healer | a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea.exe
Size

787KB
MD5

5b5b90e00cf359c135c90c11782ad5ea
SHA1

76f4a2881879fc0cd0056e4a1d4f8788c5f0e889
SHA256

a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea
SHA512

03629bc94904825777591c10b907c5886ac8890b25eef8268d2dedc5ee811c72409150599279f4ee4bc556bb6f4bf434a57641e6435970291b05cc025ba2e614
SSDEEP

12288:KMrZy90Vl+yVmpmtt4fmZ26SPGGp2pIYLA1lneoI1RShrck1yIjYLIeCemXZ:DySl+yVmpW2eZ26Se9Izlnex1IsCeMZ

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cb4-19.dat	healer
behavioral1/memory/5072-22-0x0000000000890000-0x000000000089A000-memory.dmp	healer
behavioral1/memory/4164-29-0x0000000002260000-0x000000000227A000-memory.dmp	healer
behavioral1/memory/4164-31-0x0000000005020000-0x0000000005038000-memory.dmp	healer
behavioral1/memory/4164-32-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-37-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-59-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-57-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-55-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-53-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-51-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-49-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-47-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-45-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-43-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-41-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-39-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-35-0x0000000005020000-0x0000000005032000-memory.dmp	healer
behavioral1/memory/4164-33-0x0000000005020000-0x0000000005032000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b5007cV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b5007cV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b5007cV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c23iy35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c23iy35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b5007cV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b5007cV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b5007cV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c23iy35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c23iy35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c23iy35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c23iy35.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/2028-67-0x0000000004A00000-0x0000000004A46000-memory.dmp	family_redline
behavioral1/memory/2028-68-0x0000000004AC0000-0x0000000004B04000-memory.dmp	family_redline
behavioral1/memory/2028-80-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-86-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-100-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-98-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-96-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-94-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-92-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-90-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-88-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-84-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-82-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-78-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-76-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-75-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-73-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-102-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-70-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline
behavioral1/memory/2028-69-0x0000000004AC0000-0x0000000004AFE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
1020	tice1245.exe
2972	tice6722.exe
5072	b5007cV.exe
4164	c23iy35.exe
2028	dkShx66.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b5007cV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c23iy35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c23iy35.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice1245.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice6722.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2380	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4396	4164	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c23iy35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dkShx66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice1245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice6722.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5072	b5007cV.exe
5072	b5007cV.exe
4164	c23iy35.exe
4164	c23iy35.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	b5007cV.exe
Token: SeDebugPrivilege	4164	c23iy35.exe
Token: SeDebugPrivilege	2028	dkShx66.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1020	4904	a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea.exe	83
PID 4904 wrote to memory of 1020	4904	a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea.exe	83
PID 4904 wrote to memory of 1020	4904	a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea.exe	83
PID 1020 wrote to memory of 2972	1020	tice1245.exe	84
PID 1020 wrote to memory of 2972	1020	tice1245.exe	84
PID 1020 wrote to memory of 2972	1020	tice1245.exe	84
PID 2972 wrote to memory of 5072	2972	tice6722.exe	86
PID 2972 wrote to memory of 5072	2972	tice6722.exe	86
PID 2972 wrote to memory of 4164	2972	tice6722.exe	96
PID 2972 wrote to memory of 4164	2972	tice6722.exe	96
PID 2972 wrote to memory of 4164	2972	tice6722.exe	96
PID 1020 wrote to memory of 2028	1020	tice1245.exe	101
PID 1020 wrote to memory of 2028	1020	tice1245.exe	101
PID 1020 wrote to memory of 2028	1020	tice1245.exe	101

C:\Users\Admin\AppData\Local\Temp\a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea.exe
"C:\Users\Admin\AppData\Local\Temp\a99dc9b2b27d517a8fbadc2c98faa43a9ff3a650a1cba790785e75d22b8133ea.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice1245.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice1245.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6722.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6722.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5007cV.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5007cV.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c23iy35.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c23iy35.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1080
        5⤵
        Program crash
        
        PID:4396
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dkShx66.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dkShx66.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4164 -ip 4164
1⤵
PID:912

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice1245.exe

Filesize
642KB

MD5
9e3b0ac2c49218b53ae9e7a8e53c4b50

SHA1
4782f120003c00343b60152e2cf12e3126dd9a7c

SHA256
1561062a8004e2c485d70cdf9454eab6c673257babe34bc638893553166f9efa

SHA512
d6b5b478e9b8b125627ce72ae44249f5750cafb141d0135220459e3c437c2e3b8d4d447df20d8c2b620505567126de4f7b83cc6c70685e64e91c1a0769d45a37

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dkShx66.exe

Filesize
295KB

MD5
1fd92d1615eee2de52bc752171330e70

SHA1
bdca3486a9348ebea969a141fcf6a7930cca32ea

SHA256
1f64accdf2f8d81c7279cf236ef726259ddac0a71cbe23c2acee0e32f0574c39

SHA512
cacc059cce9bb78ca9113976f9ab90b6947923a31a6711e1389f91f177451c66e3cced3ab74548f1576099c789ee8866508305c98007000c0d01106734340c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6722.exe

Filesize
321KB

MD5
b5c293c2d0b1f4c2a3249d753eb99a4c

SHA1
d05fdd16a7ea20765f601f4dfc02b0950521f675

SHA256
5c1bb62879955df2652e09b5060e0324d601d126f354b5ce8e354ac2f23d7d9c

SHA512
b634e2234571b38bba327bba3c96dd26e9de05e0eb744672d1d55a4a0a768cf2ac26b681a73de9ba2c4cd3e6a717c3c0037adb03dd59846dea95414c96b4c5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5007cV.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c23iy35.exe

Filesize
237KB

MD5
f3d133127e4f73d8cc8653c330165d91

SHA1
4daf37355d5fe9971e0d9aac9be7f414f4d5082d

SHA256
c5bebc3ba176c3eff78b508914da92f45bec9b824357707b85139a04f055c75d

SHA512
452bcd639b89b760ff24f82ed47130c37d01cb89d27e593818384cdd283244f2f08a6fd6de9216145c63c268f22fa70b8b0cbb95e33a57b542a056f736ebf85c

Download Submit
memory/2028-75-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-84-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-976-0x00000000058E0000-0x00000000059EA000-memory.dmp

Filesize
1.0MB

Download
memory/2028-975-0x0000000005270000-0x0000000005888000-memory.dmp

Filesize
6.1MB

Download
memory/2028-69-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-70-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-102-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-73-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-978-0x0000000005A40000-0x0000000005A7C000-memory.dmp

Filesize
240KB

Download
memory/2028-80-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-76-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-78-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-82-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-977-0x0000000005A20000-0x0000000005A32000-memory.dmp

Filesize
72KB

Download
memory/2028-88-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-90-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-92-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-94-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-96-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-98-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-100-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-86-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

Filesize
248KB

Download
memory/2028-979-0x0000000005B90000-0x0000000005BDC000-memory.dmp

Filesize
304KB

Download
memory/2028-67-0x0000000004A00000-0x0000000004A46000-memory.dmp

Filesize
280KB

Download
memory/2028-68-0x0000000004AC0000-0x0000000004B04000-memory.dmp

Filesize
272KB

Download
memory/4164-57-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-62-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4164-60-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4164-33-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-35-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-39-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-41-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-43-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-45-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-47-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-49-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-51-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-53-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-55-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-59-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-37-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-32-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/4164-31-0x0000000005020000-0x0000000005038000-memory.dmp

Filesize
96KB

Download
memory/4164-30-0x0000000004A70000-0x0000000005014000-memory.dmp

Filesize
5.6MB

Download
memory/4164-29-0x0000000002260000-0x000000000227A000-memory.dmp

Filesize
104KB

Download
memory/5072-24-0x00007FF81E343000-0x00007FF81E345000-memory.dmp

Filesize
8KB

Download
memory/5072-22-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download
memory/5072-21-0x00007FF81E343000-0x00007FF81E345000-memory.dmp

Filesize
8KB

Download