healer | b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0

Analysis

max time kernel
140s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe
Size

787KB
MD5

2dcfe632497ed95262f1dd9d16b9949f
SHA1

6ac4e2d16a913ef2f8b33603474c003d66183f9f
SHA256

b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0
SHA512

e2ba87aad9eb29e3621ed50667a52630f9327d0a2d197d7df6ce830929bcb5e98ba2e72972cf5835d1205bc175b7cecbe0e048d1aa93c4d26e04b518be86ecb8
SSDEEP

24576:QyKiXSmhUXqvGJexjIeJl37sPl4KZfCH:XK2S3aOK1rOlnZfC

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3960-19-0x0000000002050000-0x000000000206A000-memory.dmp	healer
behavioral1/memory/3960-21-0x0000000002440000-0x0000000002458000-memory.dmp	healer
behavioral1/memory/3960-23-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-47-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-49-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-45-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-43-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-41-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-39-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-37-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-35-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-33-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-31-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-29-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-27-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-25-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/3960-22-0x0000000002440000-0x0000000002452000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro7434.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro7434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro7434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro7434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro7434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro7434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro7434.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4864-2143-0x0000000005410000-0x0000000005442000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/1192-2156-0x0000000000960000-0x0000000000990000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si113120.exe	family_redline
behavioral1/memory/1972-2163-0x0000000000D80000-0x0000000000DAE000-memory.dmp	family_redline

Redline family
redline
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

qu6390.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation qu6390.exe
Executes dropped EXE 5 IoCs

Processes:

un655120.exepro7434.exequ6390.exe1.exesi113120.exe

pid process

400 un655120.exe
3960 pro7434.exe
4864 qu6390.exe
1192 1.exe
1972 si113120.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	qu6390.exe

pid	process
400	un655120.exe
3960	pro7434.exe
4864	qu6390.exe
1192	1.exe
1972	si113120.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro7434.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro7434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro7434.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exeun655120.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un655120.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4228 3960 WerFault.exe pro7434.exe
4964 4864 WerFault.exe qu6390.exe

pid	pid_target	process	target process
4228	3960	WerFault.exe	pro7434.exe
4964	4864	WerFault.exe	qu6390.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exeun655120.exepro7434.exequ6390.exe1.exesi113120.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un655120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro7434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu6390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si113120.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro7434.exe

pid process

3960 pro7434.exe
3960 pro7434.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro7434.exequ6390.exe

description pid process

Token: SeDebugPrivilege 3960 pro7434.exe
Token: SeDebugPrivilege 4864 qu6390.exe

pid	process
3960	pro7434.exe
3960	pro7434.exe

description	pid	process
Token: SeDebugPrivilege	3960	pro7434.exe
Token: SeDebugPrivilege	4864	qu6390.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exeun655120.exequ6390.exe

description	pid	process	target process
PID 2744 wrote to memory of 400	2744	b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe	un655120.exe
PID 2744 wrote to memory of 400	2744	b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe	un655120.exe
PID 2744 wrote to memory of 400	2744	b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe	un655120.exe
PID 400 wrote to memory of 3960	400	un655120.exe	pro7434.exe
PID 400 wrote to memory of 3960	400	un655120.exe	pro7434.exe
PID 400 wrote to memory of 3960	400	un655120.exe	pro7434.exe
PID 400 wrote to memory of 4864	400	un655120.exe	qu6390.exe
PID 400 wrote to memory of 4864	400	un655120.exe	qu6390.exe
PID 400 wrote to memory of 4864	400	un655120.exe	qu6390.exe
PID 4864 wrote to memory of 1192	4864	qu6390.exe	1.exe
PID 4864 wrote to memory of 1192	4864	qu6390.exe	1.exe
PID 4864 wrote to memory of 1192	4864	qu6390.exe	1.exe
PID 2744 wrote to memory of 1972	2744	b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe	si113120.exe
PID 2744 wrote to memory of 1972	2744	b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe	si113120.exe
PID 2744 wrote to memory of 1972	2744	b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe	si113120.exe

C:\Users\Admin\AppData\Local\Temp\b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe
"C:\Users\Admin\AppData\Local\Temp\b013b69f16586d5079eff9059ec0ff6929642b01fbe5038317eefec707e956a0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un655120.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un655120.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7434.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7434.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1080
4⤵
- Program crash
PID:4228

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6390.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6390.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1384
4⤵
- Program crash
PID:4964

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si113120.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si113120.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3960 -ip 3960
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4864 -ip 4864
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si113120.exe

Filesize
168KB

MD5
94df30a983b22af7e87d537b8ad94af3

SHA1
b2e750829b02cb3924f43d0fc7836f3d54b9f47d

SHA256
e0ba07b5170d110c3870b5efb91ebe3ea4dae6986be272a21057a679dfbf2bf1

SHA512
ea8d28c6500ff71d4e7db2f65b510b6b97fee160c0a8d1172903defe78168e260eea2a286a50b36f78846f16b130f6806c68cc5231190ee682197bcb249bb73e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un655120.exe

Filesize
633KB

MD5
adda3196a503fa54bf4ced5d1c6d2845

SHA1
00001792c865a919d0a3c497f5ccd7a83691b44b

SHA256
cda22c9ffd354c9854e905d4a90944880cd40ef7395962db065d781535ef5d16

SHA512
665b485662c900791a523b8b132ba1ed6729e5777517fe7a17e4465cc2f6abf5fed8db8ebbed4bfccbd8f3504057c89963fd9176ce056b766f55ed075d901a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7434.exe

Filesize
230KB

MD5
6f286ab41ad5a863bd221fb5a6e7b5ba

SHA1
a64224e2b341247d2443c2a2e619d6a01ea60ad8

SHA256
32a5b7112d160f941d868f4d6fc584f5bcbd153beb6f0cc54fad2b1ee609c4ae

SHA512
9758c06115698c0dd8c242fa784ce774dbee34c70ab26421363dcc064288fe311f450d937bc53e5126c7275b46637817cb6dcdc9a5949cd42254a5ba58cf0b53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6390.exe

Filesize
414KB

MD5
14f0577c272519b8d4930f5f18e50642

SHA1
b84c25092b1874f7940fbe01a82d06f13ab145df

SHA256
ec1bf79e8146d06e8499e45ced8c36ff81461330b2106f39aa2172f96c046d00

SHA512
b35cb5625d78c604291f40c2eb4bc93ea8022d1f98db2ab59c8dba4a2ebcee9ea0e588aa559750083834eda4741fa0968786762d7e2a2e8e52febf3edbe89cfc

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1192-2156-0x0000000000960000-0x0000000000990000-memory.dmp

Filesize
192KB

Download
memory/1192-2157-0x00000000029D0000-0x00000000029D6000-memory.dmp

Filesize
24KB

Download
memory/1192-2169-0x0000000005390000-0x00000000053DC000-memory.dmp

Filesize
304KB

Download
memory/1192-2168-0x0000000005340000-0x000000000537C000-memory.dmp

Filesize
240KB

Download
memory/1192-2167-0x00000000051D0000-0x00000000051E2000-memory.dmp

Filesize
72KB

Download
memory/1192-2166-0x0000000005450000-0x000000000555A000-memory.dmp

Filesize
1.0MB

Download
memory/1972-2165-0x0000000005D10000-0x0000000006328000-memory.dmp

Filesize
6.1MB

Download
memory/1972-2164-0x0000000003030000-0x0000000003036000-memory.dmp

Filesize
24KB

Download
memory/1972-2163-0x0000000000D80000-0x0000000000DAE000-memory.dmp

Filesize
184KB

Download
memory/3960-51-0x00000000005E0000-0x000000000060D000-memory.dmp

Filesize
180KB

Download
memory/3960-25-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-49-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-45-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-43-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-41-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-39-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-37-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-35-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-33-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-31-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-29-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-27-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-21-0x0000000002440000-0x0000000002458000-memory.dmp

Filesize
96KB

Download
memory/3960-22-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-50-0x00000000004E0000-0x00000000005E0000-memory.dmp

Filesize
1024KB

Download
memory/3960-23-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3960-55-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3960-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3960-15-0x00000000004E0000-0x00000000005E0000-memory.dmp

Filesize
1024KB

Download
memory/3960-16-0x00000000005E0000-0x000000000060D000-memory.dmp

Filesize
180KB

Download
memory/3960-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3960-47-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/3960-18-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3960-19-0x0000000002050000-0x000000000206A000-memory.dmp

Filesize
104KB

Download
memory/3960-20-0x0000000004B10000-0x00000000050B4000-memory.dmp

Filesize
5.6MB

Download
memory/4864-66-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-84-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-96-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-94-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-92-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-90-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-88-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-86-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-82-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-80-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-64-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-72-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-68-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-70-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-63-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-62-0x0000000004AF0000-0x0000000004B56000-memory.dmp

Filesize
408KB

Download
memory/4864-61-0x0000000002410000-0x0000000002476000-memory.dmp

Filesize
408KB

Download
memory/4864-78-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-76-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-74-0x0000000004AF0000-0x0000000004B4F000-memory.dmp

Filesize
380KB

Download
memory/4864-2143-0x0000000005410000-0x0000000005442000-memory.dmp

Filesize
200KB

Download