Analysis

  • max time kernel
    147s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    06-01-2025 18:03

General

  • Target

    Sena.exe

  • Size

    1.7MB

  • MD5

    c87016453266c49b5c7b0d7abaf6801f

  • SHA1

    0230da2215ae2f918d52bf5c6a80fb3e09356395

  • SHA256

    26b267e0cb8636fe564969255b9b40e8aa3636c5084406d47bd538085e32651e

  • SHA512

    cbae59449af7e35c5b5bd068f75a6bd58c88500af6971057f72c83565f11052a9d3a517d98cb59c6f4e2f7576e73e58d981cb6f7e3a1f6b5f33bd842a699265f

  • SSDEEP

    24576:2nsJ39LyjbJkQFMhmC+6GD9qEoScovLgGCJv+gy4xwpdvGzk+kKufpFr:2nsHyjtk2MYC5GD8UcoDTCBtxCdeQ+y

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sena.exe
    "C:\Users\Admin\AppData\Local\Temp\Sena.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\._cache_Sena.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Sena.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/bPwDApnY2G
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:768
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1668
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2960
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    1.7MB

    MD5

    c87016453266c49b5c7b0d7abaf6801f

    SHA1

    0230da2215ae2f918d52bf5c6a80fb3e09356395

    SHA256

    26b267e0cb8636fe564969255b9b40e8aa3636c5084406d47bd538085e32651e

    SHA512

    cbae59449af7e35c5b5bd068f75a6bd58c88500af6971057f72c83565f11052a9d3a517d98cb59c6f4e2f7576e73e58d981cb6f7e3a1f6b5f33bd842a699265f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    f3f5b91c14432bf3540427f83b328840

    SHA1

    0c462c6e84c7d88db4b00a1da524f4ecd9ed4a9e

    SHA256

    bc493ac6c70003913f4fdf181b5c97959a0646badf3752187a262cf919f6c247

    SHA512

    51cb0c2d85e4500bb1ecf0fbafabacee707fb4a5768f3a420d3e59cbf24e1596bee1097713fcba781685531d484414ce95a19c40467f578f842ad628cf0f6913

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b67b026b0461fe581be932e10eb4b02a

    SHA1

    4e42904a08d1aa9878dc3ab0645a9169704283f0

    SHA256

    57a4bea25b680d206c002d0f6d357617936d71570a228ea585c5a9a8120c6d46

    SHA512

    16592e5da3bb1d73f196ddf9593cdbff3234193627ee3492060c5b365cdbabbce4baebdad935e0a885d1d89de38f9a4a2c568fe88d589cb72409ed81fa3a8a77

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    86504f5f7c882f500b107694b4a55f6c

    SHA1

    817639572d24ce954348d2aa48e003902669b09f

    SHA256

    bd5dd40f9c2334fabb2b8bcc8aaee74d5e8f05764eb607c6afbbd22f10bc7893

    SHA512

    4284ac855db52cec6172b3829bce346cf56c49a516864b69058cdd052734bf2ae73d45a6502d988582aef64f699c650c00d32a4394ece10296a411dcc0263568

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e73638cc6f580494e1164449c78e4b06

    SHA1

    c2f4ab274e6edb2e5ce452b24d849c0f9b8b65d1

    SHA256

    2feda149d75e89b06ce835daa6b600e458d0e07d7587d98f6126b1f76816f448

    SHA512

    826496d03309707c1b3389e69e71491d30fe5d5975e94da75d49b40b5f844c02ea12a52c36c6dc71d690882347537d96cf5bae9f2abbce6156d6f216c99fc29f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    94d20fa0b0abb7406cb74dd723c5d533

    SHA1

    de42d4331bc6536dd702748cae34a6e08754f841

    SHA256

    c80f1017410c02feafa9a3b736e3449dad899de354b44555059a3556a0e1adc5

    SHA512

    81b074a7b74dc92b5288a40b47ded365acac02f3a487846e2576757f2f403fd8b14714911afd3f579ad92fb008142c09f9b15a719c8ebf929a20d371f1561abc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8662a9319d80192de5c5025534f9c1aa

    SHA1

    a5b02ec0b52a08d8b662dac9605c792d7fd6a792

    SHA256

    1c7b0253adb7b8770f4928b86027f76b4dddd3a25064d3cd3f07817c1ee87770

    SHA512

    795cdae478c8a12aa8efbb48c571236921a885f8dad3e75ece5969dca0b2d0d10f2f46a5e7b6c36c7055cda34c53f26494b896156effa906b297e08e963db1a9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    26e7cd7ba3724c946b7e81128ad1266c

    SHA1

    2917c12e140ee3cb7277c5031e2e0b47ea7a77ce

    SHA256

    0f2a52c0ff0907b1519e838b3784da835d72325c74d9c2faf772d97c1e05c2ac

    SHA512

    5adb1ac70b51927eab4ce2778a900daedabe31eac1818bbd5fde06df856062020a2b8daf1e8dbc5774ccfeab01001a7bebed7892b368e57f30bca9c97df87a61

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    daa78cad04e954307a321f4ae58736ab

    SHA1

    4c731023487c828ac25aa1d1a73330370a972aa3

    SHA256

    9198048c98e86386495c1c83974a84924f4ed76b6e1b2048fadf8dfdea1d1843

    SHA512

    636b10df28d4cb59161a41bf9dc6d8596a25295e23f5d6fff872b03d1f1f659fa5218d4231f461c7ca4721faa1bdc888603543873cf4fffbb6a1853a36e226a1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e2fe21f23a6dce8304840b01e0053d8e

    SHA1

    fd934d9b452116c811445666ec80d830278cce3a

    SHA256

    9613169a765ee2c2e9a127228c5fd0d0e6747bc87ed8bf0bcb5b8aba25473a07

    SHA512

    9420fc49e5d1970d9d840f04db6f71c35d60bbeeceb568f736f2a0ebb5ea4d2e72fffe75adf8e7bd25bc9b55b54805b0e5ae42e56177cc37fdd620d63c024ee9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    99b61eabd2536d1512ab42750c4a77a2

    SHA1

    68202e670fa22991bc2ce080986bb54352bf7a0a

    SHA256

    c7912e5cbf2ea97ceaeb434948b5297dbdb0b978fcfa1f5c208b574a4b83c55d

    SHA512

    ab12c76e03a2d432b71f1e99f942e4e1761cd0e8e4d29f4c3ae4110a106c722c7cba85f137d4ecb225f66309f6a352e0369b1c950ca85388c44eee1b0fd046a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6f7524dc5bbb068a7e8fecbbaca990ca

    SHA1

    4d53a57945cfd2807724d8a02d1b79b522f40812

    SHA256

    d20789605000c41495ac5d47d082cff9099f783ce6fa9c1115e72666fb744b5f

    SHA512

    8da48e0871417712a64e7411ce77a8fc5238644d6af56aa7a3e57ddcfeb89392b1c0725d7a5dcfcabe1398abc7e08fbac3f03ced68bd937bddbf37c9667ee9f7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    685d7dfeb92d70893939c5fce311cfdf

    SHA1

    2ea0e0fd008fe5ebe0b1bd19b1f86de96fb2e15f

    SHA256

    50d054b4f0f0f313b27dd9b0ae8b179426b3edae4e2f7aa00ee4b7548e655fac

    SHA512

    b6753a58e1d5aeef50e90f8b7771da505316db3085822b666bf4a20c052d206351353086d7d164aa2372a1144ed510f4dc14dac38bcca747a2b5164713c1cb23

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\78076te\imagestore.dat

    Filesize

    24KB

    MD5

    18c95a3e94f2b13b5fe2e376094b7cf7

    SHA1

    49bf6007f64300dca61f41f5bbd3af637d52041c

    SHA256

    56ba317562a49da7315fe2edb23f80914a88f96d9bb090109d319bb898e27343

    SHA512

    138d56b1550485f25e295ca28848680cf5fc5bcf999f0770e9b5cba7faec854de7059fc69db8a0a44bfa058fc408e045f7bcd6f5513d6dafac09e0620705a49a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6J4GCMD\favicon[1].ico

    Filesize

    23KB

    MD5

    ec2c34cadd4b5f4594415127380a85e6

    SHA1

    e7e129270da0153510ef04a148d08702b980b679

    SHA256

    128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

    SHA512

    c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

  • C:\Users\Admin\AppData\Local\Sena\system_info.txt

    Filesize

    59B

    MD5

    aeeea6eebb09382310f5184f8fe69259

    SHA1

    cea09f6f3bf5e720d078e2533cae372efd4039a2

    SHA256

    51469f54259cece71f79aff22be7442b4965ddd29cf5f0c057c592460be6d890

    SHA512

    8dba1cf56de3e14f5942ea792a109e8ebdbb2dbe168c0c0211a2bcc757a6aa5c77c54b2a6b0ff48a9cd044eb7f543772b27d3d4a551b176acbef1c942b4066b8

  • C:\Users\Admin\AppData\Local\Temp\CabE725.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarE728.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\oSyQ8tRj.xlsm

    Filesize

    21KB

    MD5

    4783e7b5ecf5f16b97267a638af3bfea

    SHA1

    f411772d0e239b57ec2da41c412460173d55fd87

    SHA256

    6b270c7988ac9f880e6f29e93dfbbbe26f6399e7fcf3e84217f2de046007f61b

    SHA512

    38c41dca1af478594fba96828eb77e344e141579462587450d375fd4e33744f338eaf0448810a254158f04da5410f87e0b4ece7d3a00b120bc62d2d48fb01f6d

  • C:\Users\Admin\AppData\Local\Temp\oSyQ8tRj.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\oSyQ8tRj.xlsm

    Filesize

    25KB

    MD5

    fa73a61142c835c2eed187395c0a35fa

    SHA1

    370757ab6229c12b340c47b239c957c52bd07454

    SHA256

    248746fbfb3d4bec53c8fdbda2f2a91c30c150a55843573434e94efafb1dfe97

    SHA512

    7a2dc223312274a34ddb057271ee68311a691b2b59687582e5db9af12937d3607d4c70842b554c8ad345048ea42b9c54bd07c80ca02afdfc1315cc59ab9c4735

  • C:\Users\Admin\AppData\Local\Temp\oSyQ8tRj.xlsm

    Filesize

    23KB

    MD5

    07b21bc6bd97ade0e270d501e423c56c

    SHA1

    7679886792d45b4d170682a0261aa009857480b6

    SHA256

    1f37c4753567cba97ef82f7716751d5e91c444ff9ac56af562d07bebf682e26b

    SHA512

    38530ea1003f438689bc6a78654998a4539bf76a2857def7c5dac5f01b4919b623e4b84d34c9205efec5a40a98b1989f60ed5290bf2b4c14e76d15c192546cc3

  • C:\Users\Admin\AppData\Local\Temp\oSyQ8tRj.xlsm

    Filesize

    21KB

    MD5

    6520015d45c9bc3796647663f3c41983

    SHA1

    79dc1ef2ec8cf3af723a18ab99e216a8baf6e029

    SHA256

    c3227eddac9731d8de025c18e6359b54e7e4cd35fb0edd639010b3f03921d714

    SHA512

    37974f2157c552dc2cd6437405188b3ebd7f137326ad7aee94685bb0d7eb4bf674ba32d65f54dcd5a49abeee476562984793bdd4b52b6cb5ab1006f83fa7d1a5

  • C:\Users\Admin\AppData\Local\Temp\oSyQ8tRj.xlsm

    Filesize

    26KB

    MD5

    f7e132a8153bce1b99c92582e687803c

    SHA1

    cdaf6553e420b926f47aae5aa34632b798e90b3d

    SHA256

    2271bceaa421016711b065ff8d56e7a88833c1d223ef065607fa9a748e106dc4

    SHA512

    cb7b3c2e997ee04a4580ce5c6cc442d657d214683309b5ca152c60b39d5546821259f05a0224bbcef6b9254534f52c0e92a4a34318bbcdf54fea88e696a17a8d

  • C:\Users\Admin\Desktop\~$OpenBackup.xlsx

    Filesize

    165B

    MD5

    ff09371174f7c701e75f357a187c06e8

    SHA1

    57f9a638fd652922d7eb23236c80055a91724503

    SHA256

    e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

    SHA512

    e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

  • \Users\Admin\AppData\Local\Temp\._cache_Sena.exe

    Filesize

    1.0MB

    MD5

    9872c633ef83d043cfca1609c7668719

    SHA1

    116579be25c526f3fb21620263467717e52db237

    SHA256

    553cfbf1aec44f3baf003f3a095e9638d4c3ec4aa387e07cf64ff69601353306

    SHA512

    93bc495d230f8198e573275c037db8b3487ef8cf1ae7029a01998018f4694e2a793bc9bc73e776e171870f0ac1ebbaf3a917ec8da5be235586569989dd0be0e1

  • memory/1304-26-0x0000000000400000-0x00000000005C5000-memory.dmp

    Filesize

    1.8MB

  • memory/1304-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2296-169-0x0000000000400000-0x00000000005C5000-memory.dmp

    Filesize

    1.8MB

  • memory/2296-476-0x0000000000400000-0x00000000005C5000-memory.dmp

    Filesize

    1.8MB

  • memory/2296-1150-0x0000000000400000-0x00000000005C5000-memory.dmp

    Filesize

    1.8MB

  • memory/2296-626-0x0000000000400000-0x00000000005C5000-memory.dmp

    Filesize

    1.8MB

  • memory/2296-621-0x0000000000400000-0x00000000005C5000-memory.dmp

    Filesize

    1.8MB

  • memory/2488-38-0x0000000001080000-0x000000000118A000-memory.dmp

    Filesize

    1.0MB

  • memory/2488-42-0x0000000000490000-0x000000000049A000-memory.dmp

    Filesize

    40KB

  • memory/2488-43-0x0000000000490000-0x000000000049A000-memory.dmp

    Filesize

    40KB

  • memory/2488-39-0x0000000007100000-0x00000000072FA000-memory.dmp

    Filesize

    2.0MB

  • memory/2488-170-0x0000000000490000-0x000000000049A000-memory.dmp

    Filesize

    40KB

  • memory/2488-171-0x0000000000490000-0x000000000049A000-memory.dmp

    Filesize

    40KB

  • memory/2960-40-0x0000000000390000-0x000000000039A000-memory.dmp

    Filesize

    40KB

  • memory/2960-137-0x0000000000390000-0x000000000039A000-memory.dmp

    Filesize

    40KB

  • memory/2960-41-0x0000000000390000-0x000000000039A000-memory.dmp

    Filesize

    40KB

  • memory/2960-37-0x00000000008A0000-0x00000000009AA000-memory.dmp

    Filesize

    1.0MB

  • memory/2960-138-0x0000000000390000-0x000000000039A000-memory.dmp

    Filesize

    40KB

  • memory/2972-49-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2972-136-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB