xred | 6bf3a9c47d0dc7cbde76eb4dbd81f9fcac54f64d7bf907ff952438503d8588b6

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RNEQTT.exe
Size

1.6MB
MD5

019fc60427d0126adfec88980c7fb666
SHA1

55e2550ce27991e708e30a2e75253093eed0edb3
SHA256

6bf3a9c47d0dc7cbde76eb4dbd81f9fcac54f64d7bf907ff952438503d8588b6
SHA512

f8013fb625bb6354b50d7c27331c3088904ddd9103e0b28bac8965edd83d86353250e97aa872b82756d2765064d5be30e9e9579e216805c12216634627311a86
SSDEEP

49152:MnsHyjtk2MYC5GDshloJfxBHUklI7GkBf:Mnsmtk2a5hliBHUklI66f

Score

10^/10

xred backdoor discovery persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VFNCBO.lnk	._cache_RNEQTT.exe

Executes dropped EXE 5 IoCs

pid	Process
2548	._cache_RNEQTT.exe
2812	Synaptics.exe
1464	._cache_Synaptics.exe
1316	NUHORT.exe
1268	NUHORT.exe

Loads dropped DLL 6 IoCs

pid	Process
3028	RNEQTT.exe
3028	RNEQTT.exe
3028	RNEQTT.exe
2548	._cache_RNEQTT.exe
2812	Synaptics.exe
2812	Synaptics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	RNEQTT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\VFNCBO = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\NUHORT.exe\""	._cache_RNEQTT.exe

AutoIT Executable 17 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1464-65-0x00000000001D0000-0x00000000003C0000-memory.dmp	autoit_exe
behavioral1/memory/2548-94-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-95-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-99-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-101-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/1316-107-0x00000000009E0000-0x0000000000BD0000-memory.dmp	autoit_exe
behavioral1/memory/2548-108-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-110-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-140-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-142-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-144-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-146-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/1268-150-0x0000000000160000-0x0000000000350000-memory.dmp	autoit_exe
behavioral1/memory/2548-151-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-153-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-155-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe
behavioral1/memory/2548-157-0x0000000000A90000-0x0000000000C80000-memory.dmp	autoit_exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000120fb-4.dat	upx
behavioral1/memory/2548-18-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/1464-46-0x00000000001D0000-0x00000000003C0000-memory.dmp	upx
behavioral1/memory/1464-65-0x00000000001D0000-0x00000000003C0000-memory.dmp	upx
behavioral1/memory/2548-94-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-95-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-99-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-101-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/1316-105-0x00000000009E0000-0x0000000000BD0000-memory.dmp	upx
behavioral1/memory/1316-107-0x00000000009E0000-0x0000000000BD0000-memory.dmp	upx
behavioral1/memory/2548-108-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-110-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-140-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-142-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-144-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-146-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/1268-149-0x0000000000160000-0x0000000000350000-memory.dmp	upx
behavioral1/memory/1268-150-0x0000000000160000-0x0000000000350000-memory.dmp	upx
behavioral1/memory/2548-151-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-153-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-155-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/2548-157-0x0000000000A90000-0x0000000000C80000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NUHORT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_RNEQTT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RNEQTT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NUHORT.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	._cache_RNEQTT.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3056	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2684	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe
2548	._cache_RNEQTT.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	._cache_RNEQTT.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2548	3028	RNEQTT.exe	30
PID 3028 wrote to memory of 2548	3028	RNEQTT.exe	30
PID 3028 wrote to memory of 2548	3028	RNEQTT.exe	30
PID 3028 wrote to memory of 2548	3028	RNEQTT.exe	30
PID 3028 wrote to memory of 2812	3028	RNEQTT.exe	31
PID 3028 wrote to memory of 2812	3028	RNEQTT.exe	31
PID 3028 wrote to memory of 2812	3028	RNEQTT.exe	31
PID 3028 wrote to memory of 2812	3028	RNEQTT.exe	31
PID 2548 wrote to memory of 2188	2548	._cache_RNEQTT.exe	32
PID 2548 wrote to memory of 2188	2548	._cache_RNEQTT.exe	32
PID 2548 wrote to memory of 2188	2548	._cache_RNEQTT.exe	32
PID 2548 wrote to memory of 2188	2548	._cache_RNEQTT.exe	32
PID 2548 wrote to memory of 2784	2548	._cache_RNEQTT.exe	34
PID 2548 wrote to memory of 2784	2548	._cache_RNEQTT.exe	34
PID 2548 wrote to memory of 2784	2548	._cache_RNEQTT.exe	34
PID 2548 wrote to memory of 2784	2548	._cache_RNEQTT.exe	34
PID 2812 wrote to memory of 1464	2812	Synaptics.exe	35
PID 2812 wrote to memory of 1464	2812	Synaptics.exe	35
PID 2812 wrote to memory of 1464	2812	Synaptics.exe	35
PID 2812 wrote to memory of 1464	2812	Synaptics.exe	35
PID 2188 wrote to memory of 3056	2188	cmd.exe	37
PID 2188 wrote to memory of 3056	2188	cmd.exe	37
PID 2188 wrote to memory of 3056	2188	cmd.exe	37
PID 2188 wrote to memory of 3056	2188	cmd.exe	37
PID 2156 wrote to memory of 1316	2156	taskeng.exe	43
PID 2156 wrote to memory of 1316	2156	taskeng.exe	43
PID 2156 wrote to memory of 1316	2156	taskeng.exe	43
PID 2156 wrote to memory of 1316	2156	taskeng.exe	43
PID 2156 wrote to memory of 1268	2156	taskeng.exe	44
PID 2156 wrote to memory of 1268	2156	taskeng.exe	44
PID 2156 wrote to memory of 1268	2156	taskeng.exe	44
PID 2156 wrote to memory of 1268	2156	taskeng.exe	44

C:\Users\Admin\AppData\Local\Temp\RNEQTT.exe
"C:\Users\Admin\AppData\Local\Temp\RNEQTT.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\._cache_RNEQTT.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_RNEQTT.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn VFNCBO.exe /tr C:\Users\Admin\AppData\Roaming\Windata\NUHORT.exe /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn VFNCBO.exe /tr C:\Users\Admin\AppData\Roaming\Windata\NUHORT.exe /sc minute /mo 1
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3056
- - C:\Windows\SysWOW64\WSCript.exe
    WSCript C:\Users\Admin\AppData\Local\Temp\VFNCBO.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2784
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1464

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2684

C:\Windows\system32\taskeng.exe
taskeng.exe {07A1754C-08D5-4223-B708-FCCF402A7BF0} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Roaming\Windata\NUHORT.exe
  C:\Users\Admin\AppData\Roaming\Windata\NUHORT.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1316
- C:\Users\Admin\AppData\Roaming\Windata\NUHORT.exe
  C:\Users\Admin\AppData\Roaming\Windata\NUHORT.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.6MB

MD5
019fc60427d0126adfec88980c7fb666

SHA1
55e2550ce27991e708e30a2e75253093eed0edb3

SHA256
6bf3a9c47d0dc7cbde76eb4dbd81f9fcac54f64d7bf907ff952438503d8588b6

SHA512
f8013fb625bb6354b50d7c27331c3088904ddd9103e0b28bac8965edd83d86353250e97aa872b82756d2765064d5be30e9e9579e216805c12216634627311a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\VFNCBO.vbs

Filesize
848B

MD5
54c40d25c90c3eb1467bfe6279711501

SHA1
f84e7541c12a29254697bce19fe66648fcd5cf78

SHA256
9ab5d94a00d1a331bf47149b574dee6483c7f39d57f036a60c8296ed2ffa2802

SHA512
60e5cc0cdbeec2db52c4c215c7d7a7de5f188827126608c5630332fe72f68568a7919bfd6795017351067b7dda9429d3640b6ccf2fa61f32f2ebc22d4582b417

Download Submit
C:\Users\Admin\AppData\Local\Temp\wV8C9Gck.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\wV8C9Gck.xlsm

Filesize
23KB

MD5
2f916f11888ede265330cf73d6386c05

SHA1
103d41e48111ee214f8ede9baab4859f6de827cc

SHA256
dd3d0a4a2f31c003286ce93a3746cb3ba587576c9caa14bdd7ece8c7a2c344a7

SHA512
aca4c8e1b8031a3b092c22501b462da0b210e0602e9d90f3e20b9c7e032993d400eeaada1981e9d02d34b7e93783ddc11934feaa96cee8b8aa19fb4d18996d53

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_RNEQTT.exe

Filesize
895KB

MD5
e18974062e92d1e85871e1be1487f6dc

SHA1
cef294ecb4f41dd4970a918550084d30705a1a3b

SHA256
f5e48b46d31d16b783f2c91a516562ea9aed19f1d4a6de820962c6b9a592b2ce

SHA512
3b0cf9fc65a9b950ec0b7dd9162f9902b6a2869980c13099daab0fa443b39e427b952e74537e527f4def4d7e7f2abd8912c3cee1dfa57b4ff2fa13eb91a1b007

Download Submit
memory/1268-149-0x0000000000160000-0x0000000000350000-memory.dmp

Filesize
1.9MB

Download
memory/1268-150-0x0000000000160000-0x0000000000350000-memory.dmp

Filesize
1.9MB

Download
memory/1316-107-0x00000000009E0000-0x0000000000BD0000-memory.dmp

Filesize
1.9MB

Download
memory/1316-105-0x00000000009E0000-0x0000000000BD0000-memory.dmp

Filesize
1.9MB

Download
memory/1464-46-0x00000000001D0000-0x00000000003C0000-memory.dmp

Filesize
1.9MB

Download
memory/1464-65-0x00000000001D0000-0x00000000003C0000-memory.dmp

Filesize
1.9MB

Download
memory/2548-99-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-95-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-101-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-94-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-155-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-151-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-36-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2548-18-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-146-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-153-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-144-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-108-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-110-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-140-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-157-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2548-142-0x0000000000A90000-0x0000000000C80000-memory.dmp

Filesize
1.9MB

Download
memory/2684-48-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2812-44-0x00000000057E0000-0x00000000059D0000-memory.dmp

Filesize
1.9MB

Download
memory/2812-141-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2812-98-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2812-96-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/3028-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3028-29-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/3028-11-0x0000000005850000-0x0000000005A40000-memory.dmp

Filesize
1.9MB

Download