Analysis
-
max time kernel
600s -
max time network
433s -
platform
windows7_x64 -
resource
win7-20220901-es -
resource tags
arch:x64arch:x86image:win7-20220901-eslocale:es-esos:windows7-x64systemwindows -
submitted
18-01-2023 23:39
Static task
static1
Behavioral task
behavioral1
Sample
AnyDeskAPP.msi
Resource
win7-20220901-es
Behavioral task
behavioral2
Sample
AnyDeskAPP.msi
Resource
win10v2004-20220812-es
General
-
Target
AnyDeskAPP.msi
-
Size
1.4MB
-
MD5
4e4a4a4eb6a77d72af83b2bbd0698593
-
SHA1
dbaeba54fcae50acc36565d0f61ad73df6df7d45
-
SHA256
58e9f60d0b951029578cc1054668bfee2f00cfa029cfbd01ea65c7f61713a40a
-
SHA512
69785dadc878bd1178672a8f08590eeccd268b4fd2107ae3909e59fba03e7cfa425f690580dfcfa1f5ec3e494e5ef0b7232a16a26c8fbf734ef3887da4044ccb
-
SSDEEP
24576:Y+rwxLNjY3Wx0ECIgYmfLVYeBZrWAv12h2SekeUuyZD6lvs0zqa3:TrMjYMZKumZrWAWTreUuyZD6lvVz9
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Wintoa.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Wintoa.exe -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 4 1056 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
Wintoa.exepid process 1156 Wintoa.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Wintoa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Wintoa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Wintoa.exe -
Loads dropped DLL 5 IoCs
Processes:
MsiExec.exepowershell.exepid process 940 MsiExec.exe 940 MsiExec.exe 940 MsiExec.exe 940 MsiExec.exe 1056 powershell.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Wintoa.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Wintoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ajtiivva = "C:\\proeminente\\corroborar\\Wintoa.exe" Wintoa.exe -
Processes:
Wintoa.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Wintoa.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in System32 directory 2 IoCs
Processes:
DrvInst.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF DrvInst.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Wintoa.exepid process 1156 Wintoa.exe -
Drops file in Windows directory 15 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\volsnap.PNF DrvInst.exe File created C:\Windows\Installer\6c9770.msi msiexec.exe File opened for modification C:\Windows\Installer\6c9770.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI983B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9F00.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIA71C.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI9B38.tmp msiexec.exe File created C:\Windows\Installer\6c9772.ipi msiexec.exe File created C:\Windows\Installer\6c9774.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA847.tmp msiexec.exe File opened for modification C:\Windows\Installer\6c9772.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d7436a962bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88AD9381-9789-11ED-BAA4-568CD4283F6A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380850225" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007291c4332ea83e4b904ac4b45206848f00000000020000000000106600000001000020000000cfd98c1a4e1743b9c6c70eccdd35ceae73ceac4f4cba92442d6c3d59aee31d41000000000e80000000020000200000005e1da9da410c83e9390705d3712184a7e4d04a20ef7b1a27d05977270ed14ce920000000e98f6ffe8dcde4c0e64c2752a17f158c0019e24c7ebf3f83ba29fa7a3b56f4e940000000d4528e52be6f72a26252e6ce7110c5d9300513b2b13343a35d7d65bfda91c630bdb97c189961f5e168e1f936bbf5c2634ac85bf5708c5ac97ed45f30c9548180 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\es-ES = "es-ES.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007291c4332ea83e4b904ac4b45206848f000000000200000000001066000000010000200000006df9e2bb2910e43f44d08a3487021332e7e39cd27b426cdbf73ea469ace1e89f000000000e80000000020000200000004dcf5547707c95eda64db3716ca88e032bf50026c139ba9ec6d33046cbc7cfcd900000008f2f57294de5d38b27f3c0e8b6a6ad776a15a309414d9250534cbf9bc9f40c69d243a14ff0c0a7fdc6d09c1ee153c8083d2d0f131e6e0433f088f3b18a714339d8adc37e52bf5335b9dd0f2b7829f4bf944fd007fad09dfcd759b2f1716d964e4633b455c53c0c16a9c94d0b0e9ab671e157f764b9bd8d48059af99edecfd367bdbb11b1a0bc9f67c353a64979872477400000009a45a7da953e8c35ba1bbc33d7b3ee42a98553e1bfacc2bdbe675d767fee089c28c5ad224b6c1cf679854de9c7dfc308268da21ee0a74652514db1cbe4a37228 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Modifies data under HKEY_USERS 52 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF\@%SystemRoot%\system32\dnsapi.dll,-103 = "Confianza en el servidor DNS (Sistema de nombres de dominio)" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF\LanguageList = 650073002d0045005300000065007300000065006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF\@%SystemRoot%\system32\qagentrt.dll,-10 = "AutenticaciĆ³n de mantenimiento del sistema" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Confianza de mismo nivel" DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF\@%SystemRoot%\System32\fveui.dll,-843 = "Cifrado de unidad BitLocker" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF\@%SystemRoot%\System32\fveui.dll,-844 = "Agente de recuperaciĆ³n de datos BitLocker" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe -
Modifies registry class 20 IoCs
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51\B48CCF9E9411D5C40B37663A245F8B16 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B48CCF9E9411D5C40B37663A245F8B16 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\PackageName = "AnyDeskAPP.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\ProductName = "AnyDesk" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Language = "1046" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B48CCF9E9411D5C40B37663A245F8B16\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\PackageCode = "7A53F5C34D4FDEE41A79AB069A0CCD7B" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\InstanceType = "0" msiexec.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msiexec.exepowershell.exeWintoa.exepid process 900 msiexec.exe 900 msiexec.exe 1056 powershell.exe 1056 powershell.exe 1056 powershell.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe 1156 Wintoa.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Wintoa.exepid process 1156 Wintoa.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 860 msiexec.exe Token: SeIncreaseQuotaPrivilege 860 msiexec.exe Token: SeRestorePrivilege 900 msiexec.exe Token: SeTakeOwnershipPrivilege 900 msiexec.exe Token: SeSecurityPrivilege 900 msiexec.exe Token: SeCreateTokenPrivilege 860 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 860 msiexec.exe Token: SeLockMemoryPrivilege 860 msiexec.exe Token: SeIncreaseQuotaPrivilege 860 msiexec.exe Token: SeMachineAccountPrivilege 860 msiexec.exe Token: SeTcbPrivilege 860 msiexec.exe Token: SeSecurityPrivilege 860 msiexec.exe Token: SeTakeOwnershipPrivilege 860 msiexec.exe Token: SeLoadDriverPrivilege 860 msiexec.exe Token: SeSystemProfilePrivilege 860 msiexec.exe Token: SeSystemtimePrivilege 860 msiexec.exe Token: SeProfSingleProcessPrivilege 860 msiexec.exe Token: SeIncBasePriorityPrivilege 860 msiexec.exe Token: SeCreatePagefilePrivilege 860 msiexec.exe Token: SeCreatePermanentPrivilege 860 msiexec.exe Token: SeBackupPrivilege 860 msiexec.exe Token: SeRestorePrivilege 860 msiexec.exe Token: SeShutdownPrivilege 860 msiexec.exe Token: SeDebugPrivilege 860 msiexec.exe Token: SeAuditPrivilege 860 msiexec.exe Token: SeSystemEnvironmentPrivilege 860 msiexec.exe Token: SeChangeNotifyPrivilege 860 msiexec.exe Token: SeRemoteShutdownPrivilege 860 msiexec.exe Token: SeUndockPrivilege 860 msiexec.exe Token: SeSyncAgentPrivilege 860 msiexec.exe Token: SeEnableDelegationPrivilege 860 msiexec.exe Token: SeManageVolumePrivilege 860 msiexec.exe Token: SeImpersonatePrivilege 860 msiexec.exe Token: SeCreateGlobalPrivilege 860 msiexec.exe Token: SeBackupPrivilege 684 vssvc.exe Token: SeRestorePrivilege 684 vssvc.exe Token: SeAuditPrivilege 684 vssvc.exe Token: SeBackupPrivilege 900 msiexec.exe Token: SeRestorePrivilege 900 msiexec.exe Token: SeRestorePrivilege 1156 DrvInst.exe Token: SeRestorePrivilege 1156 DrvInst.exe Token: SeRestorePrivilege 1156 DrvInst.exe Token: SeRestorePrivilege 1156 DrvInst.exe Token: SeRestorePrivilege 1156 DrvInst.exe Token: SeRestorePrivilege 1156 DrvInst.exe Token: SeRestorePrivilege 1156 DrvInst.exe Token: SeLoadDriverPrivilege 1156 DrvInst.exe Token: SeLoadDriverPrivilege 1156 DrvInst.exe Token: SeLoadDriverPrivilege 1156 DrvInst.exe Token: SeRestorePrivilege 900 msiexec.exe Token: SeTakeOwnershipPrivilege 900 msiexec.exe Token: SeRestorePrivilege 900 msiexec.exe Token: SeTakeOwnershipPrivilege 900 msiexec.exe Token: SeRestorePrivilege 900 msiexec.exe Token: SeTakeOwnershipPrivilege 900 msiexec.exe Token: SeRestorePrivilege 900 msiexec.exe Token: SeTakeOwnershipPrivilege 900 msiexec.exe Token: SeRestorePrivilege 900 msiexec.exe Token: SeTakeOwnershipPrivilege 900 msiexec.exe Token: SeRestorePrivilege 900 msiexec.exe Token: SeTakeOwnershipPrivilege 900 msiexec.exe Token: SeRestorePrivilege 900 msiexec.exe Token: SeTakeOwnershipPrivilege 900 msiexec.exe Token: SeRestorePrivilege 900 msiexec.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
msiexec.exepowershell.exeiexplore.exepid process 860 msiexec.exe 1056 powershell.exe 1056 powershell.exe 1728 iexplore.exe 860 msiexec.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEWintoa.exepid process 1728 iexplore.exe 1728 iexplore.exe 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1156 Wintoa.exe 1156 Wintoa.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
msiexec.exeMsiExec.exepowershell.exeiexplore.exedescription pid process target process PID 900 wrote to memory of 940 900 msiexec.exe MsiExec.exe PID 900 wrote to memory of 940 900 msiexec.exe MsiExec.exe PID 900 wrote to memory of 940 900 msiexec.exe MsiExec.exe PID 900 wrote to memory of 940 900 msiexec.exe MsiExec.exe PID 900 wrote to memory of 940 900 msiexec.exe MsiExec.exe PID 900 wrote to memory of 940 900 msiexec.exe MsiExec.exe PID 900 wrote to memory of 940 900 msiexec.exe MsiExec.exe PID 940 wrote to memory of 1056 940 MsiExec.exe powershell.exe PID 940 wrote to memory of 1056 940 MsiExec.exe powershell.exe PID 940 wrote to memory of 1056 940 MsiExec.exe powershell.exe PID 940 wrote to memory of 1056 940 MsiExec.exe powershell.exe PID 1056 wrote to memory of 1156 1056 powershell.exe Wintoa.exe PID 1056 wrote to memory of 1156 1056 powershell.exe Wintoa.exe PID 1056 wrote to memory of 1156 1056 powershell.exe Wintoa.exe PID 1056 wrote to memory of 1156 1056 powershell.exe Wintoa.exe PID 1728 wrote to memory of 1712 1728 iexplore.exe IEXPLORE.EXE PID 1728 wrote to memory of 1712 1728 iexplore.exe IEXPLORE.EXE PID 1728 wrote to memory of 1712 1728 iexplore.exe IEXPLORE.EXE PID 1728 wrote to memory of 1712 1728 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AnyDeskAPP.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9D0C4518612B2D032F8271757C9A0DF2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssA8D1.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiA89F.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrA8B0.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrA8C0.txt" -propSep " :<->: " -testPrefix "_testValue."3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\proeminente\corroborar\Wintoa.exe"C:\proeminente\corroborar\Wintoa.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005BC" "00000000000002C0"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pssA8D1.ps1Filesize
5KB
MD5fc1bb6c87fd1f08b534e52546561c53c
SHA1db402c5c1025cf8d3e79df7b868fd186243aa9d1
SHA256a04750ed5f05b82b90f6b8ea3748ba246af969757a5a4b74a0e25b186add520b
SHA5125495f4ac3c8f42394a82540449526bb8ddd91adf0a1a852a9e1f2d32a63858b966648b4099d9947d8ac68ee43824dacda24c337c5b97733905e36c4921280e86
-
C:\Users\Admin\AppData\Local\Temp\scrA8B0.ps1Filesize
17KB
MD57c5b73168b207a9c580eb62dd1588fef
SHA1cdd8f39b7a12aa0b3c62a3c0c19572976d0444dc
SHA2566d6b711685d829f27fcfe579853e43d993bf6e935085161d0dbee6abb43f60d5
SHA5127ea9836bc57698341d18154e1b76ea6d1ee67b68504c2076b7125374c63298a9bf3580b4d2c2936ab19d0831940bb927171b6ad5a46fb87caf7f43b2b82696f9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9B4DENMU.txtFilesize
603B
MD59ae8dbea2e579e39fe5a92e608cc82f0
SHA119af2b7f7685e0c9a764f079145116d7bcc5a777
SHA256d64089db24788792f42295d81b4f5d243c0a91c393a3dfe47f74a6bf8dccddfb
SHA512f7f276c67b5684e65b225941b5e7fe4180a2067bc642cb2d96c943a41623efbd75f942a631a869ab4d29ed3209d942140a1731fdad0173f3e06802c2e59c9721
-
C:\Windows\Installer\MSI983B.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSI9B38.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSI9F00.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
C:\Windows\Installer\MSIA847.tmpFilesize
574KB
MD57b7d9e2c9b8236e7155f2f97254cb40e
SHA199621fc9d14511428d62d91c31865fb2c4625663
SHA256df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897
SHA512fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228
-
C:\proeminente\corroborar\Wintoa.exeFilesize
5.5MB
MD5caa7805c7dc283359293bae074cb85ec
SHA1f21c4880fbf40b8f03ed8954263106d814ac014d
SHA256e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23
SHA512206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1
-
C:\proeminente\corroborar\Wintoa.exeFilesize
5.5MB
MD5caa7805c7dc283359293bae074cb85ec
SHA1f21c4880fbf40b8f03ed8954263106d814ac014d
SHA256e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23
SHA512206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1
-
C:\proeminente\corroborar\vendingFilesize
89.4MB
MD53c6ef07082ae5cd1cdbb4c272f1da202
SHA14bbc70f293110dae93746e8a1fe7c5a47d1f33ec
SHA2562bd1e88bcdd6377d1fa2a8f12b1ffec9c1a73e4aeea4a9eea31c359880a17b4c
SHA512432d6c249b4b000c5cdf9600f8ca3f7771e55d41152abbc398b70a5b8cc5bd3d867a7febbd7b4d07186a519b04a7f552aa25712c099b16ebdb4575a751c73ee9
-
\Windows\Installer\MSI983B.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
\Windows\Installer\MSI9B38.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
\Windows\Installer\MSI9F00.tmpFilesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
\Windows\Installer\MSIA847.tmpFilesize
574KB
MD57b7d9e2c9b8236e7155f2f97254cb40e
SHA199621fc9d14511428d62d91c31865fb2c4625663
SHA256df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897
SHA512fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228
-
\proeminente\corroborar\Wintoa.exeFilesize
5.5MB
MD5caa7805c7dc283359293bae074cb85ec
SHA1f21c4880fbf40b8f03ed8954263106d814ac014d
SHA256e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23
SHA512206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1
-
memory/860-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmpFilesize
8KB
-
memory/940-56-0x0000000000000000-mapping.dmp
-
memory/940-57-0x0000000075F11000-0x0000000075F13000-memory.dmpFilesize
8KB
-
memory/1056-71-0x0000000072060000-0x0000000073588000-memory.dmpFilesize
21.2MB
-
memory/1056-66-0x0000000000000000-mapping.dmp
-
memory/1056-70-0x0000000072060000-0x0000000073588000-memory.dmpFilesize
21.2MB
-
memory/1156-85-0x0000000000310000-0x000000000031D000-memory.dmpFilesize
52KB
-
memory/1156-90-0x0000000004360000-0x00000000043F7000-memory.dmpFilesize
604KB
-
memory/1156-80-0x0000000000E90000-0x0000000001FF0000-memory.dmpFilesize
17.4MB
-
memory/1156-81-0x0000000000E90000-0x0000000001FF0000-memory.dmpFilesize
17.4MB
-
memory/1156-82-0x0000000000E90000-0x0000000001FF0000-memory.dmpFilesize
17.4MB
-
memory/1156-83-0x0000000000E90000-0x0000000001FF0000-memory.dmpFilesize
17.4MB
-
memory/1156-78-0x0000000000E90000-0x0000000001FF0000-memory.dmpFilesize
17.4MB
-
memory/1156-77-0x0000000000E90000-0x0000000001FF0000-memory.dmpFilesize
17.4MB
-
memory/1156-86-0x000000000F850000-0x000000000FA13000-memory.dmpFilesize
1.8MB
-
memory/1156-76-0x0000000000E90000-0x0000000001FF0000-memory.dmpFilesize
17.4MB
-
memory/1156-89-0x0000000000510000-0x000000000052C000-memory.dmpFilesize
112KB
-
memory/1156-79-0x0000000077180000-0x0000000077300000-memory.dmpFilesize
1.5MB
-
memory/1156-91-0x000000000FB70000-0x000000000FBE9000-memory.dmpFilesize
484KB
-
memory/1156-92-0x0000000003850000-0x0000000003896000-memory.dmpFilesize
280KB
-
memory/1156-93-0x000000000FC20000-0x000000000FD50000-memory.dmpFilesize
1.2MB
-
memory/1156-98-0x0000000003900000-0x000000000392B000-memory.dmpFilesize
172KB
-
memory/1156-95-0x0000000010260000-0x000000001066B000-memory.dmpFilesize
4.0MB
-
memory/1156-102-0x0000000009ED0000-0x000000000F846000-memory.dmpFilesize
89.5MB
-
memory/1156-103-0x0000000077180000-0x0000000077300000-memory.dmpFilesize
1.5MB
-
memory/1156-104-0x0000000009ED0000-0x000000000F846000-memory.dmpFilesize
89.5MB
-
memory/1156-73-0x0000000000000000-mapping.dmp