lampion | 58e9f60d0b951029578cc1054668bfee2f00cfa029cfbd01ea65c7f61713a40a

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2023 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDeskAPP.msi
Size

1.4MB
MD5

4e4a4a4eb6a77d72af83b2bbd0698593
SHA1

dbaeba54fcae50acc36565d0f61ad73df6df7d45
SHA256

58e9f60d0b951029578cc1054668bfee2f00cfa029cfbd01ea65c7f61713a40a
SHA512

69785dadc878bd1178672a8f08590eeccd268b4fd2107ae3909e59fba03e7cfa425f690580dfcfa1f5ec3e494e5ef0b7232a16a26c8fbf734ef3887da4044ccb
SSDEEP

24576:Y+rwxLNjY3Wx0ECIgYmfLVYeBZrWAv12h2SekeUuyZD6lvs0zqa3:TrMjYMZKumZrWAWTreUuyZD6lvVz9

Score

10^/10

lampion banker evasion persistence trojan

Malware Config

Signatures

Lampion
Lampion is a banking trojan, targeting Portuguese speaking countries.
trojan banker lampion
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Winpercepção.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Winpercepção.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

41 4660 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

Winpercepção.exe

pid process

4136 Winpercepção.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Winpercepção.exe

flow	pid	process
41	4660	powershell.exe

pid	process
4136	Winpercepção.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Winpercepção.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Winpercepção.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Winpercepção.exe

Loads dropped DLL 5 IoCs

Processes:

MsiExec.exe

pid process

2012 MsiExec.exe
2012 MsiExec.exe
2012 MsiExec.exe
2012 MsiExec.exe
2012 MsiExec.exe

pid	process
2012	MsiExec.exe
2012	MsiExec.exe
2012	MsiExec.exe
2012	MsiExec.exe
2012	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Winpercepção.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	Winpercepção.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gipfCadh = "C:\\candura\\indolência\\Winpercepção.exe"	Winpercepção.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Winpercepção.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Winpercepção.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Winpercepção.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Winpercepção.exe

pid process

4136 Winpercepção.exe

pid	process
4136	Winpercepção.exe

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI7407.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI761B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7708.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77F3.tmp	msiexec.exe
File created	C:\Windows\Installer\e57737d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57737a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E9FCC84B-1149-4C5D-B073-66A342F5B861}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79B9.tmp	msiexec.exe
File created	C:\Windows\Installer\e57737a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000005cb6ed2f2c7878f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000005cb6ed20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090005cb6ed2000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000005cb6ed200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000005cb6ed200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c860a19b2bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2578898177"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2589679269"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c9748000000000200000000001066000000010000200000005215c10ca43bd6c05614f648062c3a4314affbafc133db37f9e9a3de6ea7d599000000000e8000000002000020000000e68c57c5eaee715174378163afc2f199869d11693e1a675ecf6089598b6ac735200000008fb1c0be01a63e9f6d5f94dde6e02b76419ae666fc7821d5d68883e3fc19e16240000000c91345eb982226f3cd1424dd72beb3628c412a1defcc7af7b48c1cc881a45179f16b5595bc7c2c43bcd967e87ad9f7dcd3c672e5146e58b83b331f24e5c27351	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C571104F-978E-11ED-919F-42A3CC74B480} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31009691"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409d12a09b2bd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c97480000000002000000000010660000000100002000000052117141e6766671ae6dd85b2bb2822e21f395ded8a2247388d8f3514e414fa0000000000e8000000002000020000000511a503881e8a35fdb91ed20bd52fb76b6c9578be7bb4026356930d3f53f019f20000000149c6464176e8290b5f77bf7ca65f765258c901134147add719051dcf543e796400000009273c7bedfe8df10dd469743ccd1ac26d54ea8b4744bc2c941e2af9a7aef90ebd1acc9ebfb4f3113b1eefc816f2d31fdd2f184a011c243608fb599b05058dcce	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2578898177"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31009691"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31009691"	IEXPLORE.EXE

Modifies data under HKEY_USERS 5 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe

Modifies registry class 27 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Version = "16777216"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\PackageName = "AnyDeskAPP.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\ProductName = "AnyDesk"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B48CCF9E9411D5C40B37663A245F8B16\MainFeature	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Language = "1046"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\PackageCode = "7A53F5C34D4FDEE41A79AB069A0CCD7B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

msiexec.exepowershell.exeWinpercepção.exe

pid	process
4044	msiexec.exe
4044	msiexec.exe
4660	powershell.exe
4660	powershell.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe
4136	Winpercepção.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	4808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4808	msiexec.exe
Token: SeSecurityPrivilege	4044	msiexec.exe
Token: SeCreateTokenPrivilege	4808	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4808	msiexec.exe
Token: SeLockMemoryPrivilege	4808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4808	msiexec.exe
Token: SeMachineAccountPrivilege	4808	msiexec.exe
Token: SeTcbPrivilege	4808	msiexec.exe
Token: SeSecurityPrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeLoadDriverPrivilege	4808	msiexec.exe
Token: SeSystemProfilePrivilege	4808	msiexec.exe
Token: SeSystemtimePrivilege	4808	msiexec.exe
Token: SeProfSingleProcessPrivilege	4808	msiexec.exe
Token: SeIncBasePriorityPrivilege	4808	msiexec.exe
Token: SeCreatePagefilePrivilege	4808	msiexec.exe
Token: SeCreatePermanentPrivilege	4808	msiexec.exe
Token: SeBackupPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeShutdownPrivilege	4808	msiexec.exe
Token: SeDebugPrivilege	4808	msiexec.exe
Token: SeAuditPrivilege	4808	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4808	msiexec.exe
Token: SeChangeNotifyPrivilege	4808	msiexec.exe
Token: SeRemoteShutdownPrivilege	4808	msiexec.exe
Token: SeUndockPrivilege	4808	msiexec.exe
Token: SeSyncAgentPrivilege	4808	msiexec.exe
Token: SeEnableDelegationPrivilege	4808	msiexec.exe
Token: SeManageVolumePrivilege	4808	msiexec.exe
Token: SeImpersonatePrivilege	4808	msiexec.exe
Token: SeCreateGlobalPrivilege	4808	msiexec.exe
Token: SeBackupPrivilege	5036	vssvc.exe
Token: SeRestorePrivilege	5036	vssvc.exe
Token: SeAuditPrivilege	5036	vssvc.exe
Token: SeBackupPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

msiexec.exepowershell.exeiexplore.exe

pid process

4808 msiexec.exe
4660 powershell.exe
4660 powershell.exe
1976 iexplore.exe
4808 msiexec.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXEWinpercepção.exe

pid process

1976 iexplore.exe
1976 iexplore.exe
1552 IEXPLORE.EXE
1552 IEXPLORE.EXE
4136 Winpercepção.exe
4136 Winpercepção.exe

pid	process
4808	msiexec.exe
4660	powershell.exe
4660	powershell.exe
1976	iexplore.exe
4808	msiexec.exe

pid	process
1976	iexplore.exe
1976	iexplore.exe
1552	IEXPLORE.EXE
1552	IEXPLORE.EXE
4136	Winpercepção.exe
4136	Winpercepção.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

msiexec.exeMsiExec.exepowershell.exeiexplore.exe

description	pid	process	target process
PID 4044 wrote to memory of 4432	4044	msiexec.exe	srtasks.exe
PID 4044 wrote to memory of 4432	4044	msiexec.exe	srtasks.exe
PID 4044 wrote to memory of 2012	4044	msiexec.exe	MsiExec.exe
PID 4044 wrote to memory of 2012	4044	msiexec.exe	MsiExec.exe
PID 4044 wrote to memory of 2012	4044	msiexec.exe	MsiExec.exe
PID 2012 wrote to memory of 4660	2012	MsiExec.exe	powershell.exe
PID 2012 wrote to memory of 4660	2012	MsiExec.exe	powershell.exe
PID 2012 wrote to memory of 4660	2012	MsiExec.exe	powershell.exe
PID 4660 wrote to memory of 4136	4660	powershell.exe	Winpercepção.exe
PID 4660 wrote to memory of 4136	4660	powershell.exe	Winpercepção.exe
PID 4660 wrote to memory of 4136	4660	powershell.exe	Winpercepção.exe
PID 1976 wrote to memory of 1552	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 1552	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 1552	1976	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AnyDeskAPP.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:4432

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E66FAD2627416073E122FBE03455AE92
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss79E6.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi79D3.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr79D4.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr79D5.txt" -propSep " :<->: " -testPrefix "_testValue."
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4660

C:\candura\indolência\Winpercepção.exe
"C:\candura\indolência\Winpercepção.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4136

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:3016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
14bf85de793cea23b81c15fb4078caac

SHA1
288eb197e359344a18d65724ff854bbe482be6fb

SHA256
a6a1d1ce7bbc768eeda3b115f96805c7a7b79b2a1d456810842bad24fcf6d1f1

SHA512
cb7bfb330f21e1d4ef49d92c86c77c12a58ad8fe37e57a745539f0902ef2bb063f6e4236146584c4dbd2c5d48510c7500577e7d0b41724ccad1f017cb2da70c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
de5b252662ee0b24b87114239c4ec526

SHA1
1fb2bb70904e159e05f593b9280f4f06033674d4

SHA256
fba5701d079f23985244d31db3545a7da7dee4fd528be2761bc0494bcc565d0a

SHA512
66259ea5cfa1071d5836bbc0a6d15890ca4cd05f8339fb2d10667757f3598374114040f50f166054ecfb03eff4e564c24a53be426eb4ef82b0793e54da701845

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss79E6.ps1
Filesize
5KB

MD5
fc1bb6c87fd1f08b534e52546561c53c

SHA1
db402c5c1025cf8d3e79df7b868fd186243aa9d1

SHA256
a04750ed5f05b82b90f6b8ea3748ba246af969757a5a4b74a0e25b186add520b

SHA512
5495f4ac3c8f42394a82540449526bb8ddd91adf0a1a852a9e1f2d32a63858b966648b4099d9947d8ac68ee43824dacda24c337c5b97733905e36c4921280e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr79D4.ps1
Filesize
17KB

MD5
7c5b73168b207a9c580eb62dd1588fef

SHA1
cdd8f39b7a12aa0b3c62a3c0c19572976d0444dc

SHA256
6d6b711685d829f27fcfe579853e43d993bf6e935085161d0dbee6abb43f60d5

SHA512
7ea9836bc57698341d18154e1b76ea6d1ee67b68504c2076b7125374c63298a9bf3580b4d2c2936ab19d0831940bb927171b6ad5a46fb87caf7f43b2b82696f9

Download Submit
C:\Windows\Installer\MSI7407.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI7407.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI761B.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI761B.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI76B8.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI76B8.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI7708.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI7708.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI79B9.tmp
Filesize
574KB

MD5
7b7d9e2c9b8236e7155f2f97254cb40e

SHA1
99621fc9d14511428d62d91c31865fb2c4625663

SHA256
df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897

SHA512
fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228

Download Submit
C:\Windows\Installer\MSI79B9.tmp
Filesize
574KB

MD5
7b7d9e2c9b8236e7155f2f97254cb40e

SHA1
99621fc9d14511428d62d91c31865fb2c4625663

SHA256
df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897

SHA512
fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228

Download Submit
C:\candura\indolência\Winpercepção.exe
Filesize
5.5MB

MD5
caa7805c7dc283359293bae074cb85ec

SHA1
f21c4880fbf40b8f03ed8954263106d814ac014d

SHA256
e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23

SHA512
206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1

Download Submit
C:\candura\indolência\Winpercepção.exe
Filesize
5.5MB

MD5
caa7805c7dc283359293bae074cb85ec

SHA1
f21c4880fbf40b8f03ed8954263106d814ac014d

SHA256
e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23

SHA512
206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1

Download Submit
C:\candura\indolência\vending
Filesize
89.4MB

MD5
3c6ef07082ae5cd1cdbb4c272f1da202

SHA1
4bbc70f293110dae93746e8a1fe7c5a47d1f33ec

SHA256
2bd1e88bcdd6377d1fa2a8f12b1ffec9c1a73e4aeea4a9eea31c359880a17b4c

SHA512
432d6c249b4b000c5cdf9600f8ca3f7771e55d41152abbc398b70a5b8cc5bd3d867a7febbd7b4d07186a519b04a7f552aa25712c099b16ebdb4575a751c73ee9

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
9615ca73b7cfad8b513cba365b77bdfe

SHA1
6903179807d0d68899c9151f5d9e5a334d338bc2

SHA256
ccef9db2683a828f6da5deaa84382943c6b14a57ee9d70b6cbccd1136a76e283

SHA512
eb4ae8322dd60a7bc50446eb7571ceade2091c8b879d536c9f1b8c0fb5296c6ec23b8102af8bfec1c3b4d557c8e25576af88eb78058db5f0abc1181ae2bf5ed4

Download Submit
\??\Volume{d26ecb05-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4012f9b3-8049-410b-a6e0-f29e87031c69}_OnDiskSnapshotProp
Filesize
5KB

MD5
044481be30212d4327d28275b814924d

SHA1
a12804d52e5f308c12bc0e5f5ce4ffa6b08793f5

SHA256
a59761aa50204e348dae4b321cf936e738fd283bd9b2f58dcffe11a185c23df7

SHA512
180c20596571f6bbd3e06019031774152c6febaa5e7f3d89b7b304622973cf7948177746d95ea3ad03a84651efd44f269a688870c92f45d1cee148060e832ff4

Download Submit
memory/2012-133-0x0000000000000000-mapping.dmp

Download
memory/4136-165-0x0000000000880000-0x00000000019E0000-memory.dmp

Filesize
17.4MB

Download
memory/4136-174-0x0000000009DF0000-0x000000000F766000-memory.dmp

Filesize
89.5MB

Download
memory/4136-173-0x0000000009DF0000-0x000000000F766000-memory.dmp

Filesize
89.5MB

Download
memory/4136-172-0x0000000077330000-0x00000000774D3000-memory.dmp

Filesize
1.6MB

Download
memory/4136-169-0x0000000000880000-0x00000000019E0000-memory.dmp

Filesize
17.4MB

Download
memory/4136-168-0x0000000000880000-0x00000000019E0000-memory.dmp

Filesize
17.4MB

Download
memory/4136-166-0x0000000000880000-0x00000000019E0000-memory.dmp

Filesize
17.4MB

Download
memory/4136-160-0x0000000000000000-mapping.dmp

Download
memory/4136-167-0x0000000077330000-0x00000000774D3000-memory.dmp

Filesize
1.6MB

Download
memory/4136-162-0x0000000000880000-0x00000000019E0000-memory.dmp

Filesize
17.4MB

Download
memory/4136-163-0x0000000000880000-0x00000000019E0000-memory.dmp

Filesize
17.4MB

Download
memory/4136-164-0x0000000000880000-0x00000000019E0000-memory.dmp

Filesize
17.4MB

Download
memory/4432-132-0x0000000000000000-mapping.dmp

Download
memory/4660-149-0x0000000006170000-0x00000000061D6000-memory.dmp

Filesize
408KB

Download
memory/4660-148-0x0000000006010000-0x0000000006076000-memory.dmp

Filesize
408KB

Download
memory/4660-153-0x0000000006D20000-0x0000000006D3A000-memory.dmp

Filesize
104KB

Download
memory/4660-150-0x00000000067D0000-0x00000000067EE000-memory.dmp

Filesize
120KB

Download
memory/4660-152-0x0000000008130000-0x00000000087AA000-memory.dmp

Filesize
6.5MB

Download
memory/4660-147-0x0000000005810000-0x0000000005832000-memory.dmp

Filesize
136KB

Download
memory/4660-146-0x00000000059E0000-0x0000000006008000-memory.dmp

Filesize
6.2MB

Download
memory/4660-156-0x00000000087B0000-0x0000000008D54000-memory.dmp

Filesize
5.6MB

Download
memory/4660-155-0x0000000007780000-0x00000000077A2000-memory.dmp

Filesize
136KB

Download
memory/4660-154-0x0000000007AB0000-0x0000000007B46000-memory.dmp

Filesize
600KB

Download
memory/4660-145-0x0000000005220000-0x0000000005256000-memory.dmp

Filesize
216KB

Download
memory/4660-144-0x0000000000000000-mapping.dmp

Download