healer | 471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exe
Size

810KB
MD5

055f3d07ebc9b0b686c68095e37524b6
SHA1

a62f77768d7d202e19a30dbd736098f0d3477937
SHA256

471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02
SHA512

576f312d578f78ad0aabf01d195bc8361771a5bd06df93762f5b4de3ad1dcc2cf4162ecbfc8c19657ec4b23ffae286022884b98410acd426fdb723bdf13df9cd
SSDEEP

12288:uMryy90bcFl/p7bYLA0Qi6OVw8xlw3SYyWLljsS4xpwIxCAc/8c0D1b:QygcFl/INwEy4WLdb4dxC7Od

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000a000000023bca-19.dat	healer
behavioral1/memory/1504-22-0x0000000000010000-0x000000000001A000-memory.dmp	healer
behavioral1/memory/4860-29-0x00000000021D0000-0x00000000021EA000-memory.dmp	healer
behavioral1/memory/4860-31-0x0000000005160000-0x0000000005178000-memory.dmp	healer
behavioral1/memory/4860-32-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-43-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-59-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-57-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-55-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-53-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-51-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-49-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-47-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-45-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-41-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-39-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-37-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-35-0x0000000005160000-0x0000000005172000-memory.dmp	healer
behavioral1/memory/4860-33-0x0000000005160000-0x0000000005172000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

b8850oL.exec74or45.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b8850oL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c74or45.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c74or45.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b8850oL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b8850oL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b8850oL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c74or45.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c74or45.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c74or45.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c74or45.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b8850oL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b8850oL.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4012-67-0x00000000024C0000-0x0000000002506000-memory.dmp	family_redline
behavioral1/memory/4012-68-0x0000000002690000-0x00000000026D4000-memory.dmp	family_redline
behavioral1/memory/4012-72-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-70-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-69-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-86-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-102-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-100-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-98-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-94-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-92-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-91-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-88-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-84-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-82-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-80-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-78-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-76-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-74-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline
behavioral1/memory/4012-96-0x0000000002690000-0x00000000026CE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

Processes:

nice8461.exenice8073.exeb8850oL.exec74or45.exedTfSR96.exe

pid	Process
812	nice8461.exe
1116	nice8073.exe
1504	b8850oL.exe
4860	c74or45.exe
4012	dTfSR96.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

c74or45.exeb8850oL.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c74or45.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b8850oL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c74or45.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exenice8461.exenice8073.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nice8461.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nice8073.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2944	4860	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

nice8073.exec74or45.exedTfSR96.exe471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exenice8461.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nice8073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c74or45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dTfSR96.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nice8461.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b8850oL.exec74or45.exe

pid	Process
1504	b8850oL.exe
1504	b8850oL.exe
4860	c74or45.exe
4860	c74or45.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b8850oL.exec74or45.exedTfSR96.exe

description	pid	Process
Token: SeDebugPrivilege	1504	b8850oL.exe
Token: SeDebugPrivilege	4860	c74or45.exe
Token: SeDebugPrivilege	4012	dTfSR96.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exenice8461.exenice8073.exe

description	pid	Process	procid_target
PID 2996 wrote to memory of 812	2996	471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exe	83
PID 2996 wrote to memory of 812	2996	471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exe	83
PID 2996 wrote to memory of 812	2996	471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exe	83
PID 812 wrote to memory of 1116	812	nice8461.exe	84
PID 812 wrote to memory of 1116	812	nice8461.exe	84
PID 812 wrote to memory of 1116	812	nice8461.exe	84
PID 1116 wrote to memory of 1504	1116	nice8073.exe	86
PID 1116 wrote to memory of 1504	1116	nice8073.exe	86
PID 1116 wrote to memory of 4860	1116	nice8073.exe	95
PID 1116 wrote to memory of 4860	1116	nice8073.exe	95
PID 1116 wrote to memory of 4860	1116	nice8073.exe	95
PID 812 wrote to memory of 4012	812	nice8461.exe	102
PID 812 wrote to memory of 4012	812	nice8461.exe	102
PID 812 wrote to memory of 4012	812	nice8461.exe	102

C:\Users\Admin\AppData\Local\Temp\471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exe
"C:\Users\Admin\AppData\Local\Temp\471cca33817f582b6d623c65a40c29c350fc22a7ba5cdfd2dfc081f1f2340e02.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice8461.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice8461.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice8073.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice8073.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8850oL.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8850oL.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c74or45.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c74or45.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 1084
        5⤵
        Program crash
        
        PID:2944
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTfSR96.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTfSR96.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4860 -ip 4860
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice8461.exe

Filesize
665KB

MD5
383d4b6c38cf17847c4956e1bac335b5

SHA1
3957bdfc90cc06b5b2ec28ebecafdf70f51742b7

SHA256
6e7472a79343c4eb842fcb6b5923b412340228e6d056ee959ce71ede7b00289f

SHA512
5b758b6817b493a86f6fadca9b8a6bdbe04895aa1a15b6bf2bdd6f0c17d5b3a389d4120cc131a479e092ffb1717bd258d5d41ff7d9e91f2f549620ceb29e13e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTfSR96.exe

Filesize
306KB

MD5
434b037af289fae120e4fb8480bfb42c

SHA1
76b729fcbe9d883bbee17e5ca8d76fc04aee3d8f

SHA256
0708f7d381d1a639b56219192bcff33a6177624b7be16103e59e55a6d7a8f99d

SHA512
5433a867fb18dd38402f44336de57365edcb8d0b848e350c1a6c5fc39af6f9364caee612bce8120f1f1af1c45a0d28a23dcbff5006679a2f7964007a46569668

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice8073.exe

Filesize
332KB

MD5
35f36ec71acb47399513337a7d410c4f

SHA1
cf9b14f724a0d0ee7cea9a7dadb152f2450309d4

SHA256
8937ce17078b32599eb1b8280af12ce458834e8a36e850c03715d4297a0d17ce

SHA512
bc7a42ae26a0a39b6faeaa8112c97e5b8963c5679abddb75693996635e2a5fa70c9e057c8bdf10e10861a0a6d27993c2d69e76e2e053e0d287e5d1663066d3e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8850oL.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c74or45.exe

Filesize
249KB

MD5
73e75c38ae4a49b8db75437acf5ffcc1

SHA1
1e01eab64dc1326cb3ef96fad41f58abd44db2cf

SHA256
7ba7de1832ba129a983bf0551faef469522249e9c7dac96cc131c17503bb5bc6

SHA512
f664b8fda82ddfff920635ca1235c0a34f00a27bfca7fcd80eb63ceb3712e04ab1ec2ecb378d8164c1f9b7016bca7d29ea447260d05c99ad909af99b2453b346

Download Submit
memory/1504-22-0x0000000000010000-0x000000000001A000-memory.dmp

Filesize
40KB

Download
memory/1504-21-0x00007FFCD8923000-0x00007FFCD8925000-memory.dmp

Filesize
8KB

Download
memory/1504-23-0x00007FFCD8923000-0x00007FFCD8925000-memory.dmp

Filesize
8KB

Download
memory/4012-78-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-91-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-976-0x00000000057A0000-0x00000000058AA000-memory.dmp

Filesize
1.0MB

Download
memory/4012-975-0x0000000005160000-0x0000000005778000-memory.dmp

Filesize
6.1MB

Download
memory/4012-96-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-978-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/4012-74-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-76-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-86-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-80-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-82-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-84-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-88-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-977-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/4012-92-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-94-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-98-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-100-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-102-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-979-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Filesize
304KB

Download
memory/4012-67-0x00000000024C0000-0x0000000002506000-memory.dmp

Filesize
280KB

Download
memory/4012-68-0x0000000002690000-0x00000000026D4000-memory.dmp

Filesize
272KB

Download
memory/4012-72-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-70-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4012-69-0x0000000002690000-0x00000000026CE000-memory.dmp

Filesize
248KB

Download
memory/4860-57-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-62-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4860-60-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4860-33-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-35-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-37-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-39-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-41-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-45-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-47-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-49-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-51-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-53-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-55-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-59-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-43-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-32-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4860-31-0x0000000005160000-0x0000000005178000-memory.dmp

Filesize
96KB

Download
memory/4860-30-0x0000000004BB0000-0x0000000005154000-memory.dmp

Filesize
5.6MB

Download
memory/4860-29-0x00000000021D0000-0x00000000021EA000-memory.dmp

Filesize
104KB

Download