0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
Size

1.6MB
MD5

b7b46aec06334c4e8b49a1bc7997ca0f
SHA1

6c5b43ed527b7c2add2e78f905dc477c601c9375
SHA256

0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980
SHA512

65b6611c1ea094297a31571056de645bcee5e0f37a497e0548f85b9c22d330fab3c53633d0d317a4dc8e9761d09eaced596850a5e74a071ac50adae0db3a5f9f
SSDEEP

24576:JBs2e9bXkMhHp1vye0j5i1CRSTKtrAH6JNemZbPwdHYl2zWIhVNveUt72pzbIzW6:PsZXNEbVSGrAajemZbPyYGWIhPt72BZo

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 18 IoCs

resource	yara_rule
behavioral1/memory/2256-0-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2424-64-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2464-89-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-93-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2424-102-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-104-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-109-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-112-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-115-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-120-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-123-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-126-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-129-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-132-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-135-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-138-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-141-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2256-144-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 19 IoCs

resource	yara_rule
behavioral1/memory/2256-0-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/files/0x0007000000015f65-5.dat	UPX
behavioral1/memory/2424-64-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2464-89-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-93-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2424-102-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-104-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-109-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-112-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-115-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-120-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-123-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-126-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-129-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-132-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-135-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-138-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-141-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2256-144-0x0000000000400000-0x000000000041E000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2256-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x0007000000015f65-5.dat	upx
behavioral1/memory/2424-64-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2464-89-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-93-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2424-102-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-104-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-109-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-112-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-115-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-120-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-123-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-126-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-129-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-132-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-135-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-138-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-141-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-144-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\M:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\N:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\O:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\S:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\H:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\K:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\X:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\V:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\Y:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\Z:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\A:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\B:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\G:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\I:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\R:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\U:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\W:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\J:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\L:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\P:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\Q:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File opened (read-only)	\??\T:	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\indian horse bukkake [bangbus] glans (Sandy,Sarah).zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish cum xxx catfight latex .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\SysWOW64\IME\shared\black nude hardcore girls pregnant .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\gay sleeping stockings (Sonja,Jade).mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\SysWOW64\config\systemprofile\black nude trambling hot (!) titts redhair (Tatjana).rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\SysWOW64\FxsTmp\italian nude horse hidden feet balls (Liz).avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\SysWOW64\IME\shared\swedish beastiality gay [bangbus] hole sweet (Karin).mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\System32\DriverStore\Temp\japanese nude trambling hot (!) castration .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\SysWOW64\FxsTmp\russian cumshot fucking lesbian hairy .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\danish action bukkake big feet swallow (Tatjana).avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\swedish nude blowjob [milf] hotel .avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Google\Update\Download\russian handjob beast licking titts stockings (Karin).rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\italian fetish trambling lesbian penetration .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\american beastiality beast voyeur 40+ (Sandy,Sarah).mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\japanese nude horse masturbation (Sylvia).mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\lesbian [milf] .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files\Common Files\Microsoft Shared\swedish porn gay voyeur hole .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files\DVD Maker\Shared\fucking [milf] black hairunshaved .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\tyrkish nude fucking catfight swallow (Ashley,Melissa).mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian kicking fucking hidden femdom .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files\Windows Journal\Templates\japanese gang bang fucking big young .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\japanese porn lingerie masturbation hole .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Google\Temp\indian horse gay hot (!) young .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\italian animal lesbian [bangbus] .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\swedish cum beast uncut feet mature (Karin).zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\norwegian sperm public redhair .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\fucking several models (Melissa).rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\porn hardcore [free] hole hotel (Liz).avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\bukkake several models circumcision .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\bukkake catfight sweet .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\fetish xxx several models upskirt (Jenna,Sarah).avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\japanese gang bang lingerie several models (Jade).avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\canadian lingerie [bangbus] feet .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\japanese porn sperm uncut stockings .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\assembly\temp\beast sleeping lady .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\indian handjob horse girls feet (Jenna,Sarah).avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\swedish porn trambling hot (!) .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish animal trambling girls 40+ (Ashley,Melissa).mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\british sperm hot (!) cock mistress (Janette).mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\horse blowjob masturbation YEâPSè& .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\american handjob hardcore public ejaculation (Jenna,Karin).avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\animal gay full movie ìï .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\beast girls glans .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\beast uncut titts (Britney,Samantha).mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\animal fucking lesbian (Karin).mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\horse big feet shower .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\mssrv.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\fetish gay voyeur shower .avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\sperm big .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\russian porn hardcore masturbation high heels .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\black fetish xxx hidden Ôë (Ashley,Sylvia).zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\lingerie catfight glans .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\action sperm hidden feet swallow (Sylvia).rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\handjob beast masturbation (Jade).mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\asian xxx licking (Melissa).mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\action beast [milf] cock bondage .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\american handjob xxx voyeur circumcision .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\assembly\tmp\swedish animal fucking big ìï .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\horse sperm several models feet (Jenna,Samantha).rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\italian action lingerie several models titts granny (Janette).zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\Downloaded Program Files\black horse beast sleeping hole bedroom (Melissa).mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\SoftwareDistribution\Download\bukkake sleeping sweet .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\horse sleeping cock .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\black action blowjob big fishy (Sonja,Liz).rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\danish gang bang gay uncut titts .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\canadian blowjob [bangbus] feet bedroom (Liz).zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\lesbian big swallow (Sonja,Karin).rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\chinese trambling public upskirt .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\tyrkish cumshot hardcore sleeping black hairunshaved .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\norwegian trambling several models (Curtney).mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\british lingerie masturbation hole .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\bukkake [bangbus] cock traffic (Janette).zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\handjob gay [free] .avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\fucking licking (Curtney).mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\brasilian fetish beast big cock .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\american cum sperm lesbian .avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\french gay sleeping granny .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\british trambling voyeur feet (Christine,Karin).avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish porn lingerie public .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\malaysia beast licking .mpg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\swedish fetish fucking [bangbus] leather .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\swedish nude sperm hot (!) glans hotel .avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\asian beast sleeping titts bedroom .zip.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\norwegian fucking masturbation (Curtney).avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\african lingerie full movie hole .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\beast hidden .mpeg.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\fucking girls cock leather .avi.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\japanese porn horse hidden glans boots .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\spanish trambling masturbation black hairunshaved .rar.exe	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
2464	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2424	2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe	28
PID 2256 wrote to memory of 2424	2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe	28
PID 2256 wrote to memory of 2424	2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe	28
PID 2256 wrote to memory of 2424	2256	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe	28
PID 2424 wrote to memory of 2464	2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe	29
PID 2424 wrote to memory of 2464	2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe	29
PID 2424 wrote to memory of 2464	2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe	29
PID 2424 wrote to memory of 2464	2424	0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe	29

C:\Users\Admin\AppData\Local\Temp\0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
"C:\Users\Admin\AppData\Local\Temp\0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
  "C:\Users\Admin\AppData\Local\Temp\0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe
    "C:\Users\Admin\AppData\Local\Temp\0b8b297b124ba42be10358d1c220a39758821ef2db51f25601b01154d64be980.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\swedish nude blowjob [milf] hotel .avi.exe

Filesize
2.0MB

MD5
19d736f1ac139d346e3a636871d33efd

SHA1
49251e4c6cf41a04535e68c74502cbd39ad60489

SHA256
57232efa165234609a0c5fe47442bba16c4155482995be2cba5a330e9bc5ca78

SHA512
280519091441a836471370d00c6c1d9c0f08b11e3cc5ea81b1abc1109fe31a8a1713ffaaf178cc00fc521b8b9cb9a5af9f70d7eaaf1a413370c39fc53b433bfa

Download Submit
C:\debug.txt

Filesize
183B

MD5
3f85cbea46560ad8d8a48f0e563992a9

SHA1
194a0ad5833ae6ec1a4d962c28992d0bd25808ee

SHA256
5af4d1530a1147ee122eefc43cbfb23edf6ffb04cc5a112b2f9a4029e14375e2

SHA512
365adca2d444a21e134b0dcc9f92aaf35c7e7f46b7bd95ea52d97dd1b74e99247fa275602c1b391ff4f3d0785821da16869d43d90bbdf2f6cdf52551982acf18

Download Submit
memory/2256-109-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-129-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-144-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-93-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-63-0x0000000000860000-0x000000000087E000-memory.dmp

Filesize
120KB

Download
memory/2256-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-104-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-107-0x0000000000860000-0x000000000087E000-memory.dmp

Filesize
120KB

Download
memory/2256-115-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-112-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-132-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-120-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-123-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-126-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2424-108-0x0000000001F90000-0x0000000001FAE000-memory.dmp

Filesize
120KB

Download
memory/2424-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2424-102-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2424-88-0x0000000001F90000-0x0000000001FAE000-memory.dmp

Filesize
120KB

Download
memory/2464-89-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download