healer | 4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exe
Size

864KB
MD5

cca4c95a71818e91dc9e3dbe94220a6a
SHA1

eccbe7f31c4af4c1aa7dbdb419f1d7cf3fab4ee3
SHA256

4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d
SHA512

f03e921ca3c66f2daf0d909b19a65d7ca665eeb910f288462fc0912e7364dce208a2433b41198ecc257e89343dcf3f274f6a49ea1d7431f3ff9cc001fbdec76e
SSDEEP

24576:uyNwtm4d6baZWmtQQl+4CxOASNnM950o/5TX:9NwtybP9QI4CU3NMvN

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000b000000023b7b-19.dat	healer
behavioral1/memory/3964-22-0x0000000000860000-0x000000000086A000-memory.dmp	healer
behavioral1/memory/3892-29-0x00000000048D0000-0x00000000048EA000-memory.dmp	healer
behavioral1/memory/3892-31-0x0000000004A30000-0x0000000004A48000-memory.dmp	healer
behavioral1/memory/3892-33-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-59-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-57-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-55-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-53-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-51-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-49-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-47-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-45-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-43-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-41-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-39-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-37-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-35-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/3892-32-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

b1002Hw.exec69gL54.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b1002Hw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c69gL54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c69gL54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c69gL54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b1002Hw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b1002Hw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b1002Hw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b1002Hw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c69gL54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c69gL54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c69gL54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b1002Hw.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2164-67-0x0000000004BF0000-0x0000000004C36000-memory.dmp	family_redline
behavioral1/memory/2164-68-0x0000000007730000-0x0000000007774000-memory.dmp	family_redline
behavioral1/memory/2164-70-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-98-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-102-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-97-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-94-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-93-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-90-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-89-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-86-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-84-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-83-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-80-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-78-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-77-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-74-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-73-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-100-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline
behavioral1/memory/2164-69-0x0000000007730000-0x000000000776E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

Processes:

tice7812.exetice6066.exeb1002Hw.exec69gL54.exeduoFl54.exe

pid	Process
4140	tice7812.exe
932	tice6066.exe
3964	b1002Hw.exe
3892	c69gL54.exe
2164	duoFl54.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

c69gL54.exeb1002Hw.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c69gL54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b1002Hw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c69gL54.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exetice7812.exetice6066.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice7812.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice6066.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3880	3892	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exetice7812.exetice6066.exec69gL54.exeduoFl54.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice7812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice6066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c69gL54.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	duoFl54.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b1002Hw.exec69gL54.exe

pid	Process
3964	b1002Hw.exe
3964	b1002Hw.exe
3892	c69gL54.exe
3892	c69gL54.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b1002Hw.exec69gL54.exeduoFl54.exe

description	pid	Process
Token: SeDebugPrivilege	3964	b1002Hw.exe
Token: SeDebugPrivilege	3892	c69gL54.exe
Token: SeDebugPrivilege	2164	duoFl54.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exetice7812.exetice6066.exe

description	pid	Process	procid_target
PID 2584 wrote to memory of 4140	2584	4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exe	84
PID 2584 wrote to memory of 4140	2584	4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exe	84
PID 2584 wrote to memory of 4140	2584	4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exe	84
PID 4140 wrote to memory of 932	4140	tice7812.exe	86
PID 4140 wrote to memory of 932	4140	tice7812.exe	86
PID 4140 wrote to memory of 932	4140	tice7812.exe	86
PID 932 wrote to memory of 3964	932	tice6066.exe	87
PID 932 wrote to memory of 3964	932	tice6066.exe	87
PID 932 wrote to memory of 3892	932	tice6066.exe	94
PID 932 wrote to memory of 3892	932	tice6066.exe	94
PID 932 wrote to memory of 3892	932	tice6066.exe	94
PID 4140 wrote to memory of 2164	4140	tice7812.exe	98
PID 4140 wrote to memory of 2164	4140	tice7812.exe	98
PID 4140 wrote to memory of 2164	4140	tice7812.exe	98

C:\Users\Admin\AppData\Local\Temp\4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exe
"C:\Users\Admin\AppData\Local\Temp\4a09b6b29388dc994003e657854f11eaf978ebde7913d0290db8003d64543f2d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7812.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7812.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6066.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6066.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1002Hw.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1002Hw.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c69gL54.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c69gL54.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 1100
        5⤵
        Program crash
        
        PID:3880
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\duoFl54.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\duoFl54.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3892 -ip 3892
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice7812.exe

Filesize
719KB

MD5
035d835d612388108cd5e16d1312f18d

SHA1
757eb081a4d916697e7196679413830c3fc284a9

SHA256
e0ff4c6e28b30777ff93fcc8e923451e7fd0989e3d4a75c7bc1bd7ed4e44ded8

SHA512
02ad57d433605f42b05379b8d1d9d93a189cd15b43e710f6ae8824b6e2505886be0744ddd7dc16b66ae856882d1ecd0ccb7620f59431133e590aa8410cb654dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\duoFl54.exe

Filesize
399KB

MD5
6f747b5ab87617af4359bf12045b936c

SHA1
5ce1cc0f10685ef01782e9f82fa127965bcdcaa3

SHA256
64b1851306e8864eb285febf74c1fe6b307b9cbd25f5844ad737180a8520f3f3

SHA512
a83864ca3fd3dbaf2e13b3801bf9182da2692ab01b58831a43badd8ff99f36cb126e25c5c115fa935b0a6594db8373db6bb4993c6e610e3ff28df602c2fae5aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6066.exe

Filesize
360KB

MD5
cacafe62005892568adb575d974b9cc4

SHA1
4da8471a48d2268d961f49a2dbba3ab0723409d4

SHA256
6b44fcc24909154428eb7dadc0f3d0c1c0c341a2db17b5a6386ef64f3af3b51b

SHA512
a736b07399cd875e13e22f0cd470388abb041fa08fc8f87c5b93935e8b6f279429757ec8071938d25fc28fa2dbb8a6fb546f983e28ca7c20dc5737191fd2646d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1002Hw.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c69gL54.exe

Filesize
342KB

MD5
376ba7150b6466b6e42c71e9aee4ffc2

SHA1
9188e267ff36e60d768526ccbe7048ad9ec1f25a

SHA256
77906aa25ca2882be8638a9206966fff70898067ae288f3e73f3391bd2deb8dc

SHA512
22062614b57c11ac8eb046ac064dcee3dc63f25d6e3701621321a6ef498a6456200a1d1aa749aa7f3b26cf8481f7f5555990fb83d1cb24d3efedf76fc1db761a

Download Submit
memory/2164-77-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-84-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-976-0x0000000007E00000-0x0000000007F0A000-memory.dmp

Filesize
1.0MB

Download
memory/2164-975-0x0000000007770000-0x0000000007D88000-memory.dmp

Filesize
6.1MB

Download
memory/2164-69-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-100-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-73-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-74-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-978-0x0000000007F60000-0x0000000007F9C000-memory.dmp

Filesize
240KB

Download
memory/2164-70-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-78-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-80-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-83-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-977-0x0000000007F40000-0x0000000007F52000-memory.dmp

Filesize
72KB

Download
memory/2164-86-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-89-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-90-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-93-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-94-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-97-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-102-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-979-0x00000000080B0000-0x00000000080FC000-memory.dmp

Filesize
304KB

Download
memory/2164-98-0x0000000007730000-0x000000000776E000-memory.dmp

Filesize
248KB

Download
memory/2164-67-0x0000000004BF0000-0x0000000004C36000-memory.dmp

Filesize
280KB

Download
memory/2164-68-0x0000000007730000-0x0000000007774000-memory.dmp

Filesize
272KB

Download
memory/3892-55-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-62-0x0000000000400000-0x0000000002B1A000-memory.dmp

Filesize
39.1MB

Download
memory/3892-60-0x0000000000400000-0x0000000002B1A000-memory.dmp

Filesize
39.1MB

Download
memory/3892-32-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-35-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-37-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-39-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-41-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-43-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-45-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-47-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-49-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-51-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-53-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-57-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-59-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-33-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/3892-31-0x0000000004A30000-0x0000000004A48000-memory.dmp

Filesize
96KB

Download
memory/3892-30-0x00000000071E0000-0x0000000007784000-memory.dmp

Filesize
5.6MB

Download
memory/3892-29-0x00000000048D0000-0x00000000048EA000-memory.dmp

Filesize
104KB

Download
memory/3964-23-0x00007FFF47CF3000-0x00007FFF47CF5000-memory.dmp

Filesize
8KB

Download
memory/3964-22-0x0000000000860000-0x000000000086A000-memory.dmp

Filesize
40KB

Download
memory/3964-21-0x00007FFF47CF3000-0x00007FFF47CF5000-memory.dmp

Filesize
8KB

Download