healer | ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be

Resubmissions

29-10-2024 12:20

241029-phrxmawpbn 10

15-03-2023 15:29

230315-sw9alsdh98 10

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe
Size

864KB
MD5

23d9c4e1f9a78b1a72a39748ef4a2019
SHA1

789c420acdc6e147128fee8521b79e351f8293a6
SHA256

ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be
SHA512

519f1d4d6fed2c7d492713523ae6c378b9a6410a36873f225c920dc371ddae89a09774913adb1ee61699da24f957ad1621503148d177e5ba739b71f56b5f276d
SSDEEP

24576:7y0A+40IMBqTEtIg1iLTXpQNby65YO9S:u0f4071IhCNG

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023b79-19.dat	healer
behavioral2/memory/3576-22-0x0000000000D70000-0x0000000000D7A000-memory.dmp	healer
behavioral2/memory/3356-28-0x0000000004B40000-0x0000000004B5A000-memory.dmp	healer
behavioral2/memory/3356-30-0x0000000004D50000-0x0000000004D68000-memory.dmp	healer
behavioral2/memory/3356-31-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-38-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-58-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-57-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-54-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-52-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-51-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-48-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-46-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-44-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-42-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-40-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-36-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-34-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer
behavioral2/memory/3356-32-0x0000000004D50000-0x0000000004D62000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b4168yh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b4168yh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b4168yh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c81Ys67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b4168yh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b4168yh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b4168yh.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral2/memory/5028-66-0x0000000004B20000-0x0000000004B66000-memory.dmp	family_redline
behavioral2/memory/5028-67-0x0000000007700000-0x0000000007744000-memory.dmp	family_redline
behavioral2/memory/5028-87-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-101-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-99-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-97-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-95-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-93-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-91-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-89-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-85-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-83-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-81-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-79-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-77-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-75-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-73-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-69-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-71-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline
behavioral2/memory/5028-68-0x0000000007700000-0x000000000773E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
4980	tice6423.exe
2352	tice2507.exe
3576	b4168yh.exe
3356	c81Ys67.exe
5028	dbktb69.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b4168yh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c81Ys67.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice2507.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice6423.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	3356	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice6423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice2507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c81Ys67.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbktb69.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3576	b4168yh.exe
3576	b4168yh.exe
3356	c81Ys67.exe
3356	c81Ys67.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	b4168yh.exe
Token: SeDebugPrivilege	3356	c81Ys67.exe
Token: SeDebugPrivilege	5028	dbktb69.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4980	2880	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe	84
PID 2880 wrote to memory of 4980	2880	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe	84
PID 2880 wrote to memory of 4980	2880	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe	84
PID 4980 wrote to memory of 2352	4980	tice6423.exe	85
PID 4980 wrote to memory of 2352	4980	tice6423.exe	85
PID 4980 wrote to memory of 2352	4980	tice6423.exe	85
PID 2352 wrote to memory of 3576	2352	tice2507.exe	86
PID 2352 wrote to memory of 3576	2352	tice2507.exe	86
PID 2352 wrote to memory of 3356	2352	tice2507.exe	94
PID 2352 wrote to memory of 3356	2352	tice2507.exe	94
PID 2352 wrote to memory of 3356	2352	tice2507.exe	94
PID 4980 wrote to memory of 5028	4980	tice6423.exe	98
PID 4980 wrote to memory of 5028	4980	tice6423.exe	98
PID 4980 wrote to memory of 5028	4980	tice6423.exe	98

C:\Users\Admin\AppData\Local\Temp\ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe
"C:\Users\Admin\AppData\Local\Temp\ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6423.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6423.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2507.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2507.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4168yh.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4168yh.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c81Ys67.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c81Ys67.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1004
        5⤵
        Program crash
        
        PID:2820
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbktb69.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbktb69.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3356 -ip 3356
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6423.exe

Filesize
719KB

MD5
47184e7442802bf37bcc029a311eb7f3

SHA1
1feae07776956df32ddb2a86e98aa2fbad52ca6e

SHA256
4b2021148db4363dd8b6cb82e34bbb53d94844759121ab9b50f80e009d62e2de

SHA512
7728046f59dc66842fe31ae789549a02dbaeddf27cb8e748123cd9a755d16a13e07b6316b67949c16735554d6c76b89635b13aaa80133269dd6b5a8821aed817

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbktb69.exe

Filesize
399KB

MD5
f4144a8a6e619ab7e05bf8faea483bac

SHA1
d226283202e135eff03832b93f562d6d7aef70ce

SHA256
5e0619002a1c5a6b6e73228fa04f8f518939b04aadf70d6f5cd3152dc7a32960

SHA512
af4c3f0ba3c282a8c51d8921fc929f0cce845413ed9dc3ebffefe33b1f2080c6071fadf3b11868eb1258cbea068b306e870961fc8f9d581feddc8d346d95d1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2507.exe

Filesize
360KB

MD5
974b89180ed75a7de898d4e37da74477

SHA1
f2f26b64af20c7dd465804e13042a29fe24bec72

SHA256
02a3b9218a805ff8b8550f2d69866f42ac002f4312753db9a0c52ca0b654c773

SHA512
d90304a54d09470f3f919a8a5c1daf291a1a052a831755abe3ba796665b92a7406ee73b1a4a066fe7c7cb430867ba5bf70e986db1c9ceec63581d33cdf886f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4168yh.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c81Ys67.exe

Filesize
342KB

MD5
2a6ccc708d9eb4f55d8fd5b943999bc4

SHA1
1fbf51cbc1167ef793f784627a091740e0d9c5d7

SHA256
73318cd6686acab325fc1602e14f452e459a22311483f6997f7e50708219faf4

SHA512
8f2bc1ea67f9af6411d943fd5743a6a1b79033f3542486d1465ea475a71478ae6806f30b5b0fe9ba0165f7a449a988d6edf2866915320093f1922b4eb8acb701

Download Submit
memory/3356-28-0x0000000004B40000-0x0000000004B5A000-memory.dmp

Filesize
104KB

Download
memory/3356-29-0x00000000072A0000-0x0000000007844000-memory.dmp

Filesize
5.6MB

Download
memory/3356-30-0x0000000004D50000-0x0000000004D68000-memory.dmp

Filesize
96KB

Download
memory/3356-31-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-38-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-58-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-57-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-54-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-52-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-51-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-48-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-46-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-44-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-42-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-40-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-36-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-34-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-32-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3356-59-0x0000000000400000-0x0000000002B1A000-memory.dmp

Filesize
39.1MB

Download
memory/3356-61-0x0000000000400000-0x0000000002B1A000-memory.dmp

Filesize
39.1MB

Download
memory/3576-22-0x0000000000D70000-0x0000000000D7A000-memory.dmp

Filesize
40KB

Download
memory/3576-21-0x00007FF901213000-0x00007FF901215000-memory.dmp

Filesize
8KB

Download
memory/5028-66-0x0000000004B20000-0x0000000004B66000-memory.dmp

Filesize
280KB

Download
memory/5028-67-0x0000000007700000-0x0000000007744000-memory.dmp

Filesize
272KB

Download
memory/5028-87-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-101-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-99-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-97-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-95-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-93-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-91-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-89-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-85-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-83-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-81-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-79-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-77-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-75-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-73-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-69-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-71-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-68-0x0000000007700000-0x000000000773E000-memory.dmp

Filesize
248KB

Download
memory/5028-974-0x0000000007750000-0x0000000007D68000-memory.dmp

Filesize
6.1MB

Download
memory/5028-975-0x0000000007DF0000-0x0000000007EFA000-memory.dmp

Filesize
1.0MB

Download
memory/5028-976-0x0000000007F30000-0x0000000007F42000-memory.dmp

Filesize
72KB

Download
memory/5028-977-0x0000000007F50000-0x0000000007F8C000-memory.dmp

Filesize
240KB

Download
memory/5028-978-0x00000000080A0000-0x00000000080EC000-memory.dmp

Filesize
304KB

Download