759a62a1d7e2935c1e3898be2853ca90ef10dba4da89639a577f867342923488

Resubmissions

07/08/2024, 08:22

240807-j91e7avgrp3

06/08/2024, 23:44

240806-3rmk6avaml10

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ-virus
Size 247KB
Sample240807-j91e7avgrp
SHA256 759a62a1d7e2935c1e3898be2853ca90ef10dba4da89639a577f867342923488
MD5 6be096a120a7ed29c5f0e1438c229297
SHA1 9bd59fa300a6a1f92614299513ed3ff942f6b628
SHA512 e4f366ce09535fd36ef002fd679a3dc20b9d62d838e2aa3a76004a4437455fdca3546d0baec83de84ad0b37ebdec7ca800464d3ca6d8365729071121484badf3
SSDEEP 6144:83ojA3uokeOvHS1d1+sNs8wbiWQ29fvZJT3CqbMrhryf65NRPaCieMjAkvCJv1VP:OojA3uokeOvHS1d1+sNs8wbiWQ29fvZY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8BCFFB4B-5496-11EF-9912-762C928CCA03} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4208	vlc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4208	vlc.exe
5496	OpenWith.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4688	iexplore.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1744	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
2216	OpenWith.exe
884	OpenWith.exe
464	AcroRd32.exe
2224	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4208	vlc.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 464	1204	OpenWith.exe	96
PID 1204 wrote to memory of 464	1204	OpenWith.exe	96
PID 1204 wrote to memory of 464	1204	OpenWith.exe	96
PID 464 wrote to memory of 5724	464	AcroRd32.exe	98
PID 464 wrote to memory of 5724	464	AcroRd32.exe	98
PID 464 wrote to memory of 5724	464	AcroRd32.exe	98
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MEMZ-virus
1⤵
PID:6120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D9991D827B6C74BEA7B4CEB9DB77DC7A --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1568
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7CD7EFC4A503ED297550A2122EBB0D77 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7CD7EFC4A503ED297550A2122EBB0D77 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2380
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BC6C53BAEC39F110D80D40491DBF78D2 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1872
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1FC460FAF53C3105FA3D2396C830723F --mojo-platform-channel-handle=1912 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1556
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E16DDFEF1FF5E3B9522610753F2C54E --mojo-platform-channel-handle=2544 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4872
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5496
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\MEMZ-virus
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:4688
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4688 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 b8b1aa0f77c7c347dc89d4a321b57169b352ca9b85e44df00793360fb2ffef09
MD5 54d7dc83a47aeb7061a8ee33f81f71c0
SHA1 97c7af33c2a7dab57c9b3b00823fc8552adc6426
SHA512 6d7963ac692a49f3b9b3da33cfb47d8308021ab53b2ce796fd770aacb354c115fc10e26c9794c864564de8fd46ca48178fdab9bf61b4e3f7ab30292e41f3433f
SSDEEP 384:yehdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:4+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_primer_octicons-react_di-b40d97-22592575c2af[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_primer_octicons-react_di-b40d97-22592575c2af[1].js
Size 732KB
SHA256 2ae4af027e21b86b4c28dd509eddb2065525758a1f8c006c59ec457a54cf6a43
MD5 530131150b9b046556026a4efd6879d1
SHA1 8aad346cf9885a09d7b3a890455204928ad0c345
SHA512 22592575c2afd324e58fd953add23a2c633e77ab9927c3b0309c66ba97371b6b542f227f43757d4f994779472b1a35315233ade985dcb609b6c9e799b193206e
SSDEEP 3072:jUqdFGPy8ZniVjdbAuZiX9J3tgeZ0t8KUUKPljnk/Fjv0SzOpztOGt9kZftxnhcT:Bwy8RQjvaLLG8QEM4sLqSeXtLYV8d
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_primer_react_lib-esm_ActionList_index_js-1567f1132a28[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\vendors-node_modules_primer_react_lib-esm_ActionList_index_js-1567f1132a28[1].js
Size 25KB
SHA256 de9f25a82b14bd0569ba5922452b2a56b3208acce439cfa86913d194396610b3
MD5 98249ce74ed3ee339b54fb4bf2a55bfd
SHA1 e4304a66b3323e0910e236f5266b16f31f092512
SHA512 1567f1132a280bb6f8412a3874fefa7f7619c0b518b31ca57d3f86a8ab177cb9b95058f7b152d15bf658628d35762e3ee16d7e929489b1fe9a05bf9aa7b26871
SSDEEP 384:dNmBPxIL/0WoJQrUF+UQpPVAoXqaR1utCMm9NnsieGfCoxe4Uannlt6cav4C:dNoZq/0fJfFopPJ6fCMcsrroxewnn7pw
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_primer_react_lib-esm_ActionMenu_ActionMenu_js-node_modules_primer_react_-5b2420-048f91dcedb3[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\vendors-node_modules_primer_react_lib-esm_ActionMenu_ActionMenu_js-node_modules_primer_react_-5b2420-048f91dcedb3[1].js
Size 11KB
SHA256 81e7364ac0e52fc78a6c101fd3a8bbd5bf3a853ba2f5cb193fa58aff730de783
MD5 218a4f17ec81d77e6993d662dfafa371
SHA1 68fc5b9958fd5d6a13f129124cb476b15402869b
SHA512 048f91dcedb34a0dd855c9e3649fa798d1f7bab05ea21fe7e5acc786406bc480f38c62c1b5c992da935969081a8330ca555212e87e175e7ed273748192f5518d
SSDEEP 192:UC0GH/TQpsKHAC89JfAihEQCZTBAeaAhzxTYRNSKd50I+O/sB2hdf2tZpGumT2mS:PcpsKHnyNHiTBAerdI+IsB27s4Hu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_primer_react_lib-esm_Text_Text_js-node_modules_primer_react_lib-esm_Text-7845da-3bcd176ee601[2].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\vendors-node_modules_primer_react_lib-esm_Text_Text_js-node_modules_primer_react_lib-esm_Text-7845da-3bcd176ee601[2].js
Size 12KB
SHA256 4118b27822d5f1ea83a013cad3f3ec7bb877a42ea4239b71ed3399d0cbe8be62
MD5 1178a1c26bca6089c3d1a14a1a7796fa
SHA1 80716636c86bdf40d51e685ccf3587d6a1507602
SHA512 3bcd176ee601e186433bfb0c3e11f8f719eaaf4851da2c1d4186bfde69f6a0cd93ec0b690eb5eb8cf97ac05d99bf976f2105621774d0b18af7c8bdaecba1d581
SSDEEP 192:oW6MCgucMl03cCBGXuhUnIyCCvB7cCxG0Hp/oEzCHET1fkW09T8Wr:oWXudC3/GXt7fB7vnnKET1MW09Tz
MD5 SHA1 SHA512 SSDEEP

Submit Download

notifications-subscriptions-menu-0d65b3211924[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\notifications-subscriptions-menu-0d65b3211924[1].js
Size 17KB
SHA256 34c530f425a0b57af9a0b7c8bc1231928bb5a700ce74c08723e38eb6ad4389e9
MD5 0db96d7f52da51c4092fef0d8ece7def
SHA1 50462ae4581e1b80ae0f0b3f510b40bcd21858ff
SHA512 0d65b32119242463b901688a42327cc66ba02cb92f93216fe5d2383f5b74b463cfd46a5263be4546b239b1fdf60226144df2e43b411f6a8d9c5ef47e845d7623
SSDEEP 384:+4K4tgsqpONPU4PtKd1yqcxLtFkwaFlXEzp:+4TtApOBU4PsdITxLt7kUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

react-lib-7b7b5264f6c1[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\react-lib-7b7b5264f6c1[1].js
Size 209KB
SHA256 4736f0203a41862c10e5b93529b15897813bca088a8dc952250ba7c19b6901d9
MD5 c0772c4a7a3f6a29256a69e8feca82d8
SHA1 75ff0ed2d25d36f7c6e933030e691228e37c5264
SHA512 7b7b5264f6c11eb55aca6b7788e67f89f5638a53c75589dfebdb7e08f6fcad5b2555a90eeff60da4578ee429cbbdf1d886f55a30355d9386d7006241e65ee632
SSDEEP 3072:EjJAtLyIMb1Ybvnh4VM/974mtExIQMjqMACROl3jy4tY:Eymuiw90mO4+0O9tY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui_packages_react-core_create-browser-history_ts-ui_packages_safe-storage_safe-storage_ts-ui_-682c2c-7a1e99981675[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\ui_packages_react-core_create-browser-history_ts-ui_packages_safe-storage_safe-storage_ts-ui_-682c2c-7a1e99981675[1].js
Size 11KB
SHA256 ef5c7df244fa748c4a3019634dc4653dffb9e373c43478753cd4d9c19b5574e0
MD5 6018298e98a0ad492381a57a3a56f2fd
SHA1 c2335a94d01ef3f2d7576ac1e45196a7690cc5ce
SHA512 7a1e9998167556d279ee6f541c91e0bc09158689a5420f7c0d240f703409a6b7ca840eb3296cd034b3439d6c335690bf50e5982e9467efe94e2468c6feb6b9a1
SSDEEP 192:kwZ3NxVS1llhVsEDEZYkpJXw0Jh6CXb7P5802qsD1mZSMygqMB:X3A1llhVsMEZYk3XTRL7P58x2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103-e91295e60abd[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103-e91295e60abd[1].js
Size 28KB
SHA256 494a827200d1e11e4c08519cc0c7fff57c999e9a47763decd5ec6623faca5611
MD5 59b1ccfeba4c676ba96ca28766640910
SHA1 5504c5a8e3355794f4e7771241c274b98cbcb303
SHA512 e91295e60abd95b3bfc9d11c8db34001da35c4e5982cf58b57c32e6eee688e19454545346cb0e3b8e15fa92aac2729cb2c522fd38be8b7b7b4a193b805bcc6eb
SSDEEP 192:rdgWoUD1jInrTRBI8Ojp1csJZIXjU+cmYoYIFxLzvoldhqumnMzLHzBQcgOQX6Ic:xgWTcriDcRXjZcaF5gdKcgNt9R7HtFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_primer_react_lib-esm_Box_Box_js-55a9038b54f0[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_Box_Box_js-55a9038b54f0[1].js
Size 15KB
SHA256 0aef521ca83330f959d3fce2efef9175fdeb618c55c79ebda619d1a8a87987e2
MD5 c660c2ee0360a1d18bebeb12641857ee
SHA1 6fa2bc02090373854b6bcaa15096f517018c375a
SHA512 55a9038b54f031de7844ce356e22d2e2a145f4b2f7c0453439586079be60cedafc3eb4f45219ffe9ce2beae21e1a67f12523db049f948e7ce777aef7cdd2b788
SSDEEP 192:ceV/loGiEbIBNiRY4EIAhVC8rTom7mVzHKgIWcRc3AISzcuhL8XiothZSGMFJUeb:ceV4EbI7n7rTN7mVzHK4OgQzjgnWUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_primer_react_lib-esm_Button_Button_js-e151c17189c8[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_Button_Button_js-e151c17189c8[1].js
Size 16KB
SHA256 280e90e10922fca82f776c10e40f9d692fda0474723fbbb9aaff77ac42cd5908
MD5 d1b6c4d10b97500009f14c00cf8a0be0
SHA1 ea5b8b06e1f430c486878804af0d9ab5fd27152a
SHA512 e151c17189c816b447272668e70a272452a27e67a86cb890e8ec50237cffda8db22eb43c2e668f9d7c14953c12eeb8edafd6d5610f6fbb7d9bb417563e3fa50d
SSDEEP 384:eozr11NgHMxjxCwix8XahLxfwi7Uh9vALoGrTWnmG:eozTNgHMxjxCwix8XahLxfwi7UnpUfG
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_primer_react_lib-esm_Dialog_js-node_modules_primer_react_lib-esm_Feature-c10078-66f672e84f85[2].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_Dialog_js-node_modules_primer_react_lib-esm_Feature-c10078-66f672e84f85[2].js
Size 24KB
SHA256 a6bc8c0b839313d2535706ae820585d176b7e872e1538f134e0c9385827542c9
MD5 ec433b10644913d396c58fb6876a8eb1
SHA1 e9c9f65266cfea2b9438d347e24916630726d008
SHA512 66f672e84f8568bcf78a163f388a1c93532a313c70f8f77142c0adbd5a420b3dc9420186369fae54ce06b044901bebb6c5c59ae91e075b555eabf44d7a84bb29
SSDEEP 384:Bf1toc44hfaRSKN61nMovu8Ol2tVvb6ZYbHvHebXKqPYj31WkcPhEjBPK:Thfar4i8gEVz6ZfbXKqPYZWk1PK
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_primer_react_lib-esm_FormControl_FormControl_js-f4892e323732[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_FormControl_FormControl_js-f4892e323732[1].js
Size 32KB
SHA256 df6bcbce702dc764939564644e83fdbc27b1efd7cafe91d575bcef6bd94af688
MD5 4d242c877c9b9246f46b94fc08fb4e4c
SHA1 af8ec815ccf5d32837d180ae5c0a17386d0d248d
SHA512 f4892e323732dc64c5a4dd297efdcf652a38599c599a1f06aea9f6b255cdd7963186fefd5545f712a1ed01094288d548a39e471a7f317baa4e80056d7b91d737
SSDEEP 768:Qz8FMxWfCMKzFBeScd/sxxTXkwTyErb9FxQ9Sd:i8FMQfCMKzFBlcd/sPTtyErb9FxCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_primer_react_lib-esm_SelectPanel_SelectPanel_js-da4b9b447323[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_SelectPanel_SelectPanel_js-da4b9b447323[1].js
Size 16KB
SHA256 aeb4edf36de310adb09773ee0d8254fd5ef85bdeeb865d93458be8217a88c7ca
MD5 bd47d0364adf68cb6093326f3bc4bda3
SHA1 132b43c39bc8e56171c8ed84faa698bd87b0fe00
SHA512 da4b9b447323077fb6127b23b9256b3aa2ea752be80c3adced1f7bea49454fac9c2a6f3174645262e89a074618cffed9b6ee83f1677f70fb622217e797920d8d
SSDEEP 384:XEhY5X4NdFtS5lgnUEl6RdLhKGUE0gp7RC:48wdFlUM0Lr0gLC
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendors-node_modules_primer_react_lib-esm_TooltipV2_Tooltip_js-ffca9cf46775[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_TooltipV2_Tooltip_js-ffca9cf46775[1].js
Size 14KB
SHA256 50d8979e13f1d0b3e2b887ff7f251796bd481493d647e456ed7ffe14c822de89
MD5 a4fc81ffee4da6704a3cab4386917a48
SHA1 2f1b15888f3987e6c4c43eb0087402da29f6197d
SHA512 ffca9cf4677540790208c03fb19503ce29214d2ea3cf60303de8b0b90d34282271a905ea8df439ee125802fcebc58c625d53f7f2d6654733f34b57638ef64086
SSDEEP 192:eCS+HexPCd9LDTQ7YKrY1kSnG2qeIPuvnHBE0loGGPfZU5jqNtPw3fMlWqrol:9NTArZShIunHMPEEi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/464-123-0x000000000A1A0000-0x000000000A44B000-memory.dmp

Download

memory/4208-137-0x00007FF8A90E0000-0x00007FF8A90F1000-memory.dmp

Download

memory/4208-134-0x00007FF8ACAB0000-0x00007FF8ACAC7000-memory.dmp

Download

memory/4208-143-0x00007FF8A8BD0000-0x00007FF8A8BF1000-memory.dmp

Download

memory/4208-142-0x00007FF89A270000-0x00007FF89A2B1000-memory.dmp

Download

memory/4208-141-0x00007FF8978A0000-0x00007FF898950000-memory.dmp

Download

memory/4208-145-0x00007FF8A8A90000-0x00007FF8A8AA1000-memory.dmp

Download

memory/4208-148-0x00007FF896FD0000-0x00007FF897223000-memory.dmp

Download

memory/4208-146-0x00007FF8A8290000-0x00007FF8A82A1000-memory.dmp

Download

memory/4208-147-0x00007FF8A8270000-0x00007FF8A8281000-memory.dmp

Download

memory/4208-144-0x00007FF8A8AB0000-0x00007FF8A8AC8000-memory.dmp

Download

memory/4208-135-0x00007FF8AC6A0000-0x00007FF8AC6B1000-memory.dmp

Download

memory/4208-136-0x00007FF8AC5F0000-0x00007FF8AC607000-memory.dmp

Download

memory/4208-132-0x00007FF898950000-0x00007FF898C06000-memory.dmp

Download

memory/4208-140-0x00007FF899860000-0x00007FF899A6B000-memory.dmp

Download

memory/4208-138-0x00007FF8A8CB0000-0x00007FF8A8CCD000-memory.dmp

Download

memory/4208-139-0x00007FF8A8C90000-0x00007FF8A8CA1000-memory.dmp

Download

memory/4208-133-0x00007FF8ACC90000-0x00007FF8ACCA8000-memory.dmp

Download

memory/4208-130-0x00007FF6C8D30000-0x00007FF6C8E28000-memory.dmp

Download

memory/4208-131-0x00007FF8A8CD0000-0x00007FF8A8D04000-memory.dmp

Download

memory/4208-526-0x00007FF8978A0000-0x00007FF898950000-memory.dmp

Download