healer | 14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150.exe
Size

1.0MB
MD5

fae4d57cc7d87f74415914001edc5b68
SHA1

bb509c48a27af9323294797cf25eef291a257a6b
SHA256

14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150
SHA512

94e37a98ba13c5076c26df430653159270ac9927019631014067851e18a9553d93f17e2549d4311c4fb7b9da1641dec718ce88158a25c63e937735b2b6d8ccb2
SSDEEP

12288:NMrry90QD3hBd+J9EZx65kgL34SEr0NHHd7eS3qZclysEosOHBA5fbDjTZok6Fh5:CyHDRB8Jax6Sg74bTJBDjFm2blFoZ

Score

10^/10

healer redline gena discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023c1c-26.dat	healer
behavioral1/memory/3684-28-0x0000000000DF0000-0x0000000000DFA000-memory.dmp	healer
behavioral1/memory/3084-34-0x00000000049A0000-0x00000000049BA000-memory.dmp	healer
behavioral1/memory/3084-36-0x0000000004C40000-0x0000000004C58000-memory.dmp	healer
behavioral1/memory/3084-46-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-64-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-62-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-61-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-58-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-56-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-54-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-52-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-50-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-48-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-44-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-42-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-40-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-38-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3084-37-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	mx1430wu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	mx1430wu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	mx1430wu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	mx1430wu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	ns0746vP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ns0746vP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	ns0746vP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ns0746vP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	mx1430wu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	mx1430wu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ns0746vP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ns0746vP.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4800-72-0x0000000004A50000-0x0000000004A96000-memory.dmp	family_redline
behavioral1/memory/4800-73-0x0000000007120000-0x0000000007164000-memory.dmp	family_redline
behavioral1/memory/4800-75-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-95-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-107-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-105-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-103-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-101-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-97-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-93-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-91-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-89-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-87-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-85-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-83-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-81-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-79-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-77-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-99-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline
behavioral1/memory/4800-74-0x0000000007120000-0x000000000715E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
4452	will2120.exe
1296	will1034.exe
948	will0671.exe
3684	mx1430wu.exe
3084	ns0746vP.exe
4800	py63Wf21.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	mx1430wu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	ns0746vP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	ns0746vP.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	will2120.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	will1034.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	will0671.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
756	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	3084	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	will1034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	will0671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ns0746vP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py63Wf21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	will2120.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3684	mx1430wu.exe
3684	mx1430wu.exe
3084	ns0746vP.exe
3084	ns0746vP.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	mx1430wu.exe
Token: SeDebugPrivilege	3084	ns0746vP.exe
Token: SeDebugPrivilege	4800	py63Wf21.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 4452	3280	14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150.exe	84
PID 3280 wrote to memory of 4452	3280	14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150.exe	84
PID 3280 wrote to memory of 4452	3280	14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150.exe	84
PID 4452 wrote to memory of 1296	4452	will2120.exe	85
PID 4452 wrote to memory of 1296	4452	will2120.exe	85
PID 4452 wrote to memory of 1296	4452	will2120.exe	85
PID 1296 wrote to memory of 948	1296	will1034.exe	87
PID 1296 wrote to memory of 948	1296	will1034.exe	87
PID 1296 wrote to memory of 948	1296	will1034.exe	87
PID 948 wrote to memory of 3684	948	will0671.exe	88
PID 948 wrote to memory of 3684	948	will0671.exe	88
PID 948 wrote to memory of 3084	948	will0671.exe	95
PID 948 wrote to memory of 3084	948	will0671.exe	95
PID 948 wrote to memory of 3084	948	will0671.exe	95
PID 1296 wrote to memory of 4800	1296	will1034.exe	99
PID 1296 wrote to memory of 4800	1296	will1034.exe	99
PID 1296 wrote to memory of 4800	1296	will1034.exe	99

C:\Users\Admin\AppData\Local\Temp\14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150.exe
"C:\Users\Admin\AppData\Local\Temp\14b690f25b5f16e7abd8a92e241e2d4ed176b53c1269afd854c3d3bbf6812150.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will2120.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will2120.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will1034.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will1034.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0671.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0671.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx1430wu.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx1430wu.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns0746vP.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns0746vP.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1080
        6⤵
        Program crash
        
        PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py63Wf21.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py63Wf21.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3084 -ip 3084
1⤵
PID:1908

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will2120.exe

Filesize
866KB

MD5
79174c261888a050baa5823b92c8cbbd

SHA1
fead655228a70c1c5c82de9743b96d8d5ab36723

SHA256
db6cee2e7fcff1746899251e1359d51dcfa01dcc4578a66b7d6feb32fc770cd6

SHA512
5802176824d2f526a39b685f4ffa877976b7fc60d6e1127e4fc1c72fc5e6a2f6346915fa0788ea1accccddfd2639f1ae572dc04f7af779f6c8815379e7d00e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will1034.exe

Filesize
721KB

MD5
6a3c88a2675678c260897f247bb337b0

SHA1
e233d8bfe93913b093d5fcec60f0060e818f0330

SHA256
a95842793021acef267cec146f62251b1a6344328cb819278e38687ca1ebe120

SHA512
6573545c1497ad6ecd490d05edfd1d01b581709de5fcb469c4f97583f45f1bdbe8ae28b1e4b7c99a7fb927541abc90fa0c49c93bc599bdf047a26a27c41778c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py63Wf21.exe

Filesize
429KB

MD5
fd36bd54b4b6765456bb3e528c8276d1

SHA1
e672923b68ad5df25ee01d4e1ba1bbcfc723f3c5

SHA256
116ed4ea503e649bc95167e3f0b71ebad9980eb619de8507ef7ed9700ec06183

SHA512
c4cd400c41c53d0f6b72621438ec97d73cfa29cb1ed51d67d3a0e4d127fd091f5cc5c97fd40d335de8f27b49462a566a8c791989192bac718dc55bdc5637836b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\will0671.exe

Filesize
353KB

MD5
2cd9567b57cef8603968b8c7332fd0a1

SHA1
aeb539e2deb0d0dae74839dab4f076a03ce58b93

SHA256
c0f8ceb7213c6711f4582e932a74e7e97bae1b869cb1c3e3fe982359fe108592

SHA512
e185204e8dfc1eaec77d33eabd5a3e3c988b4c974cb234218eb638520bd6b38ce8b001c2ac30eea748f73c366198c4b9fbc7d03fc0399dc6a7e5f4504e2fee5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mx1430wu.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ns0746vP.exe

Filesize
333KB

MD5
8bc229045e4e5aabd81b8872d158da39

SHA1
e45f8c9319c308abff4da72fe652edc5490d6840

SHA256
ca8a0915e3d994f74095a94d45193dab56376f04a58b4131a978eafc981313b1

SHA512
e17e0b7fd06ad69a8d97e54db9e868800dc204db261d7b14727d35fc983394f4c3281f91d0f3fcded6f0059bd2d3fef5270406f591ed464fcea36de6bb5cdfd7

Download Submit
memory/3084-34-0x00000000049A0000-0x00000000049BA000-memory.dmp

Filesize
104KB

Download
memory/3084-35-0x0000000007140000-0x00000000076E4000-memory.dmp

Filesize
5.6MB

Download
memory/3084-36-0x0000000004C40000-0x0000000004C58000-memory.dmp

Filesize
96KB

Download
memory/3084-46-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-64-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-62-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-61-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-58-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-56-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-54-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-52-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-50-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-48-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-44-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-42-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-40-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-38-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-37-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3084-65-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/3084-67-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/3684-28-0x0000000000DF0000-0x0000000000DFA000-memory.dmp

Filesize
40KB

Download
memory/4800-72-0x0000000004A50000-0x0000000004A96000-memory.dmp

Filesize
280KB

Download
memory/4800-73-0x0000000007120000-0x0000000007164000-memory.dmp

Filesize
272KB

Download
memory/4800-75-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-95-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-107-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-105-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-103-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-101-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-97-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-93-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-91-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-89-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-87-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-85-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-83-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-81-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-79-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-77-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-99-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-74-0x0000000007120000-0x000000000715E000-memory.dmp

Filesize
248KB

Download
memory/4800-980-0x0000000007860000-0x0000000007E78000-memory.dmp

Filesize
6.1MB

Download
memory/4800-981-0x0000000007E80000-0x0000000007F8A000-memory.dmp

Filesize
1.0MB

Download
memory/4800-982-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/4800-983-0x0000000007250000-0x000000000728C000-memory.dmp

Filesize
240KB

Download
memory/4800-984-0x0000000008090000-0x00000000080DC000-memory.dmp

Filesize
304KB

Download