Overview

overview

10

Static

static

7

RUN ME FIRST.exe

windows7-x64

10

RUN ME FIRST.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • submitted
    23-04-2024 20:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RUN ME FIRST.exe

  • Size

    30.2MB

  • MD5

    1a1d3ccdb446065c89c44b67105a48c1

  • SHA1

    6a045b2be0a524d2e46e1a158fa9f5768d539470

  • SHA256

    76be196c4deabfcb66820dbc30df22421bd2940a68993272eea691cad86092fc

  • SHA512

    83b47897b5a958ba3d915caf631c1971445fcdb38b1fc344867126ffb2b94068ed447a280a7d330b3b2cd7a7d82171f5abce29bb36a11f7f9f371e20eb02ddb2

  • SSDEEP

    786432:TZ/Z/rp+Ty2SfUfnbu+zMFy/7zYgWXRLTArzttOaaFH:1Rzp+Ty2SfWnPzMFO7zYgWBLbFH

Score
10/10
xredbackdoordiscoveryevasionpersistencethemidatrojan

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 15 IoCs
  • Themida packer 33 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 9 IoCs
    evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RUN ME FIRST.exe
    "C:\Users\Admin\AppData\Local\Temp\RUN ME FIRST.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1692
    • \??\c:\users\admin\appdata\local\temp\run me first.exe 
      "c:\users\admin\appdata\local\temp\run me first.exe "
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:112
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2840
          • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
            c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2592
            • C:\Windows\Temp\{BBB5AEB2-2F95-4E9E-B5AC-7F87F5EFA83A}\.cr\._cache_synaptics.exe 
              "C:\Windows\Temp\{BBB5AEB2-2F95-4E9E-B5AC-7F87F5EFA83A}\.cr\._cache_synaptics.exe " -burn.clean.room="c:\users\admin\appdata\local\temp\._cache_synaptics.exe " -burn.filehandle.attached=180 -burn.filehandle.self=188 InjUpdate
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2280
          • C:\Windows\Resources\Themes\icsys.icn.exe
            C:\Windows\Resources\Themes\icsys.icn.exe
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2216
            • \??\c:\windows\resources\themes\explorer.exe
              c:\windows\resources\themes\explorer.exe
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:940
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2460
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2440
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2500
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in System32 directory
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2800
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1328
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:21 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2392
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:22 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2904
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:23 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2188
        • C:\Windows\Explorer.exe
          C:\Windows\Explorer.exe
          4⤵
            PID:2148
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2288

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Hide Artifacts

    1
    T1564

    Hidden Files and Directories

    1
    T1564.001

    Modify Registry

    3
    T1112

    Virtualization/Sandbox Evasion

    1
    T1497

    Credential Access

    Discovery

    Query Registry

    4
    T1012

    System Information Discovery

    4
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Virtualization/Sandbox Evasion

    1
    T1497

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5zOjrYuN.xlsm
      Filesize

      17KB

      MD5

      e566fc53051035e1e6fd0ed1823de0f9

      SHA1

      00bc96c48b98676ecd67e81a6f1d7754e4156044

      SHA256

      8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

      SHA512

      a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

      Download Submit

    • C:\Windows\Resources\Themes\explorer.exe
      Filesize

      2.6MB

      MD5

      598d546ef73a926bf66564b0cdd24724

      SHA1

      d0195bb2c4653c1b1964187e9824998063fe8111

      SHA256

      3360e23cae09d4f1819bdac72c394a1d2cdd95703997cf9dbbdad969837b51d7

      SHA512

      751f872848ccdd1a196ffe452d8f427e92d662dcd4df4241df13cc756875aff31f41e86e83cc072ee84bd5bfc234825fa2489cb4ebd74887c7c82491b4799e2d

      Download Submit

    • C:\Windows\Temp\{AD0D2146-1464-4C75-93E2-3AE441BFB58C}\.ba\logo.png
      Filesize

      1KB

      MD5

      d6bd210f227442b3362493d046cea233

      SHA1

      ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

      SHA256

      335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

      SHA512

      464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

      Download Submit

    • C:\Windows\Temp\{BBB5AEB2-2F95-4E9E-B5AC-7F87F5EFA83A}\.cr\._cache_synaptics.exe 
      Filesize

      635KB

      MD5

      53e9222bc438cbd8b7320f800bef2e78

      SHA1

      c4f295d8855b4b16c7450a4a9150eb95046f6390

      SHA256

      0e49026767420229afd23b1352cf9f97f24e0768c3d527000d449ffdb4ca6888

      SHA512

      7533f9791e1807072a4dbb6ca03c696b12dfa5337678fab53aceea0e4b7e5ffefb90c9b450ac80878e1e9a4bce549f619da4cd2d06eb2554c9add5b4ec838b4a

      Download Submit

    • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
      Filesize

      24.2MB

      MD5

      101b0b9f74cdc6cdbd2570bfe92e302c

      SHA1

      2e6bae42c2842b4f558bd68099479b929bb7d910

      SHA256

      4dfe83c91124cd542f4222fe2c396cabeac617bb6f59bdcbdf89fd6f0df0a32f

      SHA512

      ccf4fd7da2c3440f1bc7fcac67c8a12599eab8d5c015affdc2e439fa30f5c7868ef5f52ede058361faae37ccc4af2c17c0adf30b8e1f852bb7106d0ec7162506

      Download Submit

    • \Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      Filesize

      26.8MB

      MD5

      295a5c23bd7d75fb93c29d301461999e

      SHA1

      fe574720ca812f4cf0523efc7bd65c2b9e1cd006

      SHA256

      f12b9927989c46a741e1b6dba0cdca4d6da86852cefd9cdb08204e26caac53e7

      SHA512

      e08857e8fd4f3a2e501add77e7a2326693b97283a03106f4e60fcdfa1dd148009681134895b6285f328549ab24172effd9c5ee09aa5283f170a6c62bfa6efc3e

      Download Submit

    • \Users\Admin\AppData\Local\Temp\run me first.exe 
      Filesize

      27.6MB

      MD5

      d91e55db411d487e8311d12596327ac4

      SHA1

      e0104af553bf10a7bd178b41d1026fee4393d90c

      SHA256

      f5c8914376373c7c48658ee56adf44ba3157c4ca5fbba82f7794c3b820687128

      SHA512

      fe016a2c18f69f36c0c9ce9d1dda3a1a3b6e701c32f3fbb57ca4ba74ffe53edddb09ad2849da206509faa0e7a1af8d606c0c55ab803fe8987e5fb7d8e7a6887d

      Download Submit

    • \Windows\Resources\Themes\icsys.icn.exe
      Filesize

      2.6MB

      MD5

      a7d44128dcb01d3d19a1ef4213f70062

      SHA1

      958e7e8688e020f97ed58d271510c3fa31f581fa

      SHA256

      20f97327231090b3d3231195923ff1e2e1955824bc7b73bee506a2f7fe152cd9

      SHA512

      75659f857d97fd372185dd806c2fdff94500c670d5774c803a79a0a6d9d6be10c5aab58a8afec6e9e4d750a5de7eeeb4ef664101a379f3dfb97b3a7c34979ebb

      Download Submit

    • \Windows\Resources\spoolsv.exe
      Filesize

      2.6MB

      MD5

      9a3fbe26eeb9f984d83d8ccedaabf87a

      SHA1

      5593600aaf7ddff092467654acfd38baad5556aa

      SHA256

      9696c6aa0e2179df2f614a815068933e8abf176028e8979c8fc9a8cc5c64157f

      SHA512

      fdcea58301c04b38c07fc036240bcbf3932d160adafa21b27da32c0559482667f4da7751d5fd54a57e2b4daf04b571ebf1262c103328c8612cff132bc64e405f

      Download Submit

    • \Windows\Resources\svchost.exe
      Filesize

      2.6MB

      MD5

      49a5b5e574ca40d464e06059b360c333

      SHA1

      05a1b2df1e3cce2287e5ec11e3b25540ac37268d

      SHA256

      d7f49fb79e8bbc3fb19bca4d5f18013816de884035b857a0f051470ac8eefb5f

      SHA512

      0d14983c084e311800aaadef6d50b9d0be9bbae004c4dcac83be5baff686f7b07046138a49d8b88562e5b5af4275575f21e027f4f7ceda79a8bd7b877770f17f

      Download Submit

    • \Windows\Temp\{AD0D2146-1464-4C75-93E2-3AE441BFB58C}\.ba\wixstdba.dll
      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

      Download Submit

    • memory/112-213-0x0000000000400000-0x0000000001F97000-memory.dmp

      Filesize

      27.6MB

      Download

    • memory/112-176-0x0000000000400000-0x0000000001F97000-memory.dmp

      Filesize

      27.6MB

      Download

    • memory/112-199-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

      Download

    • memory/112-205-0x00000000069C0000-0x0000000006FD6000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/112-217-0x0000000000400000-0x0000000001F97000-memory.dmp

      Filesize

      27.6MB

      Download

    • memory/112-261-0x0000000000400000-0x0000000001F97000-memory.dmp

      Filesize

      27.6MB

      Download

    • memory/112-81-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

      Download

    • memory/112-103-0x00000000069C0000-0x0000000006FD6000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/940-209-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/940-204-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1328-112-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1328-92-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1692-114-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1692-0-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1692-1-0x0000000077590000-0x0000000077592000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1692-51-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1692-20-0x00000000032D0000-0x00000000038E6000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1692-68-0x00000000032D0000-0x00000000038E6000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1776-70-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1776-82-0x0000000000400000-0x0000000001F97000-memory.dmp

      Filesize

      27.6MB

      Download

    • memory/1776-14-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2216-198-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2216-210-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2288-215-0x000000007225D000-0x0000000072268000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2288-169-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2288-174-0x000000007225D000-0x0000000072268000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2440-127-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2440-170-0x0000000003490000-0x0000000003AA6000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2440-228-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2440-45-0x0000000003490000-0x0000000003AA6000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2440-111-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2440-34-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2440-218-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2460-22-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2460-33-0x00000000033E0000-0x00000000039F6000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2460-69-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2460-115-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2500-59-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2500-113-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2800-91-0x00000000032D0000-0x00000000038E6000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2800-172-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2800-71-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2800-260-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2840-178-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2840-211-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/2840-106-0x0000000000400000-0x0000000000A16000-memory.dmp

      Filesize

      6.1MB

      Download