healer | ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be

Resubmissions

29-10-2024 12:20

241029-phrxmawpbn 10

15-03-2023 15:29

230315-sw9alsdh98 10

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29-10-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe
Size

864KB
MD5

23d9c4e1f9a78b1a72a39748ef4a2019
SHA1

789c420acdc6e147128fee8521b79e351f8293a6
SHA256

ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be
SHA512

519f1d4d6fed2c7d492713523ae6c378b9a6410a36873f225c920dc371ddae89a09774913adb1ee61699da24f957ad1621503148d177e5ba739b71f56b5f276d
SSDEEP

24576:7y0A+40IMBqTEtIg1iLTXpQNby65YO9S:u0f4071IhCNG

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002ab22-19.dat	healer
behavioral4/memory/228-22-0x0000000000500000-0x000000000050A000-memory.dmp	healer
behavioral4/memory/124-29-0x0000000004A10000-0x0000000004A2A000-memory.dmp	healer
behavioral4/memory/124-31-0x0000000004E60000-0x0000000004E78000-memory.dmp	healer
behavioral4/memory/124-59-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-57-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-55-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-51-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-47-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-45-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-43-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-41-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-37-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-33-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-32-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-53-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-49-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-39-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer
behavioral4/memory/124-36-0x0000000004E60000-0x0000000004E72000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b4168yh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b4168yh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b4168yh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b4168yh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c81Ys67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b4168yh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b4168yh.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral4/memory/3748-68-0x0000000007210000-0x0000000007254000-memory.dmp	family_redline
behavioral4/memory/3748-67-0x0000000004CA0000-0x0000000004CE6000-memory.dmp	family_redline
behavioral4/memory/3748-94-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-74-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-103-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-100-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-98-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-96-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-92-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-90-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-88-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-86-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-84-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-82-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-80-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-78-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-76-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-72-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-70-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline
behavioral4/memory/3748-69-0x0000000007210000-0x000000000724E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
2604	tice6423.exe
2208	tice2507.exe
228	b4168yh.exe
124	c81Ys67.exe
3748	dbktb69.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b4168yh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c81Ys67.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c81Ys67.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice6423.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	tice2507.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3852	124	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice6423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice2507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c81Ys67.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbktb69.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
228	b4168yh.exe
228	b4168yh.exe
124	c81Ys67.exe
124	c81Ys67.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	b4168yh.exe
Token: SeDebugPrivilege	124	c81Ys67.exe
Token: SeDebugPrivilege	3748	dbktb69.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2604	868	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe	79
PID 868 wrote to memory of 2604	868	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe	79
PID 868 wrote to memory of 2604	868	ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe	79
PID 2604 wrote to memory of 2208	2604	tice6423.exe	80
PID 2604 wrote to memory of 2208	2604	tice6423.exe	80
PID 2604 wrote to memory of 2208	2604	tice6423.exe	80
PID 2208 wrote to memory of 228	2208	tice2507.exe	81
PID 2208 wrote to memory of 228	2208	tice2507.exe	81
PID 2208 wrote to memory of 124	2208	tice2507.exe	82
PID 2208 wrote to memory of 124	2208	tice2507.exe	82
PID 2208 wrote to memory of 124	2208	tice2507.exe	82
PID 2604 wrote to memory of 3748	2604	tice6423.exe	86
PID 2604 wrote to memory of 3748	2604	tice6423.exe	86
PID 2604 wrote to memory of 3748	2604	tice6423.exe	86

C:\Users\Admin\AppData\Local\Temp\ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe
"C:\Users\Admin\AppData\Local\Temp\ab2e1a38b954b8869e9527d3279e2a7dfd6c0533f2e280801a37eba6143520be.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6423.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6423.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2507.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2507.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4168yh.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4168yh.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:228
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c81Ys67.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c81Ys67.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:124
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 124 -s 968
        5⤵
        Program crash
        
        PID:3852
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbktb69.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbktb69.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 124 -ip 124
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6423.exe

Filesize
719KB

MD5
47184e7442802bf37bcc029a311eb7f3

SHA1
1feae07776956df32ddb2a86e98aa2fbad52ca6e

SHA256
4b2021148db4363dd8b6cb82e34bbb53d94844759121ab9b50f80e009d62e2de

SHA512
7728046f59dc66842fe31ae789549a02dbaeddf27cb8e748123cd9a755d16a13e07b6316b67949c16735554d6c76b89635b13aaa80133269dd6b5a8821aed817

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbktb69.exe

Filesize
399KB

MD5
f4144a8a6e619ab7e05bf8faea483bac

SHA1
d226283202e135eff03832b93f562d6d7aef70ce

SHA256
5e0619002a1c5a6b6e73228fa04f8f518939b04aadf70d6f5cd3152dc7a32960

SHA512
af4c3f0ba3c282a8c51d8921fc929f0cce845413ed9dc3ebffefe33b1f2080c6071fadf3b11868eb1258cbea068b306e870961fc8f9d581feddc8d346d95d1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice2507.exe

Filesize
360KB

MD5
974b89180ed75a7de898d4e37da74477

SHA1
f2f26b64af20c7dd465804e13042a29fe24bec72

SHA256
02a3b9218a805ff8b8550f2d69866f42ac002f4312753db9a0c52ca0b654c773

SHA512
d90304a54d09470f3f919a8a5c1daf291a1a052a831755abe3ba796665b92a7406ee73b1a4a066fe7c7cb430867ba5bf70e986db1c9ceec63581d33cdf886f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4168yh.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c81Ys67.exe

Filesize
342KB

MD5
2a6ccc708d9eb4f55d8fd5b943999bc4

SHA1
1fbf51cbc1167ef793f784627a091740e0d9c5d7

SHA256
73318cd6686acab325fc1602e14f452e459a22311483f6997f7e50708219faf4

SHA512
8f2bc1ea67f9af6411d943fd5743a6a1b79033f3542486d1465ea475a71478ae6806f30b5b0fe9ba0165f7a449a988d6edf2866915320093f1922b4eb8acb701

Download Submit
memory/124-60-0x0000000000400000-0x0000000002B1A000-memory.dmp

Filesize
39.1MB

Download
memory/124-43-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-29-0x0000000004A10000-0x0000000004A2A000-memory.dmp

Filesize
104KB

Download
memory/124-30-0x0000000007390000-0x0000000007936000-memory.dmp

Filesize
5.6MB

Download
memory/124-31-0x0000000004E60000-0x0000000004E78000-memory.dmp

Filesize
96KB

Download
memory/124-59-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-57-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-55-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-51-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-47-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-45-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-33-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-41-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-37-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-62-0x0000000000400000-0x0000000002B1A000-memory.dmp

Filesize
39.1MB

Download
memory/124-32-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-53-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-49-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-39-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/124-36-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/228-22-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/228-21-0x00007FFE8EB83000-0x00007FFE8EB85000-memory.dmp

Filesize
8KB

Download
memory/228-23-0x00007FFE8EB83000-0x00007FFE8EB85000-memory.dmp

Filesize
8KB

Download
memory/3748-69-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-90-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-94-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-74-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-103-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-100-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-98-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-96-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-92-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-67-0x0000000004CA0000-0x0000000004CE6000-memory.dmp

Filesize
280KB

Download
memory/3748-88-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-86-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-84-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-82-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-80-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-78-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-76-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-72-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-70-0x0000000007210000-0x000000000724E000-memory.dmp

Filesize
248KB

Download
memory/3748-68-0x0000000007210000-0x0000000007254000-memory.dmp

Filesize
272KB

Download
memory/3748-975-0x00000000079B0000-0x0000000007FC8000-memory.dmp

Filesize
6.1MB

Download
memory/3748-976-0x00000000072E0000-0x00000000073EA000-memory.dmp

Filesize
1.0MB

Download
memory/3748-977-0x0000000008000000-0x0000000008012000-memory.dmp

Filesize
72KB

Download
memory/3748-978-0x0000000008020000-0x000000000805C000-memory.dmp

Filesize
240KB

Download
memory/3748-979-0x0000000008170000-0x00000000081BC000-memory.dmp

Filesize
304KB

Download