFilesize
52KB
-
memory/928-91-0x00000000003C0000-0x00000000003DC000-memory.dmpFilesize
112KB
-
memory/928-93-0x00000000098A0000-0x000000000F217000-memory.dmpFilesize
89.5MB
-
memory/928-96-0x000000000F980000-0x000000000FAB0000-memory.dmpFilesize
1.2MB
-
memory/928-84-0x0000000001570000-0x0000000002035000-memory.dmpFilesize
10.8MB
-
memory/928-82-0x0000000001570000-0x0000000002035000-memory.dmpFilesize
10.8MB
-
memory/928-129-0x00000000773E0000-0x0000000077560000-memory.dmpFilesize
1.5MB
-
memory/928-83-0x00000000773E0000-0x0000000077560000-memory.dmpFilesize
1.5MB
-
memory/928-102-0x000000000FE30000-0x000000000FE61000-memory.dmpFilesize
196KB
-
memory/928-73-0x0000000000000000-mapping.dmp
-
memory/928-105-0x000000000FE70000-0x000000001027B000-memory.dmpFilesize
4.0MB
-
memory/928-80-0x0000000001570000-0x0000000002035000-memory.dmpFilesize
10.8MB
-
memory/928-110-0x0000000011720000-0x0000000011758000-memory.dmpFilesize
224KB
-
memory/1716-57-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/1716-56-0x0000000000000000-mapping.dmp
-
memory/1864-68-0x00000000722C0000-0x00000000737E8000-memory.dmpFilesize
21.2MB
-
memory/1864-66-0x0000000000000000-mapping.dmp
-
memory/1864-71-0x00000000722C0000-0x00000000737E8000-memory.dmpFilesize
21.2MB
-
memory/2020-99-0x0000000000000000-mapping.dmp
-
memory/2020-106-0x0000000001250000-0x00000000022A9000-memory.dmpFilesize
16.3MB
-
memory/2020-123-0x0000000074AA1000-0x0000000074AA3000-memory.dmpFilesize
8KB
-
memory/2020-103-0x0000000001250000-0x00000000022A9000-memory.dmpFilesize
16.3MB
-
memory/2024-54-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmpFilesize
8KB
-
memory/2188-119-0x0000000001250000-0x00000000022A9000-memory.dmpFilesize
16.3MB
-
memory/2188-130-0x0000000001250000-0x00000000022A9000-memory.dmpFilesize
16.3MB
-
memory/2188-112-0x0000000000000000-mapping.dmp
-
memory/2204-120-0x0000000001250000-0x00000000022A9000-memory.dmpFilesize
16.3MB
-
memory/2204-116-0x0000000000000000-mapping.dmp
-
memory/2204-131-0x0000000001250000-0x00000000022A9000-memory.dmpFilesize
16.3MB