healer | ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe
Size

814KB
MD5

bb7c19e6446d1145c5b29f6d76833db5
SHA1

1d6fe62d5535174bca6359b2e12f00b3c9f41648
SHA256

ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8
SHA512

5e37355f491c0a117e99945a3d3315296357792f01b5b1454437578307962714f480c852e91b38e5b0ec68fd9065316694e1a62e6f0e92d42cc98194a4230d02
SSDEEP

12288:tMrRy90R5oXd6ZxEvKdIPWmZkaJ9TsNrxT7tajL2+35MLxGXiLO4xtF1gJjRHOy4:syW5ot6ZeuAWmyafsL0Lx5SibehgJlc

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/748-19-0x0000000002830000-0x000000000284A000-memory.dmp	healer
behavioral1/memory/748-21-0x0000000002860000-0x0000000002878000-memory.dmp	healer
behavioral1/memory/748-47-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-49-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-46-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-43-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-41-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-39-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-37-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-35-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-33-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-31-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-29-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-27-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-25-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-23-0x0000000002860000-0x0000000002872000-memory.dmp	healer
behavioral1/memory/748-22-0x0000000002860000-0x0000000002872000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro1086.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro1086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro1086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro1086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro1086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro1086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro1086.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2652-2143-0x0000000005750000-0x0000000005782000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/5512-2156-0x0000000000530000-0x0000000000560000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si050227.exe	family_redline
behavioral1/memory/6004-2167-0x0000000000600000-0x000000000062E000-memory.dmp	family_redline

Redline family
redline
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

qu2167.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation qu2167.exe
Executes dropped EXE 5 IoCs

Processes:

un920226.exepro1086.exequ2167.exe1.exesi050227.exe

pid process

3868 un920226.exe
748 pro1086.exe
2652 qu2167.exe
5512 1.exe
6004 si050227.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	qu2167.exe

pid	process
3868	un920226.exe
748	pro1086.exe
2652	qu2167.exe
5512	1.exe
6004	si050227.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro1086.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro1086.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro1086.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exeun920226.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un920226.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2624 748 WerFault.exe pro1086.exe
5672 2652 WerFault.exe qu2167.exe

pid	pid_target	process	target process
2624	748	WerFault.exe	pro1086.exe
5672	2652	WerFault.exe	qu2167.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exeun920226.exepro1086.exequ2167.exe1.exesi050227.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un920226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro1086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu2167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si050227.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro1086.exe

pid process

748 pro1086.exe
748 pro1086.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro1086.exequ2167.exe

description pid process

Token: SeDebugPrivilege 748 pro1086.exe
Token: SeDebugPrivilege 2652 qu2167.exe

pid	process
748	pro1086.exe
748	pro1086.exe

description	pid	process
Token: SeDebugPrivilege	748	pro1086.exe
Token: SeDebugPrivilege	2652	qu2167.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exeun920226.exequ2167.exe

description	pid	process	target process
PID 4520 wrote to memory of 3868	4520	ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe	un920226.exe
PID 4520 wrote to memory of 3868	4520	ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe	un920226.exe
PID 4520 wrote to memory of 3868	4520	ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe	un920226.exe
PID 3868 wrote to memory of 748	3868	un920226.exe	pro1086.exe
PID 3868 wrote to memory of 748	3868	un920226.exe	pro1086.exe
PID 3868 wrote to memory of 748	3868	un920226.exe	pro1086.exe
PID 3868 wrote to memory of 2652	3868	un920226.exe	qu2167.exe
PID 3868 wrote to memory of 2652	3868	un920226.exe	qu2167.exe
PID 3868 wrote to memory of 2652	3868	un920226.exe	qu2167.exe
PID 2652 wrote to memory of 5512	2652	qu2167.exe	1.exe
PID 2652 wrote to memory of 5512	2652	qu2167.exe	1.exe
PID 2652 wrote to memory of 5512	2652	qu2167.exe	1.exe
PID 4520 wrote to memory of 6004	4520	ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe	si050227.exe
PID 4520 wrote to memory of 6004	4520	ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe	si050227.exe
PID 4520 wrote to memory of 6004	4520	ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe	si050227.exe

C:\Users\Admin\AppData\Local\Temp\ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe
"C:\Users\Admin\AppData\Local\Temp\ea3fa9ea070ccc5017ab342ecdb0453266b6be41789202a648014f17f51e4dc8.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un920226.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un920226.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1086.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1086.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 1084
4⤵
- Program crash
PID:2624

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2167.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2167.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 1208
4⤵
- Program crash
PID:5672

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si050227.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si050227.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 748 -ip 748
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2652 -ip 2652
1⤵
PID:5588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si050227.exe

Filesize
169KB

MD5
84353a83ebce59c572045420b9101cac

SHA1
a723e41ec1acbdd054d11f89905fe28d10567cb5

SHA256
9bbce715d430a40c66e8dc26007848972bd6bd2e7fddbb88a007ced26aab7031

SHA512
6c1a36e5483eaaac55685b5316ebd6fca2b6001dcbc8383cdb6d0138a9883072a2c230c82ad5eb53f272c8d8cf8f073b42e0c84ccfe82e86831127e9841a1768

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un920226.exe

Filesize
660KB

MD5
250b9a70c3bee6969e04e2a4143614df

SHA1
09bb3e6d7bbb4406e348b27009fc541c3260c5fd

SHA256
262a7b9e8d9ef5903b20d40524d90051ae4c0d1896b492f75c577e6125b614f8

SHA512
ec5b7a91551156ce939385ad5eae5a5d5ad0d3e6850508dd9693a1ac83f682ecf1cf4459517cc15d673fe2245317c5073939fa065838cfcd045886d7ca2677bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1086.exe

Filesize
312KB

MD5
bb40eb9b580c149729faa2776fc323c2

SHA1
a23924dd01da8eaad37c2ac7b90d6c969b26dca2

SHA256
3c46466393ba0a4adb3852cc756d96092e9f4b59d56126605e32cc805a1b669c

SHA512
f6bd3d5a2e83a6a03598aa2ffc56ba4ff4049f10bdd0f5294d896777dc37fae4cba0d8e867ab366b93020648fce1e3ffdaf187fa3ece019fe62831cbc9aacfa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2167.exe

Filesize
495KB

MD5
73c0786a91ad26ced23a9d0c7e6ee8a5

SHA1
b51465f41b8f8c30fb1eea945c74e156f4d235bd

SHA256
86ff1284196009659b612677eaf87b657901fbad309956c96e1a533e3b209aaf

SHA512
32ab9779fac7fddadc90c9c1eb23a8d456c3ce28524b2712487868a555ecee994efa682514965e8bfb09de9444995bbd4dbc009292777b5cc0fd0b652e2e9fad

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/748-15-0x0000000000A40000-0x0000000000B40000-memory.dmp

Filesize
1024KB

Download
memory/748-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/748-17-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/748-18-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/748-19-0x0000000002830000-0x000000000284A000-memory.dmp

Filesize
104KB

Download
memory/748-20-0x0000000005020000-0x00000000055C4000-memory.dmp

Filesize
5.6MB

Download
memory/748-21-0x0000000002860000-0x0000000002878000-memory.dmp

Filesize
96KB

Download
memory/748-47-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-49-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-46-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-43-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-41-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-39-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-37-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-35-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-33-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-31-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-29-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-27-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-25-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-23-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-22-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/748-50-0x0000000000A40000-0x0000000000B40000-memory.dmp

Filesize
1024KB

Download
memory/748-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/748-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/748-55-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2652-61-0x00000000027C0000-0x0000000002826000-memory.dmp

Filesize
408KB

Download
memory/2652-62-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/2652-74-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-66-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-64-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-63-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-78-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-96-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-94-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-92-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-90-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-86-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-84-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-82-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-81-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-77-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-72-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-70-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-68-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-88-0x0000000005560000-0x00000000055BF000-memory.dmp

Filesize
380KB

Download
memory/2652-2143-0x0000000005750000-0x0000000005782000-memory.dmp

Filesize
200KB

Download
memory/5512-2156-0x0000000000530000-0x0000000000560000-memory.dmp

Filesize
192KB

Download
memory/5512-2157-0x0000000002820000-0x0000000002826000-memory.dmp

Filesize
24KB

Download
memory/5512-2158-0x00000000054C0000-0x0000000005AD8000-memory.dmp

Filesize
6.1MB

Download
memory/5512-2159-0x0000000004FB0000-0x00000000050BA000-memory.dmp

Filesize
1.0MB

Download
memory/5512-2160-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Filesize
72KB

Download
memory/5512-2161-0x0000000004F20000-0x0000000004F5C000-memory.dmp

Filesize
240KB

Download
memory/5512-2165-0x0000000004F60000-0x0000000004FAC000-memory.dmp

Filesize
304KB

Download
memory/6004-2167-0x0000000000600000-0x000000000062E000-memory.dmp

Filesize
184KB

Download
memory/6004-2168-0x0000000004DE0000-0x0000000004DE6000-memory.dmp

Filesize
24KB

Download