healer | f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a.exe
Size

908KB
MD5

923a67414df95576bec8829cc79ba26c
SHA1

f97a551a81dda665ed6d1771c43789c373803234
SHA256

f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a
SHA512

cf30b9a7f0484ccff998d45ad7a09227b271b667a4748c958cbd285db1586f116fa4c4aaa0e3cb2bb0872fef2e7182e9a869efd9f07322f48e561d1dee1e4bf8
SSDEEP

12288:GMr9y90hinfFQquY4HC2bBPjLlsijcknXvRmMOtinfg20gTnFnEnjZR/V7tco:jyIinfazdjOiIUmMK320nZf7tR

Score

10^/10

healer redline down discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c88-19.dat	healer
behavioral1/memory/5000-22-0x00000000005A0000-0x00000000005AA000-memory.dmp	healer
behavioral1/memory/3128-29-0x00000000027A0000-0x00000000027BA000-memory.dmp	healer
behavioral1/memory/3128-31-0x0000000004CC0000-0x0000000004CD8000-memory.dmp	healer
behavioral1/memory/3128-32-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-39-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-59-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-57-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-55-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-53-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-51-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-49-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-47-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-45-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-43-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-41-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-37-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-35-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer
behavioral1/memory/3128-33-0x0000000004CC0000-0x0000000004CD2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	pro6480.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6480.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	qu9082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	qu9082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6480.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6480.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6480.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6480.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	qu9082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	qu9082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	qu9082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	qu9082.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4080-67-0x0000000002690000-0x00000000026D6000-memory.dmp	family_redline
behavioral1/memory/4080-68-0x0000000005310000-0x0000000005354000-memory.dmp	family_redline
behavioral1/memory/4080-82-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-102-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-100-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-98-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-96-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-94-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-92-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-90-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-88-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-86-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-84-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-80-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-78-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-76-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-74-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-72-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-70-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline
behavioral1/memory/4080-69-0x0000000005310000-0x000000000534E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
2116	unio5312.exe
4176	unio2266.exe
5000	pro6480.exe
3128	qu9082.exe
4080	rJP54s90.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	qu9082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	qu9082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6480.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	unio5312.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	unio2266.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	3128	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unio2266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu9082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rJP54s90.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unio5312.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5000	pro6480.exe
5000	pro6480.exe
3128	qu9082.exe
3128	qu9082.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	pro6480.exe
Token: SeDebugPrivilege	3128	qu9082.exe
Token: SeDebugPrivilege	4080	rJP54s90.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2116	1524	f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a.exe	84
PID 1524 wrote to memory of 2116	1524	f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a.exe	84
PID 1524 wrote to memory of 2116	1524	f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a.exe	84
PID 2116 wrote to memory of 4176	2116	unio5312.exe	85
PID 2116 wrote to memory of 4176	2116	unio5312.exe	85
PID 2116 wrote to memory of 4176	2116	unio5312.exe	85
PID 4176 wrote to memory of 5000	4176	unio2266.exe	86
PID 4176 wrote to memory of 5000	4176	unio2266.exe	86
PID 4176 wrote to memory of 3128	4176	unio2266.exe	94
PID 4176 wrote to memory of 3128	4176	unio2266.exe	94
PID 4176 wrote to memory of 3128	4176	unio2266.exe	94
PID 2116 wrote to memory of 4080	2116	unio5312.exe	98
PID 2116 wrote to memory of 4080	2116	unio5312.exe	98
PID 2116 wrote to memory of 4080	2116	unio5312.exe	98

C:\Users\Admin\AppData\Local\Temp\f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a.exe
"C:\Users\Admin\AppData\Local\Temp\f4d4ab7ad85831462ef9cae87296ebce0976f1f4419ac5702d1bcf0a82eade2a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5312.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5312.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\unio2266.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\unio2266.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pro6480.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pro6480.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu9082.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu9082.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3128
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1080
        5⤵
        Program crash
        
        PID:964
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rJP54s90.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rJP54s90.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3128 -ip 3128
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5312.exe

Filesize
766KB

MD5
f601943a21addc0475a337eeca1e38fc

SHA1
b1ec9d2d64571723a9d6b366f351f95a2b2f8ba0

SHA256
43d6dd6d5c4235adb1d0049f2bc973576180a8ba2a031d47af20417d3f0bb75d

SHA512
b321cac78b098e5b6abcb46d422745e7cbed6c39fe9637af9184b27fce9c46ba2aa581399db63aad1ab41a0ac361ea72924bc00ff196420e2fb42a552e66309d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rJP54s90.exe

Filesize
457KB

MD5
1c763a0a7d706516d89268fee4847a8c

SHA1
a73f39b905c91e9fb684284d9b5320d128470ecc

SHA256
bc04ab7bd294b36a99390d121721b06ee826b9dd97fc0eaee4d8eac23417ae1a

SHA512
4e87772d4188a7e1e80fc40738b1215d833fbe9202cb471616c9f4f18c2c2d836723d3fa7835975364acef97242161d08d9c8f95c29c95d25209a3ae86a223e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\unio2266.exe

Filesize
380KB

MD5
98f4a36aaa155eca24d1575e63d30101

SHA1
1ea655df1c3ce9c367dd1409f15a0ced15db13d9

SHA256
cb59acab7abf54cec5375e216a6a60e0e7d466b45ba663141e5fccaf4ad5942e

SHA512
886c609aad3b58f8ba3e51aab313d9b4907fc0295ba050550c8eab448ca695c0415c6d1a6879182236e3df338fb750f2f69301e45d5695a85a0b8b4a87923e7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pro6480.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu9082.exe

Filesize
399KB

MD5
47f33ed0ca68b6ceb3a2e3bf3df95b37

SHA1
cc90b7d453e5ed900f4e3ea39548cbfe80a3e66e

SHA256
e34cb74c252280870729ad7f7f482fd5907150a86b728a4df2dd83117b45007c

SHA512
40dcb2254c5795a3655aa4f7b6e7a8d0da41c210b5d475b9a294d55d2b0257127cc3f355fe9a85066c00b5a43be352001bf3d958963095a084e89460ad7e4941

Download Submit
memory/3128-60-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/3128-62-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/3128-29-0x00000000027A0000-0x00000000027BA000-memory.dmp

Filesize
104KB

Download
memory/3128-30-0x0000000004E10000-0x00000000053B4000-memory.dmp

Filesize
5.6MB

Download
memory/3128-31-0x0000000004CC0000-0x0000000004CD8000-memory.dmp

Filesize
96KB

Download
memory/3128-32-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-39-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-59-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-57-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-55-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-53-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-51-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-49-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-47-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-45-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-43-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-41-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-37-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-35-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3128-33-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/4080-69-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-88-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-979-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

Filesize
304KB

Download
memory/4080-978-0x0000000005B70000-0x0000000005BAC000-memory.dmp

Filesize
240KB

Download
memory/4080-90-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-82-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-102-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-100-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-98-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-96-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-94-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-92-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-68-0x0000000005310000-0x0000000005354000-memory.dmp

Filesize
272KB

Download
memory/4080-977-0x0000000005B50000-0x0000000005B62000-memory.dmp

Filesize
72KB

Download
memory/4080-86-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-84-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-80-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-78-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-76-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-74-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-72-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-70-0x0000000005310000-0x000000000534E000-memory.dmp

Filesize
248KB

Download
memory/4080-67-0x0000000002690000-0x00000000026D6000-memory.dmp

Filesize
280KB

Download
memory/4080-975-0x0000000005370000-0x0000000005988000-memory.dmp

Filesize
6.1MB

Download
memory/4080-976-0x0000000005A10000-0x0000000005B1A000-memory.dmp

Filesize
1.0MB

Download
memory/5000-22-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/5000-23-0x00007FFD0A653000-0x00007FFD0A655000-memory.dmp

Filesize
8KB

Download
memory/5000-21-0x00007FFD0A653000-0x00007FFD0A655000-memory.dmp

Filesize
8KB

Download