Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe
Resource
win10v2004-20240508-en
General
-
Target
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe
-
Size
1.8MB
-
MD5
0d42984a7c254df155c6cb70dff193b2
-
SHA1
52118322bb9b109f8c2f582344842c04f7f948ce
-
SHA256
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34
-
SHA512
845a7130f087b30162296a64316b176d95dff1ab899825a152a8c7d25e93e4bc57d8e20267c16a9f4db37ef66b7e95c4f7492bbcacd16b9c9c40f7d6cd5e831b
-
SSDEEP
49152:gp//YRTeWBGTNJtU9lL7nNXWy9GIdwv8y3iLYrr/:+//YxRMp8l/dWEGIk34YrL
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 16 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-69-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-93-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1820-103-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-104-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-109-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-112-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-115-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-120-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-123-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-126-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-129-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-132-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-135-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-138-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-141-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2712-144-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2712-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\norwegian fetish cumshot hidden redhair (Janette,Christine).rar.exe UPX behavioral1/memory/2192-69-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/1820-89-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-93-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/1820-103-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-104-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-109-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-112-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-115-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-120-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-123-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-126-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-129-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-132-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-135-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-138-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-141-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2712-144-0x0000000000400000-0x000000000041C000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exedescription ioc process File opened (read-only) \??\U: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\V: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\W: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\X: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\N: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\O: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\P: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\Q: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\H: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\I: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\E: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\K: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\S: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\L: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\M: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\R: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\T: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\A: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\B: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\G: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\J: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\Y: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File opened (read-only) \??\Z: cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe -
Drops file in System32 directory 10 IoCs
Processes:
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exedescription ioc process File created C:\Windows\System32\DriverStore\Temp\swedish gang bang girls latex .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\beastiality lingerie voyeur redhair .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\SysWOW64\IME\shared\chinese horse animal full movie wifey .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\SysWOW64\config\systemprofile\canadian horse public .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\chinese trambling public bondage (Sonja).rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\SysWOW64\FxsTmp\beastiality hidden (Christine,Curtney).mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\SysWOW64\config\systemprofile\french lingerie [bangbus] mature .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\cum voyeur .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\SysWOW64\FxsTmp\bukkake public .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\SysWOW64\IME\shared\black kicking bukkake big ejaculation .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe -
Drops file in Program Files directory 15 IoCs
Processes:
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exedescription ioc process File created C:\Program Files\Windows Journal\Templates\cum action big girly .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Google\Update\Download\tyrkish horse kicking masturbation shower .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\swedish porn hidden .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\trambling [free] ash latex (Jenna,Melissa).rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files\DVD Maker\Shared\british horse porn public .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\chinese fetish sleeping boobs redhair .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian beastiality trambling licking ¤ã (Ashley,Janette).zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files\Common Files\Microsoft Shared\asian animal lingerie public stockings .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Common Files\microsoft shared\blowjob sleeping shoes .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Google\Temp\black beast horse girls .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Microsoft Office\Templates\hardcore lingerie [free] latex .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\beast cum voyeur (Jenna,Samantha).mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\norwegian fetish cumshot hidden redhair (Janette,Christine).rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\blowjob hardcore hidden (Janette,Sandy).zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\black porn hot (!) glans .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe -
Drops file in Windows directory 64 IoCs
Processes:
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exedescription ioc process File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\indian gang bang hot (!) granny .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\beast sperm public (Sonja,Christine).mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\xxx big boobs .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\horse several models ash high heels .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\bukkake hot (!) legs redhair .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\lesbian handjob masturbation legs (Kathrin,Britney).mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\cumshot sleeping hairy .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\italian cum nude [free] tÛ (Melissa).mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\xxx handjob big .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\french lesbian fetish masturbation cock swallow .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\blowjob big balls (Gina,Christine).rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\mssrv.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\action xxx hidden boobs 50+ (Janette,Ashley).avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\swedish blowjob cum masturbation boobs gorgeoushorny .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\british horse xxx hidden granny (Curtney,Tatjana).rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\fetish action licking cock young .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\swedish beast voyeur feet YEâPSè& .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\german nude action [milf] .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\american beast lingerie voyeur .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\canadian animal masturbation circumcision .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\canadian fucking beast full movie ash girly .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\spanish nude nude licking .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\horse public sm .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\beast animal [bangbus] ejaculation .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\horse [bangbus] fishy .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\norwegian beast hot (!) cock .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\asian sperm voyeur .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\american porn lesbian bedroom (Britney).zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\italian action lingerie [free] ash .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\indian bukkake [free] .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\gang bang action masturbation high heels .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\action masturbation latex .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\canadian horse lingerie voyeur YEâPSè& (Ashley).avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\japanese nude several models (Sarah).mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\spanish bukkake licking black hairunshaved (Jade).avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\beast [bangbus] boots .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\black gay fucking girls ejaculation .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\canadian gang bang xxx sleeping sweet .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\danish xxx gay voyeur 50+ .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\french horse beast [bangbus] boobs .rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\french beast trambling masturbation nipples .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\lesbian nude hot (!) balls .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\danish sperm horse [bangbus] upskirt .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\xxx lesbian big .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\Temp\lingerie hidden leather .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\french lesbian [bangbus] (Anniston).avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\sperm masturbation young (Samantha,Gina).rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\fetish licking cock redhair (Karin).rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\brasilian kicking masturbation (Sandy,Anniston).zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\beastiality lingerie hot (!) black hairunshaved (Sonja,Britney).mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\japanese hardcore gang bang uncut hairy .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\french lingerie beast [milf] beautyfull .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\xxx beastiality licking mature .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\blowjob cum hot (!) pregnant .avi.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\russian gay licking fishy .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\hardcore hidden boobs .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\handjob gay lesbian shower (Sandy).rar.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\beast lesbian (Sandy).mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\british kicking horse full movie balls .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\action porn several models boots .mpeg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\horse action [bangbus] ash .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\bukkake kicking public legs high heels .zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\action horse hot (!) .mpg.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\british blowjob [free] ash femdom (Sarah,Britney).zip.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.execad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.execad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exepid process 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe 1820 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.execad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exedescription pid process target process PID 2712 wrote to memory of 2192 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe PID 2712 wrote to memory of 2192 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe PID 2712 wrote to memory of 2192 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe PID 2712 wrote to memory of 2192 2712 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe PID 2192 wrote to memory of 1820 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe PID 2192 wrote to memory of 1820 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe PID 2192 wrote to memory of 1820 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe PID 2192 wrote to memory of 1820 2192 cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe"C:\Users\Admin\AppData\Local\Temp\cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe"C:\Users\Admin\AppData\Local\Temp\cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe"C:\Users\Admin\AppData\Local\Temp\cad492e3f18edef27989de4c056d66394971d5dd7f873aecbf1c27430d1f4b34.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\norwegian fetish cumshot hidden redhair (Janette,Christine).rar.exeFilesize
1.9MB
MD55f274a0d30f6877443f1faa98098fb1b
SHA11b5cf8c17361490016f138e7784e0b4c107f4bac
SHA256867ea83a2efd54a04b1535391a2c786b8db7cccebe860fa7424f648b7a8eae1b
SHA512a43bd6fd19549712abe9e177bf86d8949c4a69e939f0b0744dbea6e20e70c030fbede809cd6b5c9b43a3a0f526ef833bfd5f80cfd8b0283e74b5c7f36b1a4233
-
memory/1820-89-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1820-103-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2192-108-0x0000000004DD0000-0x0000000004DEC000-memory.dmpFilesize
112KB
-
memory/2192-69-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2192-88-0x0000000004DD0000-0x0000000004DEC000-memory.dmpFilesize
112KB
-
memory/2712-112-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-123-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-104-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-107-0x0000000004C70000-0x0000000004C8C000-memory.dmpFilesize
112KB
-
memory/2712-0-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-109-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-68-0x0000000004C70000-0x0000000004C8C000-memory.dmpFilesize
112KB
-
memory/2712-115-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-120-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-93-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-126-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-129-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-132-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-135-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-138-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-141-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2712-144-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB