healer | 71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exe
Size

894KB
MD5

278050dcb822319757b6b28f095ad40b
SHA1

566468b46b8aa98679126a914ff81ddf19422f94
SHA256

71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34
SHA512

9f89459ed68cbb9a5639081760a06e03b17bd1012628fd2d8c4c25267cfdbc95ab8e15c133d215d338711c14381d802021f7d1b3fb83c84eae5647067ad30f1e
SSDEEP

12288:EMrcy90z9c75HmMAgbu7INcogmtfe/Q4E9fEvNC2IV4Wr+Tps1xdOIXDZHFCp5de:oy3lHHAMXjiQlf+N1IGatjq/EBua

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0008000000023cac-20.dat	healer
behavioral1/memory/5044-22-0x0000000000B40000-0x0000000000B4A000-memory.dmp	healer
behavioral1/memory/4700-29-0x0000000004A60000-0x0000000004A7A000-memory.dmp	healer
behavioral1/memory/4700-31-0x0000000004C10000-0x0000000004C28000-memory.dmp	healer
behavioral1/memory/4700-32-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-41-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-59-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-57-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-55-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-53-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-51-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-49-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-47-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-45-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-43-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-39-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-37-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-35-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer
behavioral1/memory/4700-33-0x0000000004C10000-0x0000000004C22000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

c32lX11.exeb5282AA.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c32lX11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c32lX11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b5282AA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b5282AA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c32lX11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b5282AA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c32lX11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c32lX11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c32lX11.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b5282AA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b5282AA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b5282AA.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1928-67-0x0000000004B30000-0x0000000004B76000-memory.dmp	family_redline
behavioral1/memory/1928-68-0x0000000007710000-0x0000000007754000-memory.dmp	family_redline
behavioral1/memory/1928-70-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-74-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-103-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-100-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-98-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-96-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-94-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-92-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-88-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-86-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-84-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-82-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-80-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-78-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-76-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-72-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-90-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline
behavioral1/memory/1928-69-0x0000000007710000-0x000000000774E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

Processes:

tice3965.exetice5173.exeb5282AA.exec32lX11.exedgeif86.exe

pid	Process
968	tice3965.exe
4396	tice5173.exe
5044	b5282AA.exe
4700	c32lX11.exe
1928	dgeif86.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

b5282AA.exec32lX11.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b5282AA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c32lX11.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c32lX11.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exetice3965.exetice5173.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice3965.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice5173.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4836	4700	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c32lX11.exedgeif86.exe71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exetice3965.exetice5173.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c32lX11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dgeif86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice3965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice5173.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b5282AA.exec32lX11.exe

pid	Process
5044	b5282AA.exe
5044	b5282AA.exe
4700	c32lX11.exe
4700	c32lX11.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b5282AA.exec32lX11.exedgeif86.exe

description	pid	Process
Token: SeDebugPrivilege	5044	b5282AA.exe
Token: SeDebugPrivilege	4700	c32lX11.exe
Token: SeDebugPrivilege	1928	dgeif86.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exetice3965.exetice5173.exe

description	pid	Process	procid_target
PID 636 wrote to memory of 968	636	71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exe	83
PID 636 wrote to memory of 968	636	71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exe	83
PID 636 wrote to memory of 968	636	71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exe	83
PID 968 wrote to memory of 4396	968	tice3965.exe	84
PID 968 wrote to memory of 4396	968	tice3965.exe	84
PID 968 wrote to memory of 4396	968	tice3965.exe	84
PID 4396 wrote to memory of 5044	4396	tice5173.exe	85
PID 4396 wrote to memory of 5044	4396	tice5173.exe	85
PID 4396 wrote to memory of 4700	4396	tice5173.exe	93
PID 4396 wrote to memory of 4700	4396	tice5173.exe	93
PID 4396 wrote to memory of 4700	4396	tice5173.exe	93
PID 968 wrote to memory of 1928	968	tice3965.exe	97
PID 968 wrote to memory of 1928	968	tice3965.exe	97
PID 968 wrote to memory of 1928	968	tice3965.exe	97

C:\Users\Admin\AppData\Local\Temp\71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exe
"C:\Users\Admin\AppData\Local\Temp\71866d2660d7424262478e7b7d3002a2b918356052fee01e2f3257a8e11bab34.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3965.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3965.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5173.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5173.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5282AA.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5282AA.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c32lX11.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c32lX11.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 1080
        5⤵
        Program crash
        
        PID:4836
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dgeif86.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dgeif86.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4700 -ip 4700
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3965.exe

Filesize
749KB

MD5
0b1f2ea699680c8fcca5cfdea785663a

SHA1
7c5c5ad1f211867aec76cfb37f8c891bfa6ef164

SHA256
7d79a4ab70866edef574292143e0c2b4420f8f2fa36f6cdf56fbcf48d0c394df

SHA512
b09afacbef30b4dd2bed1f64d4c0252aae6b7aaed794f23c3d395e750e0a34bb93d0c008cd3b521e175b72c8d6450f18661efa2bbab0c93285e186840bf4ac56

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dgeif86.exe

Filesize
446KB

MD5
4ed93522b9e8cd25d7a61b0c691fabca

SHA1
62ffdb45dcfdce32e1c3b83b39e894efaaa5b9dd

SHA256
a4ad76aeb1f433581b91ebfb9ef597a45b52af405f36f5a6fd9b0ecfd8cfdd67

SHA512
8f0eefd41af4b4116a8b623ca68d46e6f47e59ebdc3ce93898074c7e3d0dad5485119c9b3cb491b12d4315a377f4df7dbb92459cfaf61d11867781e924da5f0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5173.exe

Filesize
374KB

MD5
9cefd2b6a821d4abd0d9f28f7a1de9d4

SHA1
44d9bc99f6fd876e3b9823a1c7ae0ef2cbe79508

SHA256
99399a006c66f0ea6410eaa63803bdd8aa41c8e97a0795a373b6729731c95f94

SHA512
e44da99589af88abcf8796ef98fa710fc91dbf33a6099c7be02b49a4c5636f8d2b179a06b6c98ab48142dafc140c9a998a8f2cf15d8a87644f426bfffeaaf71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5282AA.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c32lX11.exe

Filesize
388KB

MD5
9f3b419b7659bad5926350cdf841311f

SHA1
c13585b301459e1badca58792f8df317c503cc6b

SHA256
a450a52d2b9c4ede611859b341390808eb866671ab6b804ddd52e86186f177cb

SHA512
515f967542990d1a7bdcbba7ee0c03e187c2f50edc33533b2e45b7755229b647116a7549c8dce8ff486062a3a076ca07d318aaf97481804e24e86f7fc938a1ec

Download Submit
memory/1928-84-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-82-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-979-0x00000000080C0000-0x000000000810C000-memory.dmp

Filesize
304KB

Download
memory/1928-67-0x0000000004B30000-0x0000000004B76000-memory.dmp

Filesize
280KB

Download
memory/1928-977-0x0000000007F50000-0x0000000007F62000-memory.dmp

Filesize
72KB

Download
memory/1928-976-0x0000000007E10000-0x0000000007F1A000-memory.dmp

Filesize
1.0MB

Download
memory/1928-975-0x0000000007770000-0x0000000007D88000-memory.dmp

Filesize
6.1MB

Download
memory/1928-68-0x0000000007710000-0x0000000007754000-memory.dmp

Filesize
272KB

Download
memory/1928-90-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-72-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-76-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-78-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-80-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-74-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-86-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-88-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-92-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-94-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-96-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-98-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-70-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-103-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-978-0x0000000007F70000-0x0000000007FAC000-memory.dmp

Filesize
240KB

Download
memory/1928-69-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/1928-100-0x0000000007710000-0x000000000774E000-memory.dmp

Filesize
248KB

Download
memory/4700-49-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-59-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-61-0x0000000000400000-0x0000000002B27000-memory.dmp

Filesize
39.2MB

Download
memory/4700-33-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-35-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-37-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-39-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-43-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-45-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-29-0x0000000004A60000-0x0000000004A7A000-memory.dmp

Filesize
104KB

Download
memory/4700-47-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-30-0x0000000007420000-0x00000000079C4000-memory.dmp

Filesize
5.6MB

Download
memory/4700-51-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-53-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-55-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-57-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-31-0x0000000004C10000-0x0000000004C28000-memory.dmp

Filesize
96KB

Download
memory/4700-41-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/4700-32-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/5044-22-0x0000000000B40000-0x0000000000B4A000-memory.dmp

Filesize
40KB

Download
memory/5044-23-0x00007FFC0CDF3000-0x00007FFC0CDF5000-memory.dmp

Filesize
8KB

Download
memory/5044-21-0x00007FFC0CDF3000-0x00007FFC0CDF5000-memory.dmp

Filesize
8KB

Download