lampion | 58e9f60d0b951029578cc1054668bfee2f00cfa029cfbd01ea65c7f61713a40a

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-01-2023 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDeskAPP.msi
Size

1.4MB
MD5

4e4a4a4eb6a77d72af83b2bbd0698593
SHA1

dbaeba54fcae50acc36565d0f61ad73df6df7d45
SHA256

58e9f60d0b951029578cc1054668bfee2f00cfa029cfbd01ea65c7f61713a40a
SHA512

69785dadc878bd1178672a8f08590eeccd268b4fd2107ae3909e59fba03e7cfa425f690580dfcfa1f5ec3e494e5ef0b7232a16a26c8fbf734ef3887da4044ccb
SSDEEP

24576:Y+rwxLNjY3Wx0ECIgYmfLVYeBZrWAv12h2SekeUuyZD6lvs0zqa3:TrMjYMZKumZrWAWTreUuyZD6lvVz9

Score

10^/10

lampion banker evasion persistence trojan

Malware Config

Signatures

Lampion
Lampion is a banking trojan, targeting Portuguese speaking countries.
trojan banker lampion
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Winexímio.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Winexímio.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1944 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

Winexímio.exe

pid process

976 Winexímio.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Winexímio.exe

flow	pid	process
4	1944	powershell.exe

pid	process
976	Winexímio.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Winexímio.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Winexímio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Winexímio.exe

Loads dropped DLL 5 IoCs

Processes:

MsiExec.exepowershell.exe

pid process

1620 MsiExec.exe
1620 MsiExec.exe
1620 MsiExec.exe
1620 MsiExec.exe
1944 powershell.exe

pid	process
1620	MsiExec.exe
1620	MsiExec.exe
1620	MsiExec.exe
1620	MsiExec.exe
1944	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Winexímio.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Winexímio.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ezogdixe = "C:\\já\\paradoxo\\Winexímio.exe"	Winexímio.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Winexímio.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Winexímio.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Winexímio.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Winexímio.exe

pid process

976 Winexímio.exe

pid	process
976	Winexímio.exe

Drops file in Windows directory 14 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI90BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A23.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6c8cf7.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6c8cf5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D81.tmp	msiexec.exe
File created	C:\Windows\Installer\6c8cf7.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI984D.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\6c8cf9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c8cf5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9011.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000812c113a942a4945b3d4d82f470c28d200000000020000000000106600000001000020000000adbd24b1659bcbedcbf1538e6c0ae9870b339de6be44b40222e543c7849128f6000000000e800000000200002000000061dcdff316755b40c28f27f15429c07c2c673ceb965efb1af8f4183cea4ccb5c90000000977868fe31b1bd32d42916c6a38ad5feebc3b9c6450451145b2749973faa4445a9f5cc874061c911c99239b1fed8df758551510dc275fcbafb90aa30ff57f39bd0d277c43ad6e854007d5a536842594e9f69b3e634eca6375d23777f2251f98cfda1a940aa52e38e75ce471d0620dcc65ad7246dd5dc6e089a2de2e19c08f8986c515c4d7293fc87064fe8513c12d391400000008c4a3c8c3009733d18be63125c330294d435caf0bba004cd705177b4acb4acd9dad4c8175ce5bdd1e354e3436419c781235e05f2bd0ebde3beeca158f06f0749	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000812c113a942a4945b3d4d82f470c28d200000000020000000000106600000001000020000000636263de3dc072d52c7d241377c5b893c5664298756edbc8a374168820d8a6c3000000000e800000000200002000000052b9bb0ea5daa4b9aff9bd02f51f9ad7562f7467dff69a70442b3c478f321bc12000000080833ab27948f3aad9bf97becb9893498886097f37fe411643766168e5a8dd6c40000000296fbba38c5cfc917b7a4b1d67e0ff3145ae96b29231307664c9d48ee38ae3ea448e27f888bd352d8e73e6e6b5c3d9786eefe517c1283246fcae0f792f2115d9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d665679c2bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82A3FC81-978F-11ED-8C74-D6AAFEFD221A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 20 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\PackageName = "AnyDeskAPP.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\ProductName = "AnyDesk"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Language = "1046"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B48CCF9E9411D5C40B37663A245F8B16\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\PackageCode = "7A53F5C34D4FDEE41A79AB069A0CCD7B"	msiexec.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

msiexec.exepowershell.exeWinexímio.exe

pid	process
1584	msiexec.exe
1584	msiexec.exe
1944	powershell.exe
1944	powershell.exe
1944	powershell.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe
976	Winexímio.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	904	msiexec.exe
Token: SeIncreaseQuotaPrivilege	904	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeSecurityPrivilege	1584	msiexec.exe
Token: SeCreateTokenPrivilege	904	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	904	msiexec.exe
Token: SeLockMemoryPrivilege	904	msiexec.exe
Token: SeIncreaseQuotaPrivilege	904	msiexec.exe
Token: SeMachineAccountPrivilege	904	msiexec.exe
Token: SeTcbPrivilege	904	msiexec.exe
Token: SeSecurityPrivilege	904	msiexec.exe
Token: SeTakeOwnershipPrivilege	904	msiexec.exe
Token: SeLoadDriverPrivilege	904	msiexec.exe
Token: SeSystemProfilePrivilege	904	msiexec.exe
Token: SeSystemtimePrivilege	904	msiexec.exe
Token: SeProfSingleProcessPrivilege	904	msiexec.exe
Token: SeIncBasePriorityPrivilege	904	msiexec.exe
Token: SeCreatePagefilePrivilege	904	msiexec.exe
Token: SeCreatePermanentPrivilege	904	msiexec.exe
Token: SeBackupPrivilege	904	msiexec.exe
Token: SeRestorePrivilege	904	msiexec.exe
Token: SeShutdownPrivilege	904	msiexec.exe
Token: SeDebugPrivilege	904	msiexec.exe
Token: SeAuditPrivilege	904	msiexec.exe
Token: SeSystemEnvironmentPrivilege	904	msiexec.exe
Token: SeChangeNotifyPrivilege	904	msiexec.exe
Token: SeRemoteShutdownPrivilege	904	msiexec.exe
Token: SeUndockPrivilege	904	msiexec.exe
Token: SeSyncAgentPrivilege	904	msiexec.exe
Token: SeEnableDelegationPrivilege	904	msiexec.exe
Token: SeManageVolumePrivilege	904	msiexec.exe
Token: SeImpersonatePrivilege	904	msiexec.exe
Token: SeCreateGlobalPrivilege	904	msiexec.exe
Token: SeBackupPrivilege	1736	vssvc.exe
Token: SeRestorePrivilege	1736	vssvc.exe
Token: SeAuditPrivilege	1736	vssvc.exe
Token: SeBackupPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	804	DrvInst.exe
Token: SeRestorePrivilege	804	DrvInst.exe
Token: SeRestorePrivilege	804	DrvInst.exe
Token: SeRestorePrivilege	804	DrvInst.exe
Token: SeRestorePrivilege	804	DrvInst.exe
Token: SeRestorePrivilege	804	DrvInst.exe
Token: SeRestorePrivilege	804	DrvInst.exe
Token: SeLoadDriverPrivilege	804	DrvInst.exe
Token: SeLoadDriverPrivilege	804	DrvInst.exe
Token: SeLoadDriverPrivilege	804	DrvInst.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

msiexec.exepowershell.exeiexplore.exe

pid process

904 msiexec.exe
1944 powershell.exe
1944 powershell.exe
516 iexplore.exe
904 msiexec.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXEWinexímio.exe

pid process

516 iexplore.exe
516 iexplore.exe
2036 IEXPLORE.EXE
2036 IEXPLORE.EXE
976 Winexímio.exe
976 Winexímio.exe

pid	process
904	msiexec.exe
1944	powershell.exe
1944	powershell.exe
516	iexplore.exe
904	msiexec.exe

pid	process
516	iexplore.exe
516	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
976	Winexímio.exe
976	Winexímio.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

msiexec.exeMsiExec.exepowershell.exeiexplore.exe

description	pid	process	target process
PID 1584 wrote to memory of 1620	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1620	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1620	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1620	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1620	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1620	1584	msiexec.exe	MsiExec.exe
PID 1584 wrote to memory of 1620	1584	msiexec.exe	MsiExec.exe
PID 1620 wrote to memory of 1944	1620	MsiExec.exe	powershell.exe
PID 1620 wrote to memory of 1944	1620	MsiExec.exe	powershell.exe
PID 1620 wrote to memory of 1944	1620	MsiExec.exe	powershell.exe
PID 1620 wrote to memory of 1944	1620	MsiExec.exe	powershell.exe
PID 1944 wrote to memory of 976	1944	powershell.exe	Winexímio.exe
PID 1944 wrote to memory of 976	1944	powershell.exe	Winexímio.exe
PID 1944 wrote to memory of 976	1944	powershell.exe	Winexímio.exe
PID 1944 wrote to memory of 976	1944	powershell.exe	Winexímio.exe
PID 516 wrote to memory of 2036	516	iexplore.exe	IEXPLORE.EXE
PID 516 wrote to memory of 2036	516	iexplore.exe	IEXPLORE.EXE
PID 516 wrote to memory of 2036	516	iexplore.exe	IEXPLORE.EXE
PID 516 wrote to memory of 2036	516	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AnyDeskAPP.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:904

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 03DBF4BBF1A45C32A415CEE91B31006E
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss9CFF.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi9CCD.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr9CDD.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr9CDE.txt" -propSep " :<->: " -testPrefix "_testValue."
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1944

C:\já\paradoxo\Winexímio.exe
"C:\já\paradoxo\Winexímio.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004D8" "0000000000000588"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:804

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:516 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pss9CFF.ps1
Filesize
5KB

MD5
fc1bb6c87fd1f08b534e52546561c53c

SHA1
db402c5c1025cf8d3e79df7b868fd186243aa9d1

SHA256
a04750ed5f05b82b90f6b8ea3748ba246af969757a5a4b74a0e25b186add520b

SHA512
5495f4ac3c8f42394a82540449526bb8ddd91adf0a1a852a9e1f2d32a63858b966648b4099d9947d8ac68ee43824dacda24c337c5b97733905e36c4921280e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr9CDD.ps1
Filesize
17KB

MD5
7c5b73168b207a9c580eb62dd1588fef

SHA1
cdd8f39b7a12aa0b3c62a3c0c19572976d0444dc

SHA256
6d6b711685d829f27fcfe579853e43d993bf6e935085161d0dbee6abb43f60d5

SHA512
7ea9836bc57698341d18154e1b76ea6d1ee67b68504c2076b7125374c63298a9bf3580b4d2c2936ab19d0831940bb927171b6ad5a46fb87caf7f43b2b82696f9

Download Submit
C:\Windows\Installer\MSI8D81.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI9011.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI90BE.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI9A23.tmp
Filesize
574KB

MD5
7b7d9e2c9b8236e7155f2f97254cb40e

SHA1
99621fc9d14511428d62d91c31865fb2c4625663

SHA256
df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897

SHA512
fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228

Download Submit
C:\já\paradoxo\Winexímio.exe
Filesize
5.5MB

MD5
caa7805c7dc283359293bae074cb85ec

SHA1
f21c4880fbf40b8f03ed8954263106d814ac014d

SHA256
e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23

SHA512
206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1

Download Submit
C:\já\paradoxo\Winexímio.exe
Filesize
5.5MB

MD5
caa7805c7dc283359293bae074cb85ec

SHA1
f21c4880fbf40b8f03ed8954263106d814ac014d

SHA256
e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23

SHA512
206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1

Download Submit
C:\já\paradoxo\vending
Filesize
89.4MB

MD5
3c6ef07082ae5cd1cdbb4c272f1da202

SHA1
4bbc70f293110dae93746e8a1fe7c5a47d1f33ec

SHA256
2bd1e88bcdd6377d1fa2a8f12b1ffec9c1a73e4aeea4a9eea31c359880a17b4c

SHA512
432d6c249b4b000c5cdf9600f8ca3f7771e55d41152abbc398b70a5b8cc5bd3d867a7febbd7b4d07186a519b04a7f552aa25712c099b16ebdb4575a751c73ee9

Download Submit
\Windows\Installer\MSI8D81.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI9011.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI90BE.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI9A23.tmp
Filesize
574KB

MD5
7b7d9e2c9b8236e7155f2f97254cb40e

SHA1
99621fc9d14511428d62d91c31865fb2c4625663

SHA256
df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897

SHA512
fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228

Download Submit
\já\paradoxo\Winexímio.exe
Filesize
5.5MB

MD5
caa7805c7dc283359293bae074cb85ec

SHA1
f21c4880fbf40b8f03ed8954263106d814ac014d

SHA256
e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23

SHA512
206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1

Download Submit
memory/904-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/976-92-0x000000000A040000-0x000000000F9B6000-memory.dmp

Filesize
89.5MB

Download
memory/976-87-0x000000000FB50000-0x000000000FD13000-memory.dmp

Filesize
1.8MB

Download
memory/976-73-0x0000000000000000-mapping.dmp

Download
memory/976-105-0x000000000A040000-0x000000000F9B6000-memory.dmp

Filesize
89.5MB

Download
memory/976-76-0x0000000000CC0000-0x0000000001E20000-memory.dmp

Filesize
17.4MB

Download
memory/976-77-0x0000000000CC0000-0x0000000001E20000-memory.dmp

Filesize
17.4MB

Download
memory/976-78-0x0000000000CC0000-0x0000000001E20000-memory.dmp

Filesize
17.4MB

Download
memory/976-79-0x00000000778E0000-0x0000000077A60000-memory.dmp

Filesize
1.5MB

Download
memory/976-80-0x0000000000CC0000-0x0000000001E20000-memory.dmp

Filesize
17.4MB

Download
memory/976-81-0x0000000000CC0000-0x0000000001E20000-memory.dmp

Filesize
17.4MB

Download
memory/976-82-0x0000000000CC0000-0x0000000001E20000-memory.dmp

Filesize
17.4MB

Download
memory/976-83-0x0000000000CC0000-0x0000000001E20000-memory.dmp

Filesize
17.4MB

Download
memory/976-103-0x0000000010510000-0x0000000010548000-memory.dmp

Filesize
224KB

Download
memory/976-85-0x0000000000540000-0x000000000054D000-memory.dmp

Filesize
52KB

Download
memory/976-86-0x000000000F9C0000-0x000000000FB50000-memory.dmp

Filesize
1.6MB

Download
memory/976-102-0x0000000010070000-0x0000000010089000-memory.dmp

Filesize
100KB

Download
memory/976-101-0x0000000010410000-0x0000000010486000-memory.dmp

Filesize
472KB

Download
memory/976-90-0x0000000003220000-0x000000000323C000-memory.dmp

Filesize
112KB

Download
memory/976-100-0x0000000003880000-0x00000000038AB000-memory.dmp

Filesize
172KB

Download
memory/976-91-0x0000000003690000-0x0000000003727000-memory.dmp

Filesize
604KB

Download
memory/976-93-0x00000000035C0000-0x0000000003639000-memory.dmp

Filesize
484KB

Download
memory/976-95-0x000000000FF30000-0x0000000010060000-memory.dmp

Filesize
1.2MB

Download
memory/976-96-0x0000000003840000-0x0000000003871000-memory.dmp

Filesize
196KB

Download
memory/976-97-0x00000000108D0000-0x0000000010CDB000-memory.dmp

Filesize
4.0MB

Download
memory/976-98-0x00000000101A0000-0x0000000010243000-memory.dmp

Filesize
652KB

Download
memory/976-99-0x000000000FE50000-0x000000000FEDE000-memory.dmp

Filesize
568KB

Download
memory/1620-56-0x0000000000000000-mapping.dmp

Download
memory/1620-57-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1944-71-0x00000000727C0000-0x0000000073CE8000-memory.dmp

Filesize
21.2MB

Download
memory/1944-66-0x0000000000000000-mapping.dmp

Download
memory/1944-68-0x00000000727C0000-0x0000000073CE8000-memory.dmp

Filesize
21.2MB

Download