Overview

overview

10

Static

static

10

8b480d332e...80.exe

windows7-x64

10

8b480d332e...80.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-01-2025 03:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe

  • Size

    794KB

  • MD5

    87fec7ddf77186a30de03851878e056f

  • SHA1

    87d60c1f5be6c44207374fda0f363d01584a8f58

  • SHA256

    8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980

  • SHA512

    30815f470ea6ba48a057e9d16529234a233a2d7dd455cb5849c7ad7afcabb2b62c8ea449606f7e135662e58132737060b1d4f9feffadbb45ebca079fdde6c29a

  • SSDEEP

    12288:WMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Qln2M:WnsJ39LyjbJkQFMhmC+6GD9un9

Score
10/10
xredbackdoordiscoverypersistenceupx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Checks computer location settings 2 TTPs 26 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 27 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • UPX packed file 52 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 26 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
    "C:\Users\Admin\AppData\Local\Temp\8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3584
      • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4860
        • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4684
          • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
            "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3412
            • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
              "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2428
              • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
                "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4480
                • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
                  "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:3752
                  • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
                    "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:5076
                    • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
                      "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:3804
                      • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
                        "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:3912
                        • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
                          "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          PID:184
                          • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
                            "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            PID:3888
                            • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
                              "C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe"
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:4352
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1424
          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:748
            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4012
              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4064
                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1596
                  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:5072
                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2228
                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:1944
                        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          PID:2924
                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            PID:456
                            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              PID:3316
                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:4764
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe
    Filesize

    794KB

    MD5

    87fec7ddf77186a30de03851878e056f

    SHA1

    87d60c1f5be6c44207374fda0f363d01584a8f58

    SHA256

    8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980

    SHA512

    30815f470ea6ba48a057e9d16529234a233a2d7dd455cb5849c7ad7afcabb2b62c8ea449606f7e135662e58132737060b1d4f9feffadbb45ebca079fdde6c29a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.cfg
    Filesize

    349B

    MD5

    e075ebba74c587c898af6245f3ec31fe

    SHA1

    b4288c1964d023522e288cc6c2f4826eb4a90e51

    SHA256

    a6d74e4fe64b38da2d9a9cfccaba79da3db2b6e49d0b19b65cc52458883c6919

    SHA512

    1dbc26e568706e43bd42280d2600ec8ad5c590eefa3570a58f5a4b76607b5bb9333ea868c0d62965c3317034bd804fc01dd77e47ce72fd0589d2c6743dbf96f7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.cfg
    Filesize

    349B

    MD5

    e3d1e3087fe72aed13e88c24342f15b4

    SHA1

    7f0a2b46a726db414555758e0603a5e7a0e3f33a

    SHA256

    037bd3d79ef9f1a43c42ed437c8b029025118d5e7b26a80c1e78a7e9afbd5d9c

    SHA512

    d75cccc129bac978508573555f1218b5727731a3f3b00ce81cee2a2986083788e5d421337f4bc75900920a54198602b5d30efecbe2449c72dfaf115a598a7086

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\._cache_8b480d332e58e3f53d16189e9dcbbeaa044a8157aa124a34ed516c4e2e66f980.exe
    Filesize

    40KB

    MD5

    1dccc7cb738029a6f264f07b748b36a4

    SHA1

    4c42ce1f07447dd95c28e8a7b4965c66a9d3ae69

    SHA256

    2361dd3272c2ca4046b3733cf464fc2b285a5b9d68b03ec8d43d874f4ce8276a

    SHA512

    9679405c74401fcb062de6669dc72bbe892b7ba1555cab76397c0c30d0cccc2d0d03250a111d84ba4b4a57b76e5cecf266d6e4182cf166768ae531b9bbcdfa14

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3EE75E00
    Filesize

    27KB

    MD5

    a7cf9001acb8fceb0cb832b959c06fa9

    SHA1

    7f6909a35e8accf09e7f36ec6a011e23e381c313

    SHA256

    9043a6f34f1bb9b8648c561a86a41aec7b45906fd407f818387d18970d81aff9

    SHA512

    ebd510bcfba3ec9e43ccfe9527979959281ab305b0f40132794dc860244772903c523ae067fa52e86cc1a6933c7456592cd1d48390e889ce1f060efaca93f8f0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\VFtbDnny.xlsm
    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    Download Submit

  • memory/184-605-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/184-584-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/456-607-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/456-586-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/748-345-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/748-318-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1424-312-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1424-284-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1436-195-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1436-234-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1596-447-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1596-414-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1944-523-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1944-551-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2228-517-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2228-492-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2428-382-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2428-404-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2904-228-0x00007FFD794D0000-0x00007FFD794E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2904-226-0x00007FFD7BBD0000-0x00007FFD7BBE0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2904-227-0x00007FFD794D0000-0x00007FFD794E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2904-224-0x00007FFD7BBD0000-0x00007FFD7BBE0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2904-223-0x00007FFD7BBD0000-0x00007FFD7BBE0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2904-222-0x00007FFD7BBD0000-0x00007FFD7BBE0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2904-225-0x00007FFD7BBD0000-0x00007FFD7BBE0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2924-556-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2924-582-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3316-612-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3316-634-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3380-193-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

    Download

  • memory/3380-461-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

    Download

  • memory/3380-130-0x0000000000690000-0x0000000000691000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3380-283-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

    Download

  • memory/3412-342-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3412-376-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3412-352-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3584-191-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3584-65-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3584-236-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3728-0-0x00000000006C0000-0x00000000006C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3728-129-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

    Download

  • memory/3752-486-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3752-464-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3804-550-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3804-524-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3888-609-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3888-632-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3912-555-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/3912-579-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4012-350-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4012-374-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4064-379-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4064-409-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4480-411-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4480-450-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4684-347-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4684-319-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4860-285-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4860-314-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/5072-448-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/5072-462-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/5072-488-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/5076-519-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/5076-493-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download