healer | 57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f.exe
Size

894KB
MD5

bd58af96d1d1952f5a265f0bb7012672
SHA1

db9d171b67b71b47f183f4d30a0180da10f76478
SHA256

57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f
SHA512

195e1c514cdfe29a115a7f93351af25b0c1a14e7dfce9e88a6f3913c28b846176e72db6b8075cbcf63019cd987550e6ec059ed99281ed076ebe6dc3700da0733
SSDEEP

12288:NMrry90it1O757+HvUwen7falrfDYiQPpwLJl0YLddIXDZHFC55daXiR/lS0wapS:Oyzt1Ox+mnjalrfD7QBOJl0eatElSpj

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023bac-19.dat	healer
behavioral1/memory/4360-22-0x0000000000170000-0x000000000017A000-memory.dmp	healer
behavioral1/memory/1484-29-0x0000000004930000-0x000000000494A000-memory.dmp	healer
behavioral1/memory/1484-31-0x0000000004D70000-0x0000000004D88000-memory.dmp	healer
behavioral1/memory/1484-32-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-41-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-57-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-55-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-53-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-51-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-50-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-47-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-45-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-43-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-39-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-37-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-59-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-35-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer
behavioral1/memory/1484-33-0x0000000004D70000-0x0000000004D82000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b8251Mw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b8251Mw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c74dG89.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c74dG89.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c74dG89.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c74dG89.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c74dG89.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b8251Mw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b8251Mw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b8251Mw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b8251Mw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c74dG89.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4600-67-0x0000000004B10000-0x0000000004B56000-memory.dmp	family_redline
behavioral1/memory/4600-68-0x0000000007730000-0x0000000007774000-memory.dmp	family_redline
behavioral1/memory/4600-98-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-102-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-100-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-96-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-94-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-92-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-90-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-88-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-86-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-82-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-80-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-78-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-76-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-74-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-70-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-69-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-84-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/4600-72-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
2764	tice7918.exe
1848	tice9716.exe
4360	b8251Mw.exe
1484	c74dG89.exe
4600	dhuii03.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b8251Mw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c74dG89.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c74dG89.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice7918.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice9716.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
688	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3292	1484	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c74dG89.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dhuii03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice7918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice9716.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4360	b8251Mw.exe
4360	b8251Mw.exe
1484	c74dG89.exe
1484	c74dG89.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	b8251Mw.exe
Token: SeDebugPrivilege	1484	c74dG89.exe
Token: SeDebugPrivilege	4600	dhuii03.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2764	3544	57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f.exe	86
PID 3544 wrote to memory of 2764	3544	57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f.exe	86
PID 3544 wrote to memory of 2764	3544	57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f.exe	86
PID 2764 wrote to memory of 1848	2764	tice7918.exe	88
PID 2764 wrote to memory of 1848	2764	tice7918.exe	88
PID 2764 wrote to memory of 1848	2764	tice7918.exe	88
PID 1848 wrote to memory of 4360	1848	tice9716.exe	89
PID 1848 wrote to memory of 4360	1848	tice9716.exe	89
PID 1848 wrote to memory of 1484	1848	tice9716.exe	98
PID 1848 wrote to memory of 1484	1848	tice9716.exe	98
PID 1848 wrote to memory of 1484	1848	tice9716.exe	98
PID 2764 wrote to memory of 4600	2764	tice7918.exe	103
PID 2764 wrote to memory of 4600	2764	tice7918.exe	103
PID 2764 wrote to memory of 4600	2764	tice7918.exe	103

C:\Users\Admin\AppData\Local\Temp\57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f.exe
"C:\Users\Admin\AppData\Local\Temp\57a6076217008f4b1eafbca6dd2187906745b585978d2bb34b5ac2eada56be6f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7918.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7918.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice9716.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice9716.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8251Mw.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8251Mw.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c74dG89.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c74dG89.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1080
        5⤵
        Program crash
        
        PID:3292
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dhuii03.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dhuii03.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1484 -ip 1484
1⤵
PID:4340

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7918.exe

Filesize
749KB

MD5
82ea164fcf82c0aa163db8b2f2989ad8

SHA1
9df39fc466ac4eaf50af7c2594ed503fc267ce56

SHA256
e249c8d7cb1e070a4a52ae8d5178175140bb283b5ee9f97eebc63adcba46cdeb

SHA512
f41e89eb0576e9e843fbe34c72ae3f2107ce6adbbdbc81d496c9b7f7a86b363502d87d2d7acc8c2b09b6ace758281b8a21f0d5a273e27e614c9a4075fb9c8780

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dhuii03.exe

Filesize
446KB

MD5
efc23b3f593bf524e25b1e7c94692e8b

SHA1
96426478e387615ded6ced2120fbd6e449b6d4c1

SHA256
1b32fd882ed22d136a16bb78347d7b13bc7812d710ed60f4c907ef954f5a3458

SHA512
73f016c7813cbbb6bfa61a5d36d8f1ba811d0cce2fbeb67dcec153c7e151c3e20b325c57faaead1efbf1de594730e25357c484608c9a30ed5230de7378c9c23d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice9716.exe

Filesize
374KB

MD5
5ef0110e934a9c6e3a2095b1e1693eaa

SHA1
453fc807f6e3a06838b10885c3932697646c06ab

SHA256
28d46c615196415959da30d841b4977c9bb0782e54e1a49bf3eee2a23ca5baf2

SHA512
5e70549cb8d16e8b6e845bcefcb2feb59af023d818e31f08d9f39b69cf3207be534e48cb111936898440289848003e7c0728ad5dfbd5f8964f541af453b38ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8251Mw.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c74dG89.exe

Filesize
388KB

MD5
23080a7dd6d40e38cef5416d0a4d35a9

SHA1
3cbb075d39f23a87d3c88a3c9e03b07672fa6357

SHA256
17c87d1645e10b90a2b22d24eb5315cdec585740279c99b94945f184deb5b2d4

SHA512
4f36889393efb43ae47e4e967246e33545aaf4f0065f359a6b725afb64117d9f3dff60908bb68bef1825960298eae88b999c4db665e3cba4ab69c8d378829093

Download Submit
memory/1484-60-0x0000000000400000-0x0000000002B27000-memory.dmp

Filesize
39.2MB

Download
memory/1484-51-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-29-0x0000000004930000-0x000000000494A000-memory.dmp

Filesize
104KB

Download
memory/1484-30-0x0000000007350000-0x00000000078F4000-memory.dmp

Filesize
5.6MB

Download
memory/1484-31-0x0000000004D70000-0x0000000004D88000-memory.dmp

Filesize
96KB

Download
memory/1484-32-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-41-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-57-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-55-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-53-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-62-0x0000000000400000-0x0000000002B27000-memory.dmp

Filesize
39.2MB

Download
memory/1484-50-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-47-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-45-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-43-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-39-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-37-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-59-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-35-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1484-33-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/4360-22-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/4360-21-0x00007FFF2A923000-0x00007FFF2A925000-memory.dmp

Filesize
8KB

Download
memory/4360-23-0x00007FFF2A923000-0x00007FFF2A925000-memory.dmp

Filesize
8KB

Download
memory/4600-74-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-78-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-98-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-102-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-100-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-96-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-94-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-92-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-90-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-88-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-67-0x0000000004B10000-0x0000000004B56000-memory.dmp

Filesize
280KB

Download
memory/4600-80-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-86-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-68-0x0000000007730000-0x0000000007774000-memory.dmp

Filesize
272KB

Download
memory/4600-76-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-82-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-70-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-69-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-84-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-72-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/4600-975-0x0000000007770000-0x0000000007D88000-memory.dmp

Filesize
6.1MB

Download
memory/4600-976-0x0000000007E10000-0x0000000007F1A000-memory.dmp

Filesize
1.0MB

Download
memory/4600-977-0x0000000007F50000-0x0000000007F62000-memory.dmp

Filesize
72KB

Download
memory/4600-978-0x0000000007F70000-0x0000000007FAC000-memory.dmp

Filesize
240KB

Download
memory/4600-979-0x00000000080C0000-0x000000000810C000-memory.dmp

Filesize
304KB

Download