Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 21:01
Behavioral task
behavioral1
Sample
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe
Resource
win10v2004-20240226-en
General
-
Target
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe
-
Size
293KB
-
MD5
6e702aa2906fd2794a236213be105658
-
SHA1
abf56f7b181e892f2e4464c3dada9271c8a76e26
-
SHA256
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac
-
SHA512
a29e496fb5a7a1153006b82be8e0427aebb78b63d88a2f8ec95e0737f0694582523a74819c5c9c5c22a9007d5242a92c5c82e67d7748403e97ed150ed9fd2b3d
-
SSDEEP
6144:VjluQoSiIo5RLZX2HHIECXKpjmLo3tj02tgA5/DF6Ne9CYU5BgioMF:VEQoSm/ZmHo8mLKBuAVDY/jbgdMF
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2200-105-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2692-108-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2960-110-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2200-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\sperm girls bedroom .zip.exe UPX behavioral1/memory/2692-56-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2960-89-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2200-105-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2692-108-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral1/memory/2960-110-0x0000000000400000-0x000000000041F000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2200-0-0x0000000000400000-0x000000000041F000-memory.dmp upx C:\Program Files\Windows Sidebar\Shared Gadgets\sperm girls bedroom .zip.exe upx behavioral1/memory/2692-56-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2960-89-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2200-105-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2692-108-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2960-110-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exedescription ioc process File opened (read-only) \??\E: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\H: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\J: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\M: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\O: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\R: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\U: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\W: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\A: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\G: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\L: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\N: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\Q: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\V: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\B: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\P: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\S: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\I: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\K: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\T: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\X: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\Y: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File opened (read-only) \??\Z: 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe -
Drops file in System32 directory 10 IoCs
Processes:
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian gang bang fucking licking glans granny .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\System32\DriverStore\Temp\horse masturbation shoes .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\SysWOW64\IME\shared\japanese beastiality fucking [bangbus] traffic .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\bukkake public .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\american animal horse catfight YEâPSè& .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\SysWOW64\FxsTmp\xxx [milf] feet .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\SysWOW64\IME\shared\beast [bangbus] 50+ .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\SysWOW64\config\systemprofile\beast [free] ejaculation .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\SysWOW64\FxsTmp\indian action trambling [bangbus] stockings .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\SysWOW64\config\systemprofile\american cum fucking licking hairy .avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe -
Drops file in Program Files directory 15 IoCs
Processes:
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exedescription ioc process File created C:\Program Files\Windows Journal\Templates\sperm girls titts .zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files\DVD Maker\Shared\italian beastiality sperm girls .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\lesbian big (Karin).mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Common Files\microsoft shared\danish action beast [free] swallow .zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Google\Update\Download\hardcore catfight hole .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\tyrkish horse fucking [milf] glans (Sonja,Liz).zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Google\Temp\indian cum lingerie big shower .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\japanese fetish blowjob big .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\blowjob [bangbus] boots .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\horse [bangbus] .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files\Common Files\Microsoft Shared\tyrkish horse xxx girls hotel .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\sperm girls bedroom .zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\japanese cumshot bukkake uncut glans lady .avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Microsoft Office\Templates\italian nude xxx full movie feet latex .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\beast girls high heels .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe -
Drops file in Windows directory 64 IoCs
Processes:
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\canadian gay public redhair .avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\horse hidden hole bedroom (Liz).mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\porn lingerie catfight feet .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\sperm big beautyfull .zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\spanish blowjob public glans .avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\french gay licking cock balls (Sarah).mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\malaysia beast catfight (Melissa).zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\japanese handjob fucking hot (!) hole .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\fetish xxx [free] .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\cum xxx [bangbus] bedroom .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\malaysia xxx full movie gorgeoushorny .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\malaysia hardcore public feet sm (Jade).mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\japanese porn bukkake several models cock (Christine,Liz).avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\danish handjob sperm girls feet girly .avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\fetish xxx masturbation penetration .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\sperm [milf] .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\russian handjob bukkake public stockings .zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\xxx hidden young (Britney,Janette).mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\hardcore licking hole mature (Sarah).avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\hardcore [bangbus] .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\tyrkish fetish beast [bangbus] bedroom (Sonja,Liz).mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian cum bukkake big lady .zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\animal beast catfight high heels .avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\danish cum bukkake [milf] .zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\security\templates\lingerie sleeping cock .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\animal trambling public titts gorgeoushorny .zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\kicking xxx girls sweet .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\swedish handjob hardcore [bangbus] feet (Britney,Samantha).zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\russian cumshot lesbian sleeping cock sweet .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\mssrv.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\blowjob uncut black hairunshaved .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\tyrkish horse hardcore uncut granny .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\horse several models .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\italian handjob lingerie big black hairunshaved .avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\Downloaded Program Files\brasilian gang bang xxx masturbation swallow .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\blowjob sleeping blondie .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\kicking lingerie [milf] shoes .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\black fetish trambling girls ìï .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\russian beastiality xxx public .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\norwegian fucking hidden traffic .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\spanish bukkake several models titts ash (Karin).avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\animal gay [milf] swallow (Christine,Samantha).zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\russian porn lingerie [milf] .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\assembly\tmp\spanish horse public feet leather .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\chinese lesbian masturbation shower .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\spanish trambling public bedroom .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\blowjob several models glans .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\brasilian animal blowjob licking cock .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\sperm sleeping .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\russian handjob fucking hot (!) hole circumcision .rar.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\american handjob beast full movie YEâPSè& (Britney,Liz).zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\black animal hardcore sleeping hole pregnant (Jade).zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\brasilian nude fucking hidden circumcision .avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\german bukkake licking blondie (Britney,Liz).mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\porn horse hidden YEâPSè& (Anniston,Samantha).mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\tyrkish kicking bukkake hidden castration .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\canadian lesbian [milf] (Liz).mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\asian fucking hot (!) 50+ .mpeg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\lingerie hot (!) 40+ .avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\SoftwareDistribution\Download\xxx voyeur feet traffic (Sylvia).avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\spanish fucking several models pregnant (Jenna,Samantha).mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\indian beastiality sperm hot (!) blondie .mpg.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\russian nude beast uncut ìï (Gina,Melissa).zip.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\french fucking full movie hairy (Sandy,Samantha).avi.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exepid process 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 2960 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exedescription pid process target process PID 2200 wrote to memory of 2692 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe PID 2200 wrote to memory of 2692 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe PID 2200 wrote to memory of 2692 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe PID 2200 wrote to memory of 2692 2200 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe PID 2692 wrote to memory of 2960 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe PID 2692 wrote to memory of 2960 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe PID 2692 wrote to memory of 2960 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe PID 2692 wrote to memory of 2960 2692 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe 4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe"C:\Users\Admin\AppData\Local\Temp\4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe"C:\Users\Admin\AppData\Local\Temp\4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe"C:\Users\Admin\AppData\Local\Temp\4d242a0dfa7657a6844fd63477dc9d2a60d44deebceb14fb6d03a3a2bea04eac.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\sperm girls bedroom .zip.exeFilesize
1.8MB
MD509b73e6e7ad9161990c72a527ef32737
SHA1f51ef3e872c422bf47b465e28f1635a9cad4a3c6
SHA256f3f3259d41741317e94be3b4495b5931cc0eae5f02ff315a76faa1af80284f66
SHA512d3c5d6bcaa038c5dd41742a55149ac9f0d3dfb16a70aa4b919ff1d76a1dbf70933e022a52fbd136e4adc4932fd148193072e42ab796636ecfd30a93fa5859806
-
C:\debug.txtFilesize
146B
MD51addf422d92c32f5947a34298b231e42
SHA147735f9efb3434cedc08ad3ecd929c322f15af63
SHA256af4710a272515d5572cf659c9ba5be0a81e7c167f50f482cbdf86a6fb3c5697e
SHA5126c8e9f886869086634bc458cbb77f238d8500ba6b30ff2dd5924592611f3454945674dd3c112c4916c646a55f844b84e93dc4a6d3bfd7656e7ad225dbadf8e3b
-
memory/2200-0-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2200-55-0x00000000045A0000-0x00000000045BF000-memory.dmpFilesize
124KB
-
memory/2200-105-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2200-107-0x00000000045A0000-0x00000000045BF000-memory.dmpFilesize
124KB
-
memory/2692-56-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2692-88-0x0000000001F10000-0x0000000001F2F000-memory.dmpFilesize
124KB
-
memory/2692-108-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2692-109-0x0000000001F10000-0x0000000001F2F000-memory.dmpFilesize
124KB
-
memory/2960-89-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2960-110-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB