healer | b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86.exe
Size

793KB
MD5

4ab115413da0da997096e99b68817109
SHA1

98d34d1a5d84e7037a8931811da7fa0f4edb72c7
SHA256

b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86
SHA512

f3231971f930c122d3f1a2f028a276cf5364ad1cdd463c8ff2ea367bed50e23a513148840c57c5e85b82d83e3ed46f2bdd15a1ad1a3c99c445fb9afe13ec2bf6
SSDEEP

24576:IyrI5sIliR+m0mHgrFrn/g1IxidvlcoJL/Wd:PM5siiQm02gp/g1IxidvSuC

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cba-19.dat	healer
behavioral1/memory/3496-22-0x0000000000840000-0x000000000084A000-memory.dmp	healer
behavioral1/memory/2780-29-0x0000000002220000-0x000000000223A000-memory.dmp	healer
behavioral1/memory/2780-31-0x00000000023D0000-0x00000000023E8000-memory.dmp	healer
behavioral1/memory/2780-32-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-39-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-57-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-55-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-53-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-51-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-50-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-47-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-45-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-43-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-42-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-37-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-35-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-33-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer
behavioral1/memory/2780-59-0x00000000023D0000-0x00000000023E2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b5414wf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b5414wf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c10WG90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c10WG90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c10WG90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b5414wf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b5414wf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b5414wf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b5414wf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c10WG90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c10WG90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c10WG90.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4044-67-0x0000000002500000-0x0000000002546000-memory.dmp	family_redline
behavioral1/memory/4044-68-0x0000000002670000-0x00000000026B4000-memory.dmp	family_redline
behavioral1/memory/4044-86-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-98-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-103-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-100-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-96-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-94-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-92-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-90-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-88-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-84-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-82-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-80-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-78-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-76-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-74-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-72-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-70-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/4044-69-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
4316	tice1821.exe
4720	tice5316.exe
3496	b5414wf.exe
2780	c10WG90.exe
4044	dsSHG98.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b5414wf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c10WG90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c10WG90.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice1821.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice5316.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2336	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2780	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dsSHG98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice1821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice5316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c10WG90.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3496	b5414wf.exe
3496	b5414wf.exe
2780	c10WG90.exe
2780	c10WG90.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3496	b5414wf.exe
Token: SeDebugPrivilege	2780	c10WG90.exe
Token: SeDebugPrivilege	4044	dsSHG98.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 4316	3080	b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86.exe	84
PID 3080 wrote to memory of 4316	3080	b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86.exe	84
PID 3080 wrote to memory of 4316	3080	b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86.exe	84
PID 4316 wrote to memory of 4720	4316	tice1821.exe	85
PID 4316 wrote to memory of 4720	4316	tice1821.exe	85
PID 4316 wrote to memory of 4720	4316	tice1821.exe	85
PID 4720 wrote to memory of 3496	4720	tice5316.exe	87
PID 4720 wrote to memory of 3496	4720	tice5316.exe	87
PID 4720 wrote to memory of 2780	4720	tice5316.exe	94
PID 4720 wrote to memory of 2780	4720	tice5316.exe	94
PID 4720 wrote to memory of 2780	4720	tice5316.exe	94
PID 4316 wrote to memory of 4044	4316	tice1821.exe	98
PID 4316 wrote to memory of 4044	4316	tice1821.exe	98
PID 4316 wrote to memory of 4044	4316	tice1821.exe	98

C:\Users\Admin\AppData\Local\Temp\b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86.exe
"C:\Users\Admin\AppData\Local\Temp\b4093d1ab64d6af5ba77a6a14c022e5a01f038833b3cd02ed15c5a7bec3dae86.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice1821.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice1821.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5316.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5316.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5414wf.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5414wf.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c10WG90.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c10WG90.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 1012
        5⤵
        Program crash
        
        PID:2752
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsSHG98.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsSHG98.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2780 -ip 2780
1⤵
PID:2244

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice1821.exe

Filesize
648KB

MD5
5607059f4fcfc1cfbe47fdde1f44a097

SHA1
00f8954843c98ce900ebc85f3f61c4a1812f3561

SHA256
beb555d806f5cd99f6590c2916c61c4b2627bd718c2c5b56e7fc09af17e2eddd

SHA512
0a5ba68e68d060b5fbfbc94b0b8f2628359f883ff4b4c80a0d99a3288aafc822425109de4597ce7e5418333e55377d67e5574a75ddb75935fe0502659f386489

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsSHG98.exe

Filesize
283KB

MD5
597a217ce89751109c86359bacd0d831

SHA1
686cdede0d70c16ae5ad8858abc11c3913de39c6

SHA256
4094bd300b3bd5c6f1a810b4afff7a02fca7900be6a33d57cdfe00bbcea0a8cc

SHA512
654b59c6b762d0813723d19f238e44e74f3f61242af785e7b4deb183326cc20726a0a9c12d5c29bb1dc2de0f6cb21aa3435129bc0359904c410892ee3515076e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice5316.exe

Filesize
325KB

MD5
d4e0498be85fbb174fc517ca6e4ef29b

SHA1
7fca1e40a45d3c36e2cd8cef5781ba58de9cad03

SHA256
0b00c4e2db97215666938d6df95126e34da9cbfefa74f8a20dae2d6be910f7ce

SHA512
209572767cbe6481f4e4c76f5e770b3c9dc276a3910b4eb41f57428e6ad3017e6f02ea20f972c11dbbe1b0cc10a55685eca3f4025aa835be7f8cb344510caedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5414wf.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c10WG90.exe

Filesize
226KB

MD5
0b8ba0c862a16e7d6bfd834918b3e3c7

SHA1
4046948111637aa536d353a0de12676a44b6bf5d

SHA256
20b22242c64e04fb8aeb734e34e74ca849fda731bd1d02498f7e6357987fc8ee

SHA512
853e6b8e3610f58251fb057d016248c925c03b396276225cae4a65a837546a05dd31a52c612e955b37518ee67292ff0b806c3edac96cdd2d2731f2183b4afe3e

Download Submit
memory/2780-60-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2780-50-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-29-0x0000000002220000-0x000000000223A000-memory.dmp

Filesize
104KB

Download
memory/2780-30-0x0000000004C00000-0x00000000051A4000-memory.dmp

Filesize
5.6MB

Download
memory/2780-31-0x00000000023D0000-0x00000000023E8000-memory.dmp

Filesize
96KB

Download
memory/2780-32-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-39-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-57-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-55-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-53-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-51-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-43-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-47-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-45-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-62-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2780-42-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-37-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-35-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-33-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2780-59-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/3496-22-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/3496-21-0x00007FFD372E3000-0x00007FFD372E5000-memory.dmp

Filesize
8KB

Download
memory/3496-23-0x00007FFD372E3000-0x00007FFD372E5000-memory.dmp

Filesize
8KB

Download
memory/4044-69-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-90-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-86-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-98-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-103-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-100-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-96-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-94-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-92-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-68-0x0000000002670000-0x00000000026B4000-memory.dmp

Filesize
272KB

Download
memory/4044-88-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-84-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-82-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-80-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-78-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-76-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-74-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-72-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-70-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/4044-67-0x0000000002500000-0x0000000002546000-memory.dmp

Filesize
280KB

Download
memory/4044-975-0x0000000005290000-0x00000000058A8000-memory.dmp

Filesize
6.1MB

Download
memory/4044-976-0x0000000004BC0000-0x0000000004CCA000-memory.dmp

Filesize
1.0MB

Download
memory/4044-977-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/4044-978-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/4044-979-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Filesize
304KB

Download