healer | 463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4a

Analysis

max time kernel
112s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4aN.exe
Size

792KB
MD5

60500901355785435eb99973082ea8b0
SHA1

1f571289b8ad4af2b4706bd7165d64b4d5cc2b27
SHA256

463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4a
SHA512

18ac1af7f061f1554aeebd7ebd14219cc2f8d520f4917c94b9cffe42f88c07e2c51470ed02cc6028c77657bdec0c15bc2c1ebb3932ad26dd8574b036a0037893
SSDEEP

12288:IMr+y90pL3DDM96eoNz2tistirs8+Fi2PkzQLqoIkN0HcoMgilhOCE8:WyUmYqtistirX+FimHqoI4o8y8

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c9c-19.dat	healer
behavioral1/memory/860-22-0x0000000000140000-0x000000000014A000-memory.dmp	healer
behavioral1/memory/1588-29-0x00000000020C0000-0x00000000020DA000-memory.dmp	healer
behavioral1/memory/1588-31-0x0000000002310000-0x0000000002328000-memory.dmp	healer
behavioral1/memory/1588-47-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-57-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-55-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-53-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-51-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-49-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-46-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-43-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-41-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-39-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-59-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-37-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-35-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-33-0x0000000002310000-0x0000000002322000-memory.dmp	healer
behavioral1/memory/1588-32-0x0000000002310000-0x0000000002322000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b3057Kn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c05ZU67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c05ZU67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b3057Kn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b3057Kn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b3057Kn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b3057Kn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c05ZU67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b3057Kn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c05ZU67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c05ZU67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c05ZU67.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/3928-67-0x00000000022E0000-0x0000000002326000-memory.dmp	family_redline
behavioral1/memory/3928-68-0x0000000004AC0000-0x0000000004B04000-memory.dmp	family_redline
behavioral1/memory/3928-88-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-90-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-102-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-100-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-98-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-96-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-94-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-92-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-86-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-84-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-82-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-80-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-76-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-74-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-78-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-72-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-70-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/3928-69-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
2848	tice5171.exe
632	tice2935.exe
860	b3057Kn.exe
1588	c05ZU67.exe
3928	dyMup59.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c05ZU67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b3057Kn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c05ZU67.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice5171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice2935.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3772	1588	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice5171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice2935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c05ZU67.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyMup59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4aN.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
860	b3057Kn.exe
860	b3057Kn.exe
1588	c05ZU67.exe
1588	c05ZU67.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	b3057Kn.exe
Token: SeDebugPrivilege	1588	c05ZU67.exe
Token: SeDebugPrivilege	3928	dyMup59.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2848	3352	463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4aN.exe	86
PID 3352 wrote to memory of 2848	3352	463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4aN.exe	86
PID 3352 wrote to memory of 2848	3352	463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4aN.exe	86
PID 2848 wrote to memory of 632	2848	tice5171.exe	87
PID 2848 wrote to memory of 632	2848	tice5171.exe	87
PID 2848 wrote to memory of 632	2848	tice5171.exe	87
PID 632 wrote to memory of 860	632	tice2935.exe	88
PID 632 wrote to memory of 860	632	tice2935.exe	88
PID 632 wrote to memory of 1588	632	tice2935.exe	98
PID 632 wrote to memory of 1588	632	tice2935.exe	98
PID 632 wrote to memory of 1588	632	tice2935.exe	98
PID 2848 wrote to memory of 3928	2848	tice5171.exe	103
PID 2848 wrote to memory of 3928	2848	tice5171.exe	103
PID 2848 wrote to memory of 3928	2848	tice5171.exe	103

C:\Users\Admin\AppData\Local\Temp\463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4aN.exe
"C:\Users\Admin\AppData\Local\Temp\463ec840b43da3ed96e55130a3880fd317cf77e86294c8ababf24ba0f84a5f4aN.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice5171.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice5171.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2935.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2935.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3057Kn.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3057Kn.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:860
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c05ZU67.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c05ZU67.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 1084
        5⤵
        Program crash
        
        PID:3772
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dyMup59.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dyMup59.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1588 -ip 1588
1⤵
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice5171.exe

Filesize
647KB

MD5
0b82949d57bc006bdbc4d03b1d578ae7

SHA1
be6874c2f1a8b20677b14205bc4ad3bb0d829388

SHA256
05cc386da6978f978e03f01dd5ebb10b4bded162b6b3c05733c09fec7fe3fc96

SHA512
1a591297797ebf510800aee82df3dac6d4649fca66a787feb333a980ca4b07564552f5acb90683813c14ca86aa847e53965c4256e093aabdf4133bd32579ad04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dyMup59.exe

Filesize
283KB

MD5
b6bbd7abe0daa44859cf3d05af7499e4

SHA1
a6291522ddeb49f74bb503d63f2ae5307249fc85

SHA256
6ac3ea7131cf37429764ce36587fc8d774aefce83b37577256e4f1f7132a414e

SHA512
582232e8b6895baa6cc55a65662efe37751cdc7c1d7eea26c19e7c42caacfff92e6fce04a37f7ffce141584475e7e52e8e4ec01ba9245b9fe9d37959cd25ee32

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2935.exe

Filesize
324KB

MD5
23fddedd9a33954b3aaf864568ef50f2

SHA1
3c011b4910bcfe0eeddf368ce9ead06a960fc3d0

SHA256
47f952b620bcedb151d718076753bb705286d69fd65a245c8ffdbc2802d42780

SHA512
0df253b73b789a4ac1594574d9edb8bdf99d3ad6f9409cf6573ce652dd855622e1b62a44c2b4929bf3eb6280cc80d4de2999941a4acf883bbfc4783fd25ecf06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3057Kn.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c05ZU67.exe

Filesize
226KB

MD5
5f0e548d5fda0ebadbb63137c83a9a5a

SHA1
c2ea3b9f49746efa6c6f119266dedf30733a31e4

SHA256
1acd5103a34151f9ff2a37bc12cc13a8b9126e4d5b511401a1b8fa25dbed8b64

SHA512
ef4dae58a42821df967bcb4a5bcb604e31f76857f817218b1eaada7f85a9d5c1d2e64ac0f54f733601ecb2d1064c71fe628395f03d4c4f2aa5710b7ae3fd54a3

Download Submit
memory/860-21-0x00007FFBA03A3000-0x00007FFBA03A5000-memory.dmp

Filesize
8KB

Download
memory/860-22-0x0000000000140000-0x000000000014A000-memory.dmp

Filesize
40KB

Download
memory/860-23-0x00007FFBA03A3000-0x00007FFBA03A5000-memory.dmp

Filesize
8KB

Download
memory/1588-60-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1588-31-0x0000000002310000-0x0000000002328000-memory.dmp

Filesize
96KB

Download
memory/1588-47-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-57-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-55-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-53-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-51-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-49-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-46-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-43-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-41-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-39-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-59-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-37-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-35-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-33-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-32-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/1588-30-0x0000000004D50000-0x00000000052F4000-memory.dmp

Filesize
5.6MB

Download
memory/1588-62-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1588-29-0x00000000020C0000-0x00000000020DA000-memory.dmp

Filesize
104KB

Download
memory/3928-90-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-80-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-88-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-67-0x00000000022E0000-0x0000000002326000-memory.dmp

Filesize
280KB

Download
memory/3928-102-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-100-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-98-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-96-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-94-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-92-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-86-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-84-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-82-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-68-0x0000000004AC0000-0x0000000004B04000-memory.dmp

Filesize
272KB

Download
memory/3928-76-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-74-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-78-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-72-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-70-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-69-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/3928-975-0x0000000005160000-0x0000000005778000-memory.dmp

Filesize
6.1MB

Download
memory/3928-976-0x00000000057A0000-0x00000000058AA000-memory.dmp

Filesize
1.0MB

Download
memory/3928-977-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/3928-978-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/3928-979-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Filesize
304KB

Download