healer | 7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exe
Size

795KB
MD5

9f50f49275877cb5113b3b3ec9a102ce
SHA1

95dcd8cfa94bec1a8b9187162a942078cd259c14
SHA256

7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655
SHA512

56ff98a21fa15f2316928b67e0dd3a3016ee2cbc0e6f7e269477570ac751d2776e0f8fabeddf514832c9cb136967e330ab4790a8aba82a020d8ceac9e2bef282
SSDEEP

12288:iMrcy90/yEJDBOuKtjaPHJsQa1NYl4Ox6zDnCvgrgxySUe5OQChkMMJFmDbG8GeM:ayDEJDn0aPSQT+BzqgrgSVkHFmDbGbF

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0008000000023cb2-19.dat	healer
behavioral1/memory/2840-22-0x0000000000530000-0x000000000053A000-memory.dmp	healer
behavioral1/memory/3844-29-0x0000000000840000-0x000000000085A000-memory.dmp	healer
behavioral1/memory/3844-31-0x0000000002640000-0x0000000002658000-memory.dmp	healer
behavioral1/memory/3844-32-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-41-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-59-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-57-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-55-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-53-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-51-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-49-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-47-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-45-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-43-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-39-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-37-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-35-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/3844-33-0x0000000002640000-0x0000000002652000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

b9975Tn.exec40go42.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b9975Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b9975Tn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c40go42.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c40go42.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c40go42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b9975Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b9975Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b9975Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b9975Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c40go42.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c40go42.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c40go42.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3148-67-0x0000000002330000-0x0000000002376000-memory.dmp	family_redline
behavioral1/memory/3148-68-0x0000000002530000-0x0000000002574000-memory.dmp	family_redline
behavioral1/memory/3148-72-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-82-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-102-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-100-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-98-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-96-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-94-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-92-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-90-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-88-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-84-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-80-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-78-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-76-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-74-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-86-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-70-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline
behavioral1/memory/3148-69-0x0000000002530000-0x000000000256E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

Processes:

tice4750.exetice8593.exeb9975Tn.exec40go42.exedQgxJ57.exe

pid	Process
228	tice4750.exe
4344	tice8593.exe
2840	b9975Tn.exe
3844	c40go42.exe
3148	dQgxJ57.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

b9975Tn.exec40go42.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b9975Tn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c40go42.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c40go42.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exetice4750.exetice8593.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice4750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice8593.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
4960	sc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2956	3844	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

dQgxJ57.exe7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exetice4750.exetice8593.exec40go42.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dQgxJ57.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice4750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice8593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c40go42.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b9975Tn.exec40go42.exe

pid	Process
2840	b9975Tn.exe
2840	b9975Tn.exe
3844	c40go42.exe
3844	c40go42.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b9975Tn.exec40go42.exedQgxJ57.exe

description	pid	Process
Token: SeDebugPrivilege	2840	b9975Tn.exe
Token: SeDebugPrivilege	3844	c40go42.exe
Token: SeDebugPrivilege	3148	dQgxJ57.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exetice4750.exetice8593.exe

description	pid	Process	procid_target
PID 960 wrote to memory of 228	960	7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exe	84
PID 960 wrote to memory of 228	960	7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exe	84
PID 960 wrote to memory of 228	960	7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exe	84
PID 228 wrote to memory of 4344	228	tice4750.exe	86
PID 228 wrote to memory of 4344	228	tice4750.exe	86
PID 228 wrote to memory of 4344	228	tice4750.exe	86
PID 4344 wrote to memory of 2840	4344	tice8593.exe	87
PID 4344 wrote to memory of 2840	4344	tice8593.exe	87
PID 4344 wrote to memory of 3844	4344	tice8593.exe	97
PID 4344 wrote to memory of 3844	4344	tice8593.exe	97
PID 4344 wrote to memory of 3844	4344	tice8593.exe	97
PID 228 wrote to memory of 3148	228	tice4750.exe	102
PID 228 wrote to memory of 3148	228	tice4750.exe	102
PID 228 wrote to memory of 3148	228	tice4750.exe	102

C:\Users\Admin\AppData\Local\Temp\7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exe
"C:\Users\Admin\AppData\Local\Temp\7f83b80b1dce3ac6418d4a0273be905473610f70b6bc05f7c7c2ec693e237655.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice4750.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice4750.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8593.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8593.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9975Tn.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9975Tn.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c40go42.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c40go42.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3844
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1080
        5⤵
        Program crash
        
        PID:2956
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dQgxJ57.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dQgxJ57.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3844 -ip 3844
1⤵
PID:2120

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice4750.exe

Filesize
649KB

MD5
7988391b62ea612fa7282a910e707983

SHA1
02e9e3ecbc003919c67200002b515a83a1b5d59e

SHA256
bc14befea17297a4a26a1f5cc3b135370f94ee97ca4cdd04233f61f8957ae403

SHA512
fe0a94361538fba44ea1c3bb24ed1cbcd0122dc6cff86c6614f196fa9bfbbb33e1704fa20a37251b49039858ee95da4f467177772071ebbcf3b19f9b95a2d050

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dQgxJ57.exe

Filesize
283KB

MD5
564de7cc1bff2a970a79c608db88b98d

SHA1
909d4e9cad42c0d243cc324f48dccc5ce231b9d4

SHA256
18147ed3a23caeeb41493291f19ca992053d7b8d97f6b44031c9588e6fda050f

SHA512
98bad50818e6ba4046575038c2f315e339ff66eb423164e694eb8db0a77c5634b84288592ac1a2bf47ef9199c3a75faab6d83b04642c2da48b7a2cf9c1d3c59d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8593.exe

Filesize
324KB

MD5
b9f25eb45b286f2478fc55c2bbc26d38

SHA1
84926f30bc02aa0f9c44e24892660450c3753ca8

SHA256
862d4c4dd231dbd75835562cd8a43aa814fecfb3a0545baeeb48c6f77f06a411

SHA512
98ee74fafd0c1376a4bd7967c10ca4a4523a0637e775cefbcac46af561c49a10e93853bb4abfa9fd2e6d6543506dfd01600c24154a7e1a309510b15f3ce67f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9975Tn.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c40go42.exe

Filesize
225KB

MD5
ce33f1ebc247b4f49234643b8f69a293

SHA1
dc84834b6ad3542b9c80da22385ae80cb8a056b6

SHA256
e87caf40bb8c4250de35ebc1e9ea10e5c00fd1b0d00afc8e5446ac4e9b6763e0

SHA512
0d7fe569389dd33564743f2118d0c0bb983f3e328c856bf3c31eb74548b3cec1bc6608b42aa69a5feeb6c6215e4997c3fb7f04e017ba69a8db8fc3dfe1f10284

Download Submit
memory/2840-21-0x00007FFE714A3000-0x00007FFE714A5000-memory.dmp

Filesize
8KB

Download
memory/2840-22-0x0000000000530000-0x000000000053A000-memory.dmp

Filesize
40KB

Download
memory/2840-23-0x00007FFE714A3000-0x00007FFE714A5000-memory.dmp

Filesize
8KB

Download
memory/3148-74-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-88-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-976-0x00000000059C0000-0x0000000005ACA000-memory.dmp

Filesize
1.0MB

Download
memory/3148-975-0x00000000053A0000-0x00000000059B8000-memory.dmp

Filesize
6.1MB

Download
memory/3148-69-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-978-0x00000000028D0000-0x000000000290C000-memory.dmp

Filesize
240KB

Download
memory/3148-70-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-86-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-100-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-76-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-78-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-80-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-84-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-977-0x0000000002890000-0x00000000028A2000-memory.dmp

Filesize
72KB

Download
memory/3148-90-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-92-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-94-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-96-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-98-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-979-0x0000000002910000-0x000000000295C000-memory.dmp

Filesize
304KB

Download
memory/3148-67-0x0000000002330000-0x0000000002376000-memory.dmp

Filesize
280KB

Download
memory/3148-68-0x0000000002530000-0x0000000002574000-memory.dmp

Filesize
272KB

Download
memory/3148-72-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-82-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3148-102-0x0000000002530000-0x000000000256E000-memory.dmp

Filesize
248KB

Download
memory/3844-57-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-62-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3844-60-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3844-33-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-35-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-37-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-39-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-43-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-45-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-47-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-49-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-51-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-53-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-55-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-59-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-41-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-32-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/3844-31-0x0000000002640000-0x0000000002658000-memory.dmp

Filesize
96KB

Download
memory/3844-30-0x0000000004AE0000-0x0000000005084000-memory.dmp

Filesize
5.6MB

Download
memory/3844-29-0x0000000000840000-0x000000000085A000-memory.dmp

Filesize
104KB

Download