Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 18:31
Behavioral task
behavioral1
Sample
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe
Resource
win10v2004-20240419-en
General
-
Target
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe
-
Size
1.9MB
-
MD5
41716442fdae7489c3c83e6ee298340e
-
SHA1
ce612f4b85788c634934e359e09a35de0669b812
-
SHA256
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d
-
SHA512
ff0c3c4003f8801c350a88c98a8463e6e5925b0a44aadafd5bbe9046f929bb6497c56399a7f97b42b498e943115d932c3a8d2179ea839aa3a0b2b7a6ac4361ce
-
SSDEEP
49152:d9YbpbswXK+YZ/seEDzOpFbECcoOsMM2eQz6PiTra1XImPR:d9YyO8sZn6bvcJxeo6a3a1XIk
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2416-71-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1908-104-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2416-107-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2352-110-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1908-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\russian lesbian masturbation feet (Anniston,Curtney).zip.exe UPX behavioral1/memory/2416-71-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2416-87-0x0000000004CD0000-0x0000000004CEF000-memory.dmp UPX behavioral1/memory/2352-88-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/1908-104-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2416-107-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2416-109-0x0000000004CD0000-0x0000000004CEF000-memory.dmp UPX behavioral1/memory/2352-110-0x0000000000400000-0x000000000041F000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1908-0-0x0000000000400000-0x000000000041F000-memory.dmp upx C:\Program Files\Windows Sidebar\Shared Gadgets\russian lesbian masturbation feet (Anniston,Curtney).zip.exe upx behavioral1/memory/2416-71-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2416-87-0x0000000004CD0000-0x0000000004CEF000-memory.dmp upx behavioral1/memory/2352-88-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1908-104-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2416-107-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2416-109-0x0000000004CD0000-0x0000000004CEF000-memory.dmp upx behavioral1/memory/2352-110-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exedescription ioc process File opened (read-only) \??\O: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\Q: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\U: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\W: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\E: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\I: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\K: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\L: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\Z: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\B: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\H: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\P: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\S: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\G: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\M: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\N: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\R: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\T: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\V: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\X: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\Y: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\A: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File opened (read-only) \??\J: 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe -
Drops file in System32 directory 10 IoCs
Processes:
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exedescription ioc process File created C:\Windows\SysWOW64\FxsTmp\beastiality sperm big .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\SysWOW64\IME\shared\russian blowjob [milf] nipples balls .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\SysWOW64\config\systemprofile\canadian porn gang bang masturbation Ôë .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\SysWOW64\IME\shared\norwegian fetish [bangbus] shoes .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian gang bang cumshot [free] .zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\SysWOW64\FxsTmp\canadian gay big YEâPSè& (Sonja,Melissa).zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\SysWOW64\config\systemprofile\french hardcore uncut granny .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian fetish full movie leather .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\System32\DriverStore\Temp\handjob lingerie [milf] stockings .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\indian gang bang hidden vagina (Tatjana,Ashley).mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe -
Drops file in Program Files directory 15 IoCs
Processes:
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\hardcore [bangbus] .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files\DVD Maker\Shared\russian gay horse [milf] ash 50+ .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Common Files\microsoft shared\british sperm blowjob catfight sm .zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\danish lesbian girls YEâPSè& (Kathrin,Tatjana).mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Microsoft Office\Templates\brasilian kicking sleeping ejaculation .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\xxx big (Sonja,Curtney).zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files\Windows Journal\Templates\russian horse licking cock ash .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\russian lesbian masturbation feet (Anniston,Curtney).zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Google\Temp\danish xxx blowjob [bangbus] .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\canadian cumshot full movie .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\spanish fucking [free] cock gorgeoushorny .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Google\Update\Download\fucking girls boobs (Liz).rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\xxx blowjob licking hotel .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\cum lingerie uncut ejaculation .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\beast voyeur high heels .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe -
Drops file in Windows directory 64 IoCs
Processes:
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exedescription ioc process File created C:\Windows\ServiceProfiles\NetworkService\Downloads\danish lesbian beastiality hidden vagina stockings .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\SoftwareDistribution\Download\nude full movie .zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\canadian xxx uncut .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\american beastiality gay full movie nipples girly .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\canadian nude horse lesbian .zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\french beast fetish hot (!) vagina femdom (Curtney).zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\danish sperm catfight (Karin).mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\japanese cum handjob [milf] feet .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\norwegian xxx gang bang girls wifey (Sylvia).avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\fetish animal sleeping cock (Sandy).mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\mssrv.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\malaysia lingerie hidden vagina (Sonja,Melissa).zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\asian action cum hot (!) .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\cum beast [bangbus] nipples (Sonja,Tatjana).mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\tyrkish blowjob blowjob big bondage .zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\InstallTemp\cum lesbian .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\sperm catfight hairy (Sarah).mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\italian horse fetish hidden boots .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\french fucking sperm full movie hole ash .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\temp\russian kicking big girly (Britney).zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\asian beastiality horse hot (!) (Samantha,Sarah).zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\beastiality trambling big .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\trambling lesbian .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\beastiality handjob full movie 50+ (Jenna,Kathrin).rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\malaysia handjob [bangbus] hole .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\italian horse trambling uncut traffic .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\brasilian fucking xxx sleeping glans stockings .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\canadian action hot (!) shoes .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\indian handjob lesbian cock .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\italian sperm girls titts .zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\norwegian lesbian porn [bangbus] sm .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\cumshot trambling girls hole young (Tatjana,Christine).avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\swedish lesbian lesbian 40+ .zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\lingerie handjob licking feet .zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\animal sleeping .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\swedish horse uncut .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\british porn kicking several models .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\kicking porn [bangbus] cock (Janette).mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\trambling public girly (Samantha,Anniston).rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\tyrkish blowjob big .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\cum lesbian .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\fucking horse masturbation ejaculation .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\security\templates\bukkake catfight shower .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\action licking ìï (Samantha,Jade).mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\lingerie hidden ash .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\german fetish hidden titts shoes .zip.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\gay masturbation vagina .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\asian trambling [milf] legs black hairunshaved .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\animal horse full movie .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\swedish fucking hidden young (Ashley).avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\german hardcore catfight bedroom .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\handjob horse hot (!) YEâPSè& .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\tyrkish cumshot horse uncut shower .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\brasilian gang bang hidden mature .rar.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\gang bang lesbian (Jade,Jade).mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\cumshot hidden lady (Tatjana,Karin).mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\german lingerie lingerie voyeur black hairunshaved .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\black cumshot action [free] ìï (Karin).mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\asian fetish beastiality uncut .avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\african xxx public hole .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\indian animal full movie .mpg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\xxx catfight circumcision .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\chinese xxx lesbian sleeping (Janette,Curtney).avi.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\malaysia handjob beastiality lesbian titts traffic .mpeg.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exepid process 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 2352 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exedescription pid process target process PID 1908 wrote to memory of 2416 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe PID 1908 wrote to memory of 2416 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe PID 1908 wrote to memory of 2416 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe PID 1908 wrote to memory of 2416 1908 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe PID 2416 wrote to memory of 2352 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe PID 2416 wrote to memory of 2352 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe PID 2416 wrote to memory of 2352 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe PID 2416 wrote to memory of 2352 2416 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe 0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe"C:\Users\Admin\AppData\Local\Temp\0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe"C:\Users\Admin\AppData\Local\Temp\0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe"C:\Users\Admin\AppData\Local\Temp\0bc1a1d38a258906fb405e8c08aba0368ad8ed1ee04c7bcc6415ae0f8928833d.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\russian lesbian masturbation feet (Anniston,Curtney).zip.exeFilesize
1.4MB
MD5d15e386dd995d68013aa3714df94f8ba
SHA179f5e48cd5ee571b491654781e24bcd9c683f47d
SHA2568b8ce3add43446704c9c8a219b8c9d4d6c8961afd38fed262945f01ebe57da14
SHA512a98a8885b0060aff92215f848e48b1ba21a5a93e1d0716887577024ac840a8f9574d71fc3077fac6fbc756185cb71ffdcebcc3a86a1389a0275b3b9be1a26b78
-
memory/1908-0-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1908-70-0x0000000005CC0000-0x0000000005CDF000-memory.dmpFilesize
124KB
-
memory/1908-104-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1908-106-0x0000000005CC0000-0x0000000005CDF000-memory.dmpFilesize
124KB
-
memory/2352-88-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2352-110-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2416-71-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2416-87-0x0000000004CD0000-0x0000000004CEF000-memory.dmpFilesize
124KB
-
memory/2416-107-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2416-109-0x0000000004CD0000-0x0000000004CEF000-memory.dmpFilesize
124KB