hxxp://46[.]228[.]221[.]162/d/msdownload/update/software/uprl/2024/04/windows-kb890830-x64-v5[.]123_12cbe1571c83eb7c16bfdfde1426dff713619670[.]exe?cacheHostOrigin=2[.]au[.]download[.]windowsupdate[.]com

Resubmissions

09/05/2024, 05:28

240509-f6ahtaff84 8

09/05/2024, 05:27

240509-f5j1vsch3t 8

Analysis

max time kernel
37s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
09/05/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://46.228.221.162/d/msdownload/update/software/uprl/2024/04/windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe?cacheHostOrigin=2.au.download.windowsupdate.com

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
3804	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
2340	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
3008	MRT.exe
2428	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe

Loads dropped DLL 2 IoCs

pid	Process
3008	MRT.exe
3008	MRT.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
File created	C:\Windows\system32\MRT.exe	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
File created	C:\Windows\system32\MRT\A94ED072-F556-86CE-5D24-A4EB3F085148\MPGEAR.DLL	MRT.exe
File created	C:\Windows\system32\MRT\A94ED072-F556-86CE-5D24-A4EB3F085148\MPENGINE.DLL	MRT.exe
File created	C:\Windows\system32\MRT\A94ED072-F556-86CE-5D24-A4EB3F085148\MRT\BE1901A0-58F6-432C-BB01-F2575A20D3E4\MpGearSupport_20240509_052804928B7F4D-B2E3-8764-6647-74DC4D87927B.log	MRT.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\mrt.log	MRT.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3804	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
3804	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
2340	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
2340	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
3008	MRT.exe
3008	MRT.exe
2428	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
2428	windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	firefox.exe
Token: SeDebugPrivilege	2852	firefox.exe
Token: SeDebugPrivilege	3008	MRT.exe
Token: SeBackupPrivilege	3008	MRT.exe
Token: SeRestorePrivilege	3008	MRT.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2852	firefox.exe
2852	firefox.exe
2852	firefox.exe
2852	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2852	firefox.exe
2852	firefox.exe
2852	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2852	firefox.exe
2852	firefox.exe
2852	firefox.exe
2852	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 4304 wrote to memory of 2852	4304	firefox.exe	80
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 1380	2852	firefox.exe	81
PID 2852 wrote to memory of 3412	2852	firefox.exe	82
PID 2852 wrote to memory of 3412	2852	firefox.exe	82
PID 2852 wrote to memory of 3412	2852	firefox.exe	82
PID 2852 wrote to memory of 3412	2852	firefox.exe	82
PID 2852 wrote to memory of 3412	2852	firefox.exe	82
PID 2852 wrote to memory of 3412	2852	firefox.exe	82
PID 2852 wrote to memory of 3412	2852	firefox.exe	82
PID 2852 wrote to memory of 3412	2852	firefox.exe	82
PID 2852 wrote to memory of 3412	2852	firefox.exe	82
PID 2852 wrote to memory of 3412	2852	firefox.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://46.228.221.162/d/msdownload/update/software/uprl/2024/04/windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe?cacheHostOrigin=2.au.download.windowsupdate.com"
1⤵
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://46.228.221.162/d/msdownload/update/software/uprl/2024/04/windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe?cacheHostOrigin=2.au.download.windowsupdate.com
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.0.2042891519\80104472" -parentBuildID 20230214051806 -prefsHandle 1796 -prefMapHandle 1788 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ad408c3-3e09-4f32-bd5b-2e1832ae9f98} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 1876 2227f908558 gpu
    3⤵
    PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.1.524204305\1826887632" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {082dc248-2c7b-4e0f-8966-fa4fb86791b1} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 2420 22272b91058 socket
    3⤵
    PID:3412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.2.218806107\1994052308" -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 2776 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 952 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33a72875-192d-412a-8b32-0f89fe249fed} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 3076 2220262d658 tab
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.3.1980884518\1721533009" -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 952 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5bc3d25-fa9a-4eef-9bc1-3b0573e86f6a} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 3576 2220571a858 tab
    3⤵
    PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.4.893943972\673616589" -childID 3 -isForBrowser -prefsHandle 5340 -prefMapHandle 5248 -prefsLen 27735 -prefMapSize 235121 -jsInitHandle 952 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5dba811-513d-4897-8b62-e344cf3992a9} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 5296 222029e3458 tab
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.5.1975342326\1792136805" -childID 4 -isForBrowser -prefsHandle 5352 -prefMapHandle 5348 -prefsLen 27735 -prefMapSize 235121 -jsInitHandle 952 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56d34ee2-2a12-4246-9770-a7968fe1dd2a} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 5368 22208764658 tab
    3⤵
    PID:4224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2852.6.1727921346\1040458390" -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5492 -prefsLen 27735 -prefMapSize 235121 -jsInitHandle 952 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8c48996-4764-4bcc-a960-b19b92b92709} 2852 "\\.\pipe\gecko-crash-server-pipe.2852" 5584 22208762858 tab
    3⤵
    PID:2664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1672

C:\Users\Admin\Downloads\windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
"C:\Users\Admin\Downloads\windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3804
- C:\Windows\system32\MRT.exe
  "C:\Windows\system32\MRT.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3008

C:\Users\Admin\Downloads\windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
"C:\Users\Admin\Downloads\windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2340

C:\Users\Admin\Downloads\windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe
"C:\Users\Admin\Downloads\windows-kb890830-x64-v5.123_12cbe1571c83eb7c16bfdfde1426dff713619670.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ydz6lw8g.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
1c9298ede442602ce6ccb344bab95206

SHA1
1c69d4e001983585f8a84bdcfb92a9908246a492

SHA256
647c50fcdb498d6cca1e9573ad1edcdf9bfd2c15fb9a44bca9a242c44da6c186

SHA512
0a0388930ce1f397ecebdee160cb95bf6df0fbc7acdc53e7ce2559adbebf6b861d0a87eab4c8b4469ec023c30b0cb514a3d070abe5958714465281d20d27d204

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ydz6lw8g.default-release\prefs-1.js

Filesize
7KB

MD5
c0ec4edf6a690704303816798ccb4119

SHA1
bf3160b43682494e9c12c722cd017d0944a98b00

SHA256
cc3ba085a1aa523347430d291075c444f9c18637a51dbe39123bc8fec1f5a435

SHA512
3c1967f4def00cbaaf52439caa02defffb7ecf794d3e70e976e5bbc47a98197e1180a503715d8e7a7f35d276e8a253f3eb22f7fda28d8b3f9029a69e9114704a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ydz6lw8g.default-release\prefs.js

Filesize
6KB

MD5
72c337bbc436365ce74509f4158f932d

SHA1
35fbee3f15b8d4238d518b14fcb6d8ed14f3ff68

SHA256
88e7a20172188065de17b6e2c252b3cdbf8daece77ad575a4d2b005a91ca9705

SHA512
e8eba6aa79b23835e4a1ef58deee10815439efd725482de13b30b1357cc069aace859f588f5b676b756f95db85ee20715e0818b8e889014af8145b830dc4c883

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ydz6lw8g.default-release\prefs.js

Filesize
6KB

MD5
5a9b75869a97cc1fa04ea8891766a20b

SHA1
b205ccb11b4dc947256773fde407825977fbdb5f

SHA256
e22f8b80c79506c5bfbc92d90c81a4b87395196229aa73b09deea932e02724cb

SHA512
6b6398eaaed8a9fdc7309890d9dfe2ac100903be89349a561391cf8c670ea5529b8b26a1b786b645d5c52689f4a3672e4717d42dbc706b585f2da79270f17413

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ydz6lw8g.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
5a8921d56f7dd32fcfd108f016e37bf4

SHA1
1c318d4b3fa7ff29b44c2788cd4dd8149d215b19

SHA256
5d7b5d33336290b0cf14b03070c455416a230d74a68e0612463719e580262a15

SHA512
8431d1abd6c1763e03680622f30a5918fb5b47a22348a76f0342b3cf10f72833a7d216c89027b12004495f59ecf8284ead802be6bfe3c161d02c9c8f34aa5d2c

Download Submit
C:\Windows\System32\MRT\A94ED072-F556-86CE-5D24-A4EB3F085148\MPENGINE.DLL

Filesize
18.6MB

MD5
348432b32a3cdd1f2f727f8f66f78107

SHA1
4d9a137b73548672bf871ddf8fe062d401064f53

SHA256
94e37aa3d76eaa7a9eb5aad793d77025ec34ef47cc2f52e7dba8d966705f9639

SHA512
1857c2a0a1c29cee470004f3795e87d0016f970a243e939291e45fcffc7df595b8e05bf4f8a846d97ebd537597f0b46fcd2cc50752a056bbaab01fa47b1f7801

Download Submit
C:\Windows\System32\MRT\A94ED072-F556-86CE-5D24-A4EB3F085148\MPGEAR.DLL

Filesize
607KB

MD5
a0c4ac6378ce0313955dccfd2d9208a6

SHA1
7ee2f0f3bf4504f4f7bbc63cb5fa883711c13801

SHA256
abbe3285c58c830314f9f0ad2ddc769139c0d808e27893290adc69a535b996b1

SHA512
72ea9f0d7399fa5d6865f3f887ffa07098b883b1428b33dcb552a40bb22ca6a461a546736667ca1aa97e5f06dffd10dab765c7f6e3e827dd0335b562b27d2fb5

Download Submit
memory/3008-106-0x0000022A4E630000-0x0000022A4EB45000-memory.dmp

Filesize
5.1MB

Download
memory/3008-107-0x0000022A4EB50000-0x0000022A4EED0000-memory.dmp

Filesize
3.5MB

Download
memory/3008-128-0x0000022A41B00000-0x0000022A41B04000-memory.dmp

Filesize
16KB

Download
memory/3008-169-0x0000022A4C1E0000-0x0000022A4C1E1000-memory.dmp

Filesize
4KB

Download
memory/3008-137-0x0000022A42270000-0x0000022A42271000-memory.dmp

Filesize
4KB

Download
memory/3008-132-0x0000022A41F20000-0x0000022A41F21000-memory.dmp

Filesize
4KB

Download
memory/3008-130-0x0000022A41B60000-0x0000022A41BA9000-memory.dmp

Filesize
292KB

Download
memory/3008-168-0x0000022A4C1D0000-0x0000022A4C1D1000-memory.dmp

Filesize
4KB

Download
memory/3008-167-0x0000022A4C1C0000-0x0000022A4C1C1000-memory.dmp

Filesize
4KB

Download
memory/3008-166-0x0000022A4C1B0000-0x0000022A4C1B1000-memory.dmp

Filesize
4KB

Download
memory/3008-165-0x0000022A4C1A0000-0x0000022A4C1A1000-memory.dmp

Filesize
4KB

Download
memory/3008-164-0x0000022A4C190000-0x0000022A4C191000-memory.dmp

Filesize
4KB

Download
memory/3008-163-0x0000022A4C180000-0x0000022A4C181000-memory.dmp

Filesize
4KB

Download
memory/3008-162-0x0000022A4C170000-0x0000022A4C171000-memory.dmp

Filesize
4KB

Download
memory/3008-161-0x0000022A4C160000-0x0000022A4C161000-memory.dmp

Filesize
4KB

Download
memory/3008-160-0x0000022A4C150000-0x0000022A4C151000-memory.dmp

Filesize
4KB

Download
memory/3008-159-0x0000022A4C140000-0x0000022A4C141000-memory.dmp

Filesize
4KB

Download
memory/3008-158-0x0000022A4C130000-0x0000022A4C131000-memory.dmp

Filesize
4KB

Download
memory/3008-157-0x0000022A4C120000-0x0000022A4C121000-memory.dmp

Filesize
4KB

Download
memory/3008-156-0x0000022A4C110000-0x0000022A4C111000-memory.dmp

Filesize
4KB

Download
memory/3008-155-0x0000022A4C100000-0x0000022A4C101000-memory.dmp

Filesize
4KB

Download
memory/3008-154-0x0000022A4C0F0000-0x0000022A4C0F1000-memory.dmp

Filesize
4KB

Download
memory/3008-153-0x0000022A4C0E0000-0x0000022A4C0E1000-memory.dmp

Filesize
4KB

Download
memory/3008-152-0x0000022A4C0D0000-0x0000022A4C0D1000-memory.dmp

Filesize
4KB

Download
memory/3008-151-0x0000022A4C0C0000-0x0000022A4C0C1000-memory.dmp

Filesize
4KB

Download
memory/3008-150-0x0000022A4C0B0000-0x0000022A4C0B1000-memory.dmp

Filesize
4KB

Download
memory/3008-149-0x0000022A4C0A0000-0x0000022A4C0A1000-memory.dmp

Filesize
4KB

Download
memory/3008-148-0x0000022A4BF50000-0x0000022A4BF51000-memory.dmp

Filesize
4KB

Download
memory/3008-147-0x0000022A4BF40000-0x0000022A4BF41000-memory.dmp

Filesize
4KB

Download
memory/3008-146-0x0000022A4BF30000-0x0000022A4BF31000-memory.dmp

Filesize
4KB

Download
memory/3008-145-0x0000022A4BF20000-0x0000022A4BF21000-memory.dmp

Filesize
4KB

Download
memory/3008-144-0x0000022A4BF10000-0x0000022A4BF11000-memory.dmp

Filesize
4KB

Download
memory/3008-143-0x0000022A4BF00000-0x0000022A4BF01000-memory.dmp

Filesize
4KB

Download
memory/3008-142-0x0000022A4BEF0000-0x0000022A4BEF1000-memory.dmp

Filesize
4KB

Download
memory/3008-141-0x0000022A4BEE0000-0x0000022A4BEE1000-memory.dmp

Filesize
4KB

Download
memory/3008-140-0x0000022A4BED0000-0x0000022A4BED1000-memory.dmp

Filesize
4KB

Download
memory/3008-139-0x0000022A46E50000-0x0000022A46E51000-memory.dmp

Filesize
4KB

Download
memory/3008-138-0x0000022A42280000-0x0000022A42281000-memory.dmp

Filesize
4KB

Download
memory/3008-136-0x0000022A42260000-0x0000022A42261000-memory.dmp

Filesize
4KB

Download
memory/3008-135-0x0000022A42190000-0x0000022A42191000-memory.dmp

Filesize
4KB

Download
memory/3008-134-0x0000022A42100000-0x0000022A42101000-memory.dmp

Filesize
4KB

Download
memory/3008-133-0x0000022A41F70000-0x0000022A41F71000-memory.dmp

Filesize
4KB

Download
memory/3008-131-0x0000022A41BB0000-0x0000022A41C42000-memory.dmp

Filesize
584KB

Download
memory/3008-129-0x0000022A41B10000-0x0000022A41B5B000-memory.dmp

Filesize
300KB

Download
memory/3008-126-0x0000022A41AE0000-0x0000022A41AE4000-memory.dmp

Filesize
16KB

Download
memory/3008-125-0x0000022A41AD0000-0x0000022A41AD4000-memory.dmp

Filesize
16KB

Download
memory/3008-124-0x0000022A41AC0000-0x0000022A41AC4000-memory.dmp

Filesize
16KB

Download
memory/3008-123-0x0000022A41AB0000-0x0000022A41AB4000-memory.dmp

Filesize
16KB

Download
memory/3008-122-0x0000022A41AA0000-0x0000022A41AA4000-memory.dmp

Filesize
16KB

Download
memory/3008-121-0x0000022A41A90000-0x0000022A41A94000-memory.dmp

Filesize
16KB

Download
memory/3008-120-0x0000022A41A80000-0x0000022A41A84000-memory.dmp

Filesize
16KB

Download
memory/3008-119-0x0000022A41A70000-0x0000022A41A74000-memory.dmp

Filesize
16KB

Download
memory/3008-118-0x0000022A41A60000-0x0000022A41A64000-memory.dmp

Filesize
16KB

Download
memory/3008-117-0x0000022A41A50000-0x0000022A41A54000-memory.dmp

Filesize
16KB

Download
memory/3008-116-0x0000022A41A40000-0x0000022A41A44000-memory.dmp

Filesize
16KB

Download
memory/3008-115-0x0000022A41A30000-0x0000022A41A34000-memory.dmp

Filesize
16KB

Download
memory/3008-114-0x0000022A46E40000-0x0000022A46E44000-memory.dmp

Filesize
16KB

Download
memory/3008-113-0x0000022A46630000-0x0000022A46634000-memory.dmp

Filesize
16KB

Download
memory/3008-112-0x0000022A43B40000-0x0000022A43B44000-memory.dmp

Filesize
16KB

Download
memory/3008-111-0x0000022A43130000-0x0000022A43134000-memory.dmp

Filesize
16KB

Download
memory/3008-110-0x0000022A43120000-0x0000022A43124000-memory.dmp

Filesize
16KB

Download
memory/3008-109-0x0000022A42FD0000-0x0000022A42FD4000-memory.dmp

Filesize
16KB

Download
memory/3008-108-0x0000022A41F10000-0x0000022A41F14000-memory.dmp

Filesize
16KB

Download
memory/3008-127-0x0000022A41AF0000-0x0000022A41AF4000-memory.dmp

Filesize
16KB

Download