healer | cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exe
Size

787KB
MD5

3595a4ef4cbf51e0423a430f1225bb7c
SHA1

6685b7548af661cb87056d62ab4336a30f4a1dd5
SHA256

cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7
SHA512

86f1fd7949779934a92b59b638cdef5cfce5c4ed00b8d174c6a7682e28824c7a4eac71d4be1d0df207d4f4a9806092f6b84df96783cb1b690040edb0e23a4dc0
SSDEEP

12288:fMrly90dKZV199U4qRMOQUlRxpBGqBnEQuosI6O5fVHeH71XvJrYk1sKQf2aMsDp:iyfUsQlRfsqBLkI68ob1/+KmPthJ

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0008000000023c8e-20.dat	healer
behavioral1/memory/1564-21-0x0000000000A70000-0x0000000000A7A000-memory.dmp	healer
behavioral1/memory/4348-28-0x0000000004AD0000-0x0000000004AEA000-memory.dmp	healer
behavioral1/memory/4348-30-0x0000000005150000-0x0000000005168000-memory.dmp	healer
behavioral1/memory/4348-31-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-38-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-58-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-56-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-54-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-52-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-50-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-48-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-46-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-44-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-42-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-40-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-36-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-34-0x0000000005150000-0x0000000005162000-memory.dmp	healer
behavioral1/memory/4348-32-0x0000000005150000-0x0000000005162000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

c48Bs04.exeb1883Lj.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c48Bs04.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c48Bs04.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c48Bs04.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c48Bs04.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c48Bs04.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b1883Lj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b1883Lj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b1883Lj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c48Bs04.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b1883Lj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b1883Lj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b1883Lj.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4764-66-0x00000000022B0000-0x00000000022F6000-memory.dmp	family_redline
behavioral1/memory/4764-67-0x00000000050A0000-0x00000000050E4000-memory.dmp	family_redline
behavioral1/memory/4764-69-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-81-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-101-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-99-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-97-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-95-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-93-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-89-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-87-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-86-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-83-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-80-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-77-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-75-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-73-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-71-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-91-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/4764-68-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

Processes:

tice3898.exetice6623.exeb1883Lj.exec48Bs04.exedYSeK16.exe

pid	Process
2504	tice3898.exe
3176	tice6623.exe
1564	b1883Lj.exe
4348	c48Bs04.exe
4764	dYSeK16.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

c48Bs04.exeb1883Lj.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c48Bs04.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b1883Lj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c48Bs04.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exetice3898.exetice6623.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice3898.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice6623.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
448	4348	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c48Bs04.exedYSeK16.execfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exetice3898.exetice6623.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c48Bs04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dYSeK16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice3898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice6623.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b1883Lj.exec48Bs04.exe

pid	Process
1564	b1883Lj.exe
1564	b1883Lj.exe
4348	c48Bs04.exe
4348	c48Bs04.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b1883Lj.exec48Bs04.exedYSeK16.exe

description	pid	Process
Token: SeDebugPrivilege	1564	b1883Lj.exe
Token: SeDebugPrivilege	4348	c48Bs04.exe
Token: SeDebugPrivilege	4764	dYSeK16.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exetice3898.exetice6623.exe

description	pid	Process	procid_target
PID 3788 wrote to memory of 2504	3788	cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exe	84
PID 3788 wrote to memory of 2504	3788	cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exe	84
PID 3788 wrote to memory of 2504	3788	cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exe	84
PID 2504 wrote to memory of 3176	2504	tice3898.exe	86
PID 2504 wrote to memory of 3176	2504	tice3898.exe	86
PID 2504 wrote to memory of 3176	2504	tice3898.exe	86
PID 3176 wrote to memory of 1564	3176	tice6623.exe	87
PID 3176 wrote to memory of 1564	3176	tice6623.exe	87
PID 3176 wrote to memory of 4348	3176	tice6623.exe	93
PID 3176 wrote to memory of 4348	3176	tice6623.exe	93
PID 3176 wrote to memory of 4348	3176	tice6623.exe	93
PID 2504 wrote to memory of 4764	2504	tice3898.exe	97
PID 2504 wrote to memory of 4764	2504	tice3898.exe	97
PID 2504 wrote to memory of 4764	2504	tice3898.exe	97

C:\Users\Admin\AppData\Local\Temp\cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exe
"C:\Users\Admin\AppData\Local\Temp\cfbbf45ddfa24659df65e830d10c8e9bd01d681d87b7d17313c7cb41bfab55a7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3898.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3898.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6623.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6623.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1883Lj.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1883Lj.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c48Bs04.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c48Bs04.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 1092
        5⤵
        Program crash
        
        PID:448
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dYSeK16.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dYSeK16.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4348 -ip 4348
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3898.exe

Filesize
642KB

MD5
befcad168d0b1ae22f77a6666142c63f

SHA1
ca95dedcd5554c5de16d3b31797453510eb22991

SHA256
69dba48bdf95fd1a171d3a0faefdba755adeddd21adac17eb08a82d62656744d

SHA512
5fe6d85d736f3c657a683ddae15a5ed739719d58092bdaf4f44d9390603891f2f978d284746fec1080131ce32ef206adc907a82a613d9c7c9b8e2ae4289bee2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dYSeK16.exe

Filesize
295KB

MD5
453a53edeccd749b1c7834097f3318eb

SHA1
e097ba7083de00f6afab680894383cd707e13ea3

SHA256
eef263946988db7ab3fd22c291de555c641ba6f86ca2445086c049178e38360a

SHA512
536b3c9704fc1c7d4dc6204da5b51178783fa3b74fc68b212058322bdcd3a2bc9a05d12a57a8ccff35661947e3691c2d55509a829b6b2242d0759916349bec2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6623.exe

Filesize
322KB

MD5
857c68de34bc35a5e72cf97d62ede070

SHA1
0acb29a3901835c74fbfd4c361c1931091d98d7e

SHA256
8cc1f6fd0501c5c4a080b99c13da1cbc4fdf260e862aa1ebbac8380d48d45efc

SHA512
04175d81fb7c412e7b63f795085fa718eaab245974594774c927c388ce4df48cf1118604234bce2abdd6642df2c90824dd5d4d04a304c37760a29ee019f38dd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1883Lj.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c48Bs04.exe

Filesize
237KB

MD5
428d747a825b7981d7eeafd590014554

SHA1
9d2b6411e39271231b388311ddaa801d7cf83169

SHA256
5c2ed167462f28a31bf74f7bab00bf46f7743cac139afb8f5c4b37a4ceb26015

SHA512
999928aba735fbd06742e14dfe984e7eb689ec1386333a199447de8ea762b80661bea8eeac5f85da1039db8ef00c02b55d3e685f0a776539323dc2e7575792c0

Download Submit
memory/1564-21-0x0000000000A70000-0x0000000000A7A000-memory.dmp

Filesize
40KB

Download
memory/1564-22-0x00007FFB40743000-0x00007FFB40745000-memory.dmp

Filesize
8KB

Download
memory/4348-61-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4348-30-0x0000000005150000-0x0000000005168000-memory.dmp

Filesize
96KB

Download
memory/4348-31-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-38-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-58-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-56-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-54-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-52-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-50-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-48-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-46-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-44-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-42-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-40-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-36-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-34-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-32-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-59-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4348-29-0x0000000004B60000-0x0000000005104000-memory.dmp

Filesize
5.6MB

Download
memory/4348-28-0x0000000004AD0000-0x0000000004AEA000-memory.dmp

Filesize
104KB

Download
memory/4764-81-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-80-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-69-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-66-0x00000000022B0000-0x00000000022F6000-memory.dmp

Filesize
280KB

Download
memory/4764-101-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-99-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-97-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-95-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-93-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-89-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-87-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-86-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-83-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-67-0x00000000050A0000-0x00000000050E4000-memory.dmp

Filesize
272KB

Download
memory/4764-77-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-75-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-73-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-71-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-91-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-68-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/4764-974-0x0000000005240000-0x0000000005858000-memory.dmp

Filesize
6.1MB

Download
memory/4764-975-0x00000000058E0000-0x00000000059EA000-memory.dmp

Filesize
1.0MB

Download
memory/4764-976-0x0000000005A20000-0x0000000005A32000-memory.dmp

Filesize
72KB

Download
memory/4764-977-0x0000000005A40000-0x0000000005A7C000-memory.dmp

Filesize
240KB

Download
memory/4764-978-0x0000000005B90000-0x0000000005BDC000-memory.dmp

Filesize
304KB

Download