healer | c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b.exe
Size

810KB
MD5

fdc9d7c429ad9ccb25a5e94f3fe393e3
SHA1

e6f4bf483ae476e524154f7dfb369ece7ef94cd5
SHA256

c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b
SHA512

5af49da080ce5d2faa8ac5f654ca53f77a264cb8db2a1512ed15235b77aeedcfde516185df99a15acb7cda74f41d6e43377387a1f93a975cd64dc0cf62c1f0e5
SSDEEP

24576:Qyx52CNq03gs+FeO443WiKOqLOUh0QZAt0m:Xx51+s+F0431Kz0QZy

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023c55-19.dat	healer
behavioral1/memory/3292-22-0x00000000005D0000-0x00000000005DA000-memory.dmp	healer
behavioral1/memory/4316-28-0x00000000023B0000-0x00000000023CA000-memory.dmp	healer
behavioral1/memory/4316-30-0x0000000002700000-0x0000000002718000-memory.dmp	healer
behavioral1/memory/4316-32-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-36-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-54-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-52-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-44-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-43-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-58-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-34-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-56-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-50-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-48-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-46-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-40-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-39-0x0000000002700000-0x0000000002712000-memory.dmp	healer
behavioral1/memory/4316-31-0x0000000002700000-0x0000000002712000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c29pX59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c29pX59.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b3409ui.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b3409ui.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b3409ui.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c29pX59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c29pX59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b3409ui.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b3409ui.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b3409ui.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c29pX59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c29pX59.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4624-66-0x0000000004A10000-0x0000000004A56000-memory.dmp	family_redline
behavioral1/memory/4624-67-0x0000000005060000-0x00000000050A4000-memory.dmp	family_redline
behavioral1/memory/4624-69-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-75-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-101-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-97-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-95-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-93-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-91-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-89-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-87-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-85-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-83-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-81-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-79-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-73-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-71-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-99-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-77-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4624-68-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
4804	nice1858.exe
1812	nice9076.exe
3292	b3409ui.exe
4316	c29pX59.exe
4624	dZLek71.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c29pX59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c29pX59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b3409ui.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nice1858.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nice9076.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4672	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5056	4316	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nice1858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nice9076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c29pX59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dZLek71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3292	b3409ui.exe
3292	b3409ui.exe
4316	c29pX59.exe
4316	c29pX59.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	b3409ui.exe
Token: SeDebugPrivilege	4316	c29pX59.exe
Token: SeDebugPrivilege	4624	dZLek71.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4804	4072	c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b.exe	84
PID 4072 wrote to memory of 4804	4072	c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b.exe	84
PID 4072 wrote to memory of 4804	4072	c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b.exe	84
PID 4804 wrote to memory of 1812	4804	nice1858.exe	86
PID 4804 wrote to memory of 1812	4804	nice1858.exe	86
PID 4804 wrote to memory of 1812	4804	nice1858.exe	86
PID 1812 wrote to memory of 3292	1812	nice9076.exe	87
PID 1812 wrote to memory of 3292	1812	nice9076.exe	87
PID 1812 wrote to memory of 4316	1812	nice9076.exe	96
PID 1812 wrote to memory of 4316	1812	nice9076.exe	96
PID 1812 wrote to memory of 4316	1812	nice9076.exe	96
PID 4804 wrote to memory of 4624	4804	nice1858.exe	101
PID 4804 wrote to memory of 4624	4804	nice1858.exe	101
PID 4804 wrote to memory of 4624	4804	nice1858.exe	101

C:\Users\Admin\AppData\Local\Temp\c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b.exe
"C:\Users\Admin\AppData\Local\Temp\c79df91fe2ef8dec810f82911fdc27c16a445d216fc3fdb3e1799a076dd9074b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice1858.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice1858.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice9076.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice9076.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3409ui.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3409ui.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c29pX59.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c29pX59.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 1088
        5⤵
        Program crash
        
        PID:5056
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dZLek71.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dZLek71.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4316 -ip 4316
1⤵
PID:3132

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice1858.exe

Filesize
665KB

MD5
d6c51f5c4f779ef26d7fcb68f743be80

SHA1
91b6fdda72cab884b39ef6dc7d96f5cd136cbe2a

SHA256
b5d3cfe31f3913e912a8a27ffdcfd77c2dd0ec06617224eefcf649ca35af1c0c

SHA512
86dfc505de91638c6a3627d963f3bfb0cd7068ce00cd330a6774cd5a4c4a16b49014472607f6a908d673ae0fc9eea7b612198c809cef30ca48d521593108f641

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dZLek71.exe

Filesize
307KB

MD5
82ac7e07b44e01d87ebae0feef3173db

SHA1
4d029b25b2bc531fe566b2dcc60a415df8f0923c

SHA256
09f8ddd21bf61bca2b959c1b6dc1529766affe102170f4dddd64297296a024cf

SHA512
175cebf65135845c8b39c21ee74e42bec8bab142ceac8602be3e96ad4f8c9bdf90204f93771f12b7760e335386e9bbd4b0b896462fe455375c0fe647be6b081a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice9076.exe

Filesize
333KB

MD5
b886e45bfa9742e10710830420224eea

SHA1
01544dcda3322071e6c0f399c0c8d16377f8dba1

SHA256
5409a0663c1f6cfc1b2f5e3c9f1462e6c324d503fe441db9f7d03eac24c7620e

SHA512
db664da6ef470f85ebac46a77d2b731134296bd5c00c959256ed43f902e3472fe08c1833b5422c2b337a426e47462683f8c7fccd1b0908495ebef4c7ba2a56fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3409ui.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c29pX59.exe

Filesize
250KB

MD5
8809a995f93b5db51e635e286f5c3213

SHA1
2c97a99dc720f09b9ec004dfb648d10d809ae84e

SHA256
6a6a744330b50650d440fc98eee6b4abd596c710171b5aea49cd08f2f4169ef8

SHA512
f6b761e6c565878013d89ccb241bdc8e08c58d1dde4a69860c7912673d0fbab043bce3f55e8266984175cf95f5042efa0087a4626180138f6842a39932f06820

Download Submit
memory/3292-21-0x00007FFC59F03000-0x00007FFC59F05000-memory.dmp

Filesize
8KB

Download
memory/3292-22-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/4316-61-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4316-30-0x0000000002700000-0x0000000002718000-memory.dmp

Filesize
96KB

Download
memory/4316-32-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-36-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-54-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-52-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-44-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-43-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-58-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-34-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-56-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-50-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-48-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-46-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-40-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-39-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-31-0x0000000002700000-0x0000000002712000-memory.dmp

Filesize
72KB

Download
memory/4316-59-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4316-29-0x0000000004B90000-0x0000000005134000-memory.dmp

Filesize
5.6MB

Download
memory/4316-28-0x00000000023B0000-0x00000000023CA000-memory.dmp

Filesize
104KB

Download
memory/4624-75-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-81-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-69-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-66-0x0000000004A10000-0x0000000004A56000-memory.dmp

Filesize
280KB

Download
memory/4624-101-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-97-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-95-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-93-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-91-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-89-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-87-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-85-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-83-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-67-0x0000000005060000-0x00000000050A4000-memory.dmp

Filesize
272KB

Download
memory/4624-79-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-73-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-71-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-99-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-77-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-68-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4624-974-0x0000000005240000-0x0000000005858000-memory.dmp

Filesize
6.1MB

Download
memory/4624-975-0x00000000058E0000-0x00000000059EA000-memory.dmp

Filesize
1.0MB

Download
memory/4624-976-0x0000000005A20000-0x0000000005A32000-memory.dmp

Filesize
72KB

Download
memory/4624-977-0x0000000005A40000-0x0000000005A7C000-memory.dmp

Filesize
240KB

Download
memory/4624-978-0x0000000005B90000-0x0000000005BDC000-memory.dmp

Filesize
304KB

Download