80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
Size

1.3MB
MD5

42bf4f91a485b79ca3e8ffd30bfdfe75
SHA1

0b326f78a366d3b26fdab93dd8c32e63224053db
SHA256

80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737
SHA512

041c0ae6420ffcadd0a6e3c375461b60b2b9dbc710a58c830c120a03fb78e83d5caf01ba09819900a1a89da250743e45456627381bba2d7808a23f85662a912b
SSDEEP

24576:V6nnUcDz4RO/aHnE83B2iQ1o1SJ2SvwAfO5Aw4VCOVYLoq+KORyfXxonwh:WU0kRflUiQJ2SvwAfM6COVYkDNRyfho6

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 17 IoCs

resource	yara_rule
behavioral1/memory/1984-89-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2472-91-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1728-92-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-103-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-104-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-108-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-111-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-114-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-119-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-122-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-125-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-128-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-131-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-134-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-137-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-140-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1984-143-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 21 IoCs

resource	yara_rule
behavioral1/memory/1984-0-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/files/0x0007000000014b27-5.dat	UPX
behavioral1/memory/2472-51-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1728-82-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-89-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2472-91-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1728-92-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-103-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-104-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-108-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-111-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-114-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-119-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-122-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-125-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-128-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-131-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-134-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-137-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-140-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1984-143-0x0000000000400000-0x000000000041E000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1984-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x0007000000014b27-5.dat	upx
behavioral1/memory/2472-51-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1728-82-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-89-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2472-91-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1728-92-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-103-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-104-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-108-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-111-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-114-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-119-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-122-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-125-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-128-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-131-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-134-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-137-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-140-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1984-143-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\V:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\W:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\K:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\L:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\O:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\U:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\H:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\P:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\S:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\M:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\N:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\X:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\Y:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\Z:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\B:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\I:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\J:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\R:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\T:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\A:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\E:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File opened (read-only)	\??\G:	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FxsTmp\gang bang full movie vagina blondie .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\SysWOW64\IME\shared\german trambling girls young .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\african sperm handjob lesbian vagina granny .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\SysWOW64\config\systemprofile\french xxx kicking several models .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\german cumshot sleeping penetration .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\SysWOW64\FxsTmp\norwegian beast sperm sleeping .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\SysWOW64\config\systemprofile\french beast porn public feet (Anniston).mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\beastiality bukkake [bangbus] nipples leather (Samantha,Curtney).avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\System32\DriverStore\Temp\action gang bang full movie boobs high heels (Gina,Sandy).mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\SysWOW64\IME\shared\chinese gay trambling hot (!) mistress (Sarah).zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\handjob several models hotel .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\italian lesbian hidden nipples .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\german porn porn hidden (Ashley).zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\fucking sleeping .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\norwegian porn blowjob catfight Œß .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Google\Temp\german trambling voyeur boobs lady .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Google\Update\Download\french gang bang [milf] feet (Jade,Tatjana).zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\norwegian hardcore [free] sweet .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\canadian blowjob uncut (Karin).avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files\Windows Journal\Templates\french gang bang action [milf] .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\swedish lesbian animal hidden castration (Jenna,Ashley).zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\norwegian gang bang horse hidden .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\tyrkish porn public .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files\DVD Maker\Shared\horse masturbation legs sweet (Jenna).avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\lesbian lesbian .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\fucking gay several models hole .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\horse full movie ash ash .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\african trambling big .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\InstallTemp\black action lesbian beautyfull .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\handjob cumshot full movie legs blondie .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\hardcore public vagina sweet .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\brasilian xxx bukkake [milf] .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\cumshot licking (Samantha,Samantha).mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\fetish beastiality [free] (Sonja,Karin).zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\handjob gang bang voyeur pregnant .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\nude xxx public .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\action [free] gorgeoushorny (Gina).avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\spanish blowjob big gorgeoushorny (Britney,Samantha).mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\african action licking 40+ .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\spanish handjob horse uncut boobs .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\beast masturbation castration (Gina,Karin).mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\Temp\canadian cumshot public boobs redhair .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\italian bukkake voyeur lady .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\assembly\temp\handjob lesbian girls bedroom .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\black trambling [milf] .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\animal uncut wifey .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\handjob lesbian .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\handjob [free] ash circumcision .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\danish fetish gay lesbian legs bondage (Janette).rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\british lesbian cumshot [bangbus] boobs bondage .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\asian fucking [milf] ash .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\american action licking .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\norwegian hardcore horse masturbation (Sylvia).zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\indian trambling [milf] .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\SoftwareDistribution\Download\swedish beastiality uncut .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\animal nude lesbian circumcision (Ashley).avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\beast blowjob girls .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\african hardcore horse hot (!) pregnant .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\tyrkish lesbian sleeping (Sylvia).mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\gang bang [milf] shower (Gina).mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\nude full movie cock hairy .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\indian lingerie cum [milf] (Janette,Karin).rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\beast blowjob lesbian vagina redhair .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\brasilian porn sperm voyeur cock (Kathrin,Liz).zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\horse lesbian .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\fetish licking .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\kicking cumshot hot (!) granny .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\norwegian animal hot (!) beautyfull (Anniston).mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\action fucking sleeping .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\trambling big lady (Sarah,Sonja).mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\beast voyeur cock leather .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\indian gay voyeur hole .mpeg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\italian xxx handjob hot (!) (Karin,Ashley).rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\gay masturbation ìï .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\hardcore sperm catfight circumcision .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\mssrv.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\handjob sperm [bangbus] hole .zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\russian animal bukkake [bangbus] stockings .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\norwegian handjob voyeur traffic .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\tyrkish blowjob lingerie [milf] feet .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\gay licking (Sandy).zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\spanish action [free] legs high heels .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\horse uncut .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\beastiality gang bang catfight legs (Jenna,Gina).zip.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\horse catfight stockings .avi.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\asian gang bang handjob girls bedroom .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\lesbian action voyeur shoes .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\lingerie catfight ejaculation .mpg.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\trambling fucking sleeping ìï .rar.exe	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
1728	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2472	1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe	28
PID 1984 wrote to memory of 2472	1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe	28
PID 1984 wrote to memory of 2472	1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe	28
PID 1984 wrote to memory of 2472	1984	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe	28
PID 2472 wrote to memory of 1728	2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe	29
PID 2472 wrote to memory of 1728	2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe	29
PID 2472 wrote to memory of 1728	2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe	29
PID 2472 wrote to memory of 1728	2472	80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe	29

C:\Users\Admin\AppData\Local\Temp\80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
"C:\Users\Admin\AppData\Local\Temp\80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
  "C:\Users\Admin\AppData\Local\Temp\80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Users\Admin\AppData\Local\Temp\80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe
    "C:\Users\Admin\AppData\Local\Temp\80d539fce1529a864595fda4160dffd2c1956fe6f9b7ae5303c4825201031737.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\swedish lesbian animal hidden castration (Jenna,Ashley).zip.exe

Filesize
1.7MB

MD5
217b9358f24c9093cae1456b5c9b4f43

SHA1
3e3ff836f99bf68038d87dabc2a6abe5d0056438

SHA256
33d167eb963eb36027f816e573171eb5f0d343b1b5d5a4dd0766454ca21974d2

SHA512
4f6ef0e201f9cbd53859fb75f48f9500b396a976c8bb9c17858b6ac95ebaa943ce7a6da915751666b01535250988baddfabc0841d20a787e5fd3a97e606d3c89

Download Submit
memory/1728-82-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1728-92-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-106-0x0000000004F00000-0x0000000004F1E000-memory.dmp

Filesize
120KB

Download
memory/1984-111-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-89-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-143-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-103-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-104-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-108-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-50-0x0000000004F00000-0x0000000004F1E000-memory.dmp

Filesize
120KB

Download
memory/1984-114-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-119-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-122-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-125-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-128-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-131-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1984-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2472-51-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2472-91-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download