healer | 30e887ebf60cfb351ea517b17d1e9e795f1b2c2380709984f72aa2b16d11ea41

Analysis

max time kernel
112s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exe
Size

864KB
MD5

6bf901024163b65a8c5b43b56ffe8abf
SHA1

e7b8e4351bfd55cb06bb86171614c296b64ec9d1
SHA256

30e887ebf60cfb351ea517b17d1e9e795f1b2c2380709984f72aa2b16d11ea41
SHA512

76ca5b1ed69dd0e0a02e0604924a56f4f8a631084c2a17e0f9cd5b5f913a0d757aac5db168e418f5721b0148b56517dc84bcd875879457c77fc3d72b6cedd930
SSDEEP

24576:Hy4lQi3Bz7aCCc+cH26j/LNdcf5ysOLoUSy86:SM13Bz7aCn+cHr/LN6nUSyZ

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000b000000023b46-19.dat	healer
behavioral1/memory/680-22-0x0000000000B50000-0x0000000000B5A000-memory.dmp	healer
behavioral1/memory/3208-29-0x00000000049C0000-0x00000000049DA000-memory.dmp	healer
behavioral1/memory/3208-31-0x0000000004C80000-0x0000000004C98000-memory.dmp	healer
behavioral1/memory/3208-39-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-32-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-49-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-59-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-57-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-55-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-53-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-51-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-47-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-45-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-43-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-41-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-37-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-35-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer
behavioral1/memory/3208-33-0x0000000004C80000-0x0000000004C92000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

c61XP12.exeb5597cY.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c61XP12.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c61XP12.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c61XP12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b5597cY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b5597cY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b5597cY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b5597cY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c61XP12.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c61XP12.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b5597cY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b5597cY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c61XP12.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4972-67-0x00000000049E0000-0x0000000004A26000-memory.dmp	family_redline
behavioral1/memory/4972-68-0x0000000007130000-0x0000000007174000-memory.dmp	family_redline
behavioral1/memory/4972-98-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-102-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-100-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-96-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-94-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-92-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-90-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-88-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-86-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-84-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-82-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-80-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-78-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-76-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-74-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-72-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-70-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4972-69-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

Processes:

tice2022.exetice1827.exeb5597cY.exec61XP12.exedUFfi49.exe

pid	Process
3568	tice2022.exe
968	tice1827.exe
680	b5597cY.exe
3208	c61XP12.exe
4972	dUFfi49.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

b5597cY.exec61XP12.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b5597cY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c61XP12.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c61XP12.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exetice2022.exetice1827.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice2022.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice1827.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2248	3208	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

dUFfi49.exeaed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exetice2022.exetice1827.exec61XP12.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dUFfi49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice2022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice1827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c61XP12.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b5597cY.exec61XP12.exe

pid	Process
680	b5597cY.exe
680	b5597cY.exe
3208	c61XP12.exe
3208	c61XP12.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b5597cY.exec61XP12.exedUFfi49.exe

description	pid	Process
Token: SeDebugPrivilege	680	b5597cY.exe
Token: SeDebugPrivilege	3208	c61XP12.exe
Token: SeDebugPrivilege	4972	dUFfi49.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exetice2022.exetice1827.exe

description	pid	Process	procid_target
PID 1652 wrote to memory of 3568	1652	aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exe	84
PID 1652 wrote to memory of 3568	1652	aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exe	84
PID 1652 wrote to memory of 3568	1652	aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exe	84
PID 3568 wrote to memory of 968	3568	tice2022.exe	85
PID 3568 wrote to memory of 968	3568	tice2022.exe	85
PID 3568 wrote to memory of 968	3568	tice2022.exe	85
PID 968 wrote to memory of 680	968	tice1827.exe	87
PID 968 wrote to memory of 680	968	tice1827.exe	87
PID 968 wrote to memory of 3208	968	tice1827.exe	95
PID 968 wrote to memory of 3208	968	tice1827.exe	95
PID 968 wrote to memory of 3208	968	tice1827.exe	95
PID 3568 wrote to memory of 4972	3568	tice2022.exe	100
PID 3568 wrote to memory of 4972	3568	tice2022.exe	100
PID 3568 wrote to memory of 4972	3568	tice2022.exe	100

C:\Users\Admin\AppData\Local\Temp\aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exe
"C:\Users\Admin\AppData\Local\Temp\aed1ebd6b3c41a53769ea5b26ad0035f2393cbba5d5dbedbd747a87a037427d9N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2022.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2022.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice1827.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice1827.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5597cY.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5597cY.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:680
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c61XP12.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c61XP12.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 1092
        5⤵
        Program crash
        
        PID:2248
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUFfi49.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUFfi49.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3208 -ip 3208
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2022.exe

Filesize
719KB

MD5
74d476112745e1797cf30efae04e2a16

SHA1
7fabf4d1240e53c2cfa825bcbdf150f74ead7711

SHA256
2f08f119eb81896e3aa4033d0e48d560c3fbc8892d994bcedaeee0db0bd5303e

SHA512
2be15eaf582a22b8d8821f06a292685d911e90b56db0551136ce8bcea65fa564757715da15fc8ea80980ec4d22cf5961b4838ec933e96c653c75a74a410b89aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUFfi49.exe

Filesize
399KB

MD5
1dd719b52bd06f50fa50509c827ecc63

SHA1
c760629cc72bc4bc3d104e683dc550138fd2a4a1

SHA256
14b2424039a7e459023539f5e578d85dc9ca5528ff296218ba1bf1c4af65a9a1

SHA512
ed8d15ce7289b472b436525a31eda6af732bd55ad32d99c04d1291db8846f643664d8846da85dc40283927f4c395e298a35432e053e42fc4ecea98ce8dc7cdcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice1827.exe

Filesize
360KB

MD5
ba962d3465e92392c823556365d46cd4

SHA1
12adefb8c5449f0876aefb58967fb83b64a94f32

SHA256
3ff1f446b9caf9cc21dc2928bd6f80956758a9ce4888051a466d936cdd3a9899

SHA512
53e4ead35f3b2c137a38941abca4a545f34e2ce739ca85a98fe69d54c81d2568e8d388a92e29165917e13f850e700511e0c0b85e40cfc3db9cc088a0cfcc7c17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5597cY.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c61XP12.exe

Filesize
342KB

MD5
dea68fe6b5195d8f4ab13f6b808cf13f

SHA1
818b5e014af9a0f1f9aec83e58db4701acea046b

SHA256
e5d3b6f1cca1b03eb249974b1132ed311263e95e175f3085f09e4fdb5fa8af22

SHA512
b9e49c88624e215e9d5e6be36145efd4e1152947fc280c9978960c1f26abf74634014984893807199557fb158b3c9195ce3d8196ba0457b608cf755ff172522c

Download Submit
memory/680-21-0x00007FFD8E383000-0x00007FFD8E385000-memory.dmp

Filesize
8KB

Download
memory/680-22-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/680-23-0x00007FFD8E383000-0x00007FFD8E385000-memory.dmp

Filesize
8KB

Download
memory/3208-60-0x0000000000400000-0x0000000002B1A000-memory.dmp

Filesize
39.1MB

Download
memory/3208-31-0x0000000004C80000-0x0000000004C98000-memory.dmp

Filesize
96KB

Download
memory/3208-39-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-32-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-49-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-59-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-57-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-55-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-53-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-51-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-47-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-45-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-43-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-41-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-37-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-35-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-33-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3208-30-0x0000000007130000-0x00000000076D4000-memory.dmp

Filesize
5.6MB

Download
memory/3208-29-0x00000000049C0000-0x00000000049DA000-memory.dmp

Filesize
104KB

Download
memory/3208-62-0x0000000000400000-0x0000000002B1A000-memory.dmp

Filesize
39.1MB

Download
memory/4972-102-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-80-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-98-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-67-0x00000000049E0000-0x0000000004A26000-memory.dmp

Filesize
280KB

Download
memory/4972-100-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-96-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-94-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-92-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-90-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-88-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-86-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-84-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-82-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-68-0x0000000007130000-0x0000000007174000-memory.dmp

Filesize
272KB

Download
memory/4972-78-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-76-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-74-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-72-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-70-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-69-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4972-975-0x00000000078A0000-0x0000000007EB8000-memory.dmp

Filesize
6.1MB

Download
memory/4972-976-0x0000000007EC0000-0x0000000007FCA000-memory.dmp

Filesize
1.0MB

Download
memory/4972-977-0x0000000007250000-0x0000000007262000-memory.dmp

Filesize
72KB

Download
memory/4972-978-0x0000000007270000-0x00000000072AC000-memory.dmp

Filesize
240KB

Download
memory/4972-979-0x00000000080D0000-0x000000000811C000-memory.dmp

Filesize
304KB

Download