Analysis
-
max time kernel
270s -
max time network
274s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 15:01
Behavioral task
behavioral1
Sample
WALM_ODM950324V2A_2021070200133021000011.pdf
Resource
win10v2004-20220812-en
General
-
Target
WALM_ODM950324V2A_2021070200133021000011.pdf
-
Size
65KB
-
MD5
c335d1615efe3c0d6b2ea9493d69b635
-
SHA1
14b11432f4abd6cea9548588b37076efda16e819
-
SHA256
7f98d431d04307ffe4e8efecfe8176ab3db3c32fc12c1fafcb8bd5e8a2a344a6
-
SHA512
5cd9d3e9fdafcd062d472c1c8ce00466ee7d702a59d32802a4a1e38ab8aa3048d123a7bf46b667fdb592b86b8c96e1795d45db48f8f8a1ec4069f2c47575a4c7
-
SSDEEP
1536:mOjK4XLtfSTn8DGfHsf9gf5JpcQg86Ay7Q72TDFr:m94xkn80Mf9g6NAy79B
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\71a37af7-a053-4ef4-ae3b-143c977c407d.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221004170327.pma setup.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
AcroRd32.exemsedge.exemsedge.exeidentity_helper.exemsedge.exechrome.exechrome.exechrome.exepid process 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 3432 msedge.exe 3432 msedge.exe 3864 msedge.exe 3864 msedge.exe 4332 identity_helper.exe 4332 identity_helper.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 6032 msedge.exe 996 chrome.exe 996 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 372 chrome.exe 372 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
Processes:
msedge.exechrome.exepid process 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
Processes:
AcroRd32.exemsedge.exechrome.exepid process 4388 AcroRd32.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe 6120 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe 4388 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 4388 wrote to memory of 4992 4388 AcroRd32.exe RdrCEF.exe PID 4388 wrote to memory of 4992 4388 AcroRd32.exe RdrCEF.exe PID 4388 wrote to memory of 4992 4388 AcroRd32.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1720 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe PID 4992 wrote to memory of 1512 4992 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WALM_ODM950324V2A_2021070200133021000011.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EC2382EA1504D9206AE6014FDBFE6112 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=211FED81A4FFB03350D7345555C4D190 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=211FED81A4FFB03350D7345555C4D190 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=63117A4F28B28FBECC9E6ABE415617A3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=63117A4F28B28FBECC9E6ABE415617A3 --renderer-client-id=4 --mojo-platform-channel-handle=2172 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=92D971975002680D100E77575E5C1B30 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=33827160931CC0EB188B368AF016860E --mojo-platform-channel-handle=1820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=602AC5CC3275CEAC845CBE49E3FF9F3E --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sac7.factsforce.shop/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd.php2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ff8cbaf46f8,0x7ff8cbaf4708,0x7ff8cbaf47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5468 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4184 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff653385460,0x7ff653385470,0x7ff6533854804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2588 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5460 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6196 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1772 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,2918731207380798100,5094383347670174111,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1260 /prefetch:83⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8db7c4f50,0x7ff8db7c4f60,0x7ff8db7c4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1696 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2368 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4564 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4536 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,13219520258903802156,10364260987505137443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
471B
MD5d506206ae44ba97a587f6642447f2440
SHA1538408d6bb9bc9ec075349b199e725fb683af3f0
SHA2566f68c5c0a48f4dc7052e1158b2617e74b1d43e52e47d84daf02b5919c2df0dcc
SHA512ba6c9794b64e1c5d6087d6527c69484287b2a91790a99d83004a5382735de1ce9499a6f9af03dfae601b7aa86e9f4b25c500e65f991248ea76b6d2e274219231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
400B
MD559b71e6e1fe33ff28446e70577905903
SHA1b95c1b3acb309fc106d29e5fef31b7a288f5390b
SHA2563bac74161f4dca389033b5a408f135f7546fff521c512440136edab2b8432db9
SHA512db980e20a1cad50f7fd87c37851e660cdbf70c4d932dee19a6ed339d57d5966ebe9d80dcd6030afdd0c543a8a8f12a3d62b9ad5a788e23a90cff7a35f273efd5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnkFilesize
2KB
MD5debb0bc63feb1e6163fd7323f6eb16bf
SHA194a8943229f0ba2d036cbfb820bc008d2ccf1746
SHA2564ab5846773a86f45f9c2729d822dd30ec453d502b02680551f3add369347b9ed
SHA512665783a8b9735c3d37a0e1e9739a3351b5e0e9d661f65598f4031da4bbd117335cfd831db04a5898b5b58bdfd568cfd60dc2b8bdc724c8fbd20c6e9291679741
-
\??\pipe\LOCAL\crashpad_3864_VLPTWYXLCSNLTERWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_6120_CDCXXRQSFPDLIBYJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/424-172-0x0000000000000000-mapping.dmp
-
memory/620-164-0x0000000000000000-mapping.dmp
-
memory/1052-166-0x0000000000000000-mapping.dmp
-
memory/1244-178-0x0000000000000000-mapping.dmp
-
memory/1512-137-0x0000000000000000-mapping.dmp
-
memory/1720-134-0x0000000000000000-mapping.dmp
-
memory/2352-168-0x0000000000000000-mapping.dmp
-
memory/2664-156-0x0000000000000000-mapping.dmp
-
memory/2948-174-0x0000000000000000-mapping.dmp
-
memory/3260-150-0x0000000000000000-mapping.dmp
-
memory/3328-201-0x0000000000000000-mapping.dmp
-
memory/3372-142-0x0000000000000000-mapping.dmp
-
memory/3432-159-0x0000000000000000-mapping.dmp
-
memory/3620-153-0x0000000000000000-mapping.dmp
-
memory/3864-155-0x0000000000000000-mapping.dmp
-
memory/3872-158-0x0000000000000000-mapping.dmp
-
memory/4032-185-0x0000000000000000-mapping.dmp
-
memory/4228-170-0x0000000000000000-mapping.dmp
-
memory/4232-176-0x0000000000000000-mapping.dmp
-
memory/4320-147-0x0000000000000000-mapping.dmp
-
memory/4332-183-0x0000000000000000-mapping.dmp
-
memory/4536-162-0x0000000000000000-mapping.dmp
-
memory/4648-182-0x0000000000000000-mapping.dmp
-
memory/4872-181-0x0000000000000000-mapping.dmp
-
memory/4992-132-0x0000000000000000-mapping.dmp
-
memory/5404-187-0x0000000000000000-mapping.dmp
-
memory/5536-189-0x0000000000000000-mapping.dmp
-
memory/5584-197-0x0000000000000000-mapping.dmp
-
memory/5604-191-0x0000000000000000-mapping.dmp
-
memory/5676-199-0x0000000000000000-mapping.dmp
-
memory/5904-193-0x0000000000000000-mapping.dmp
-
memory/6032-194-0x0000000000000000-mapping.dmp