healer | 205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe
Size

789KB
MD5

3c2cafe185b4c1705d615cea7dc63b8e
SHA1

173991f26733b3cf2cfb6f5353d96fc35bb8c131
SHA256

205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435
SHA512

39fb0b72cb5685363de5aa997dc80a2deab2b80fa16bd765853e93838109ad9f4adf59ccc24d4768e5ad9242b6dbb9ee4b3ae2f49cad3a7ef92fbaeb5ed433fb
SSDEEP

12288:GMrRy90J44+RrmnluTuGWPwsL09yIUyG5IRTBAEDietQ7PstqV1MmhemmmkefEs3:jyS44+RrmlutExqlGsqP2LifRdEW

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2908-19-0x00000000023B0000-0x00000000023CA000-memory.dmp	healer
behavioral1/memory/2908-21-0x00000000024A0000-0x00000000024B8000-memory.dmp	healer
behavioral1/memory/2908-22-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-49-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-47-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-45-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-43-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-41-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-40-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-37-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-35-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-33-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-31-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-29-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-27-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-25-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer
behavioral1/memory/2908-23-0x00000000024A0000-0x00000000024B2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro9868.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro9868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro9868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro9868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro9868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro9868.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro9868.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5004-2142-0x0000000005410000-0x0000000005442000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/4876-2155-0x0000000000350000-0x0000000000380000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si445823.exe	family_redline
behavioral1/memory/712-2166-0x00000000001B0000-0x00000000001DE000-memory.dmp	family_redline

Redline family
redline
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

qu2916.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation qu2916.exe
Executes dropped EXE 5 IoCs

Processes:

un518391.exepro9868.exequ2916.exe1.exesi445823.exe

pid process

2732 un518391.exe
2908 pro9868.exe
5004 qu2916.exe
4876 1.exe
712 si445823.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	qu2916.exe

pid	process
2732	un518391.exe
2908	pro9868.exe
5004	qu2916.exe
4876	1.exe
712	si445823.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro9868.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro9868.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro9868.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exeun518391.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un518391.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4788 2908 WerFault.exe pro9868.exe
5448 5004 WerFault.exe qu2916.exe

pid	pid_target	process	target process
4788	2908	WerFault.exe	pro9868.exe
5448	5004	WerFault.exe	qu2916.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1.exesi445823.exe205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exeun518391.exepro9868.exequ2916.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si445823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un518391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro9868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu2916.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro9868.exe

pid process

2908 pro9868.exe
2908 pro9868.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro9868.exequ2916.exe

description pid process

Token: SeDebugPrivilege 2908 pro9868.exe
Token: SeDebugPrivilege 5004 qu2916.exe

pid	process
2908	pro9868.exe
2908	pro9868.exe

description	pid	process
Token: SeDebugPrivilege	2908	pro9868.exe
Token: SeDebugPrivilege	5004	qu2916.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exeun518391.exequ2916.exe

description	pid	process	target process
PID 1556 wrote to memory of 2732	1556	205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe	un518391.exe
PID 1556 wrote to memory of 2732	1556	205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe	un518391.exe
PID 1556 wrote to memory of 2732	1556	205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe	un518391.exe
PID 2732 wrote to memory of 2908	2732	un518391.exe	pro9868.exe
PID 2732 wrote to memory of 2908	2732	un518391.exe	pro9868.exe
PID 2732 wrote to memory of 2908	2732	un518391.exe	pro9868.exe
PID 2732 wrote to memory of 5004	2732	un518391.exe	qu2916.exe
PID 2732 wrote to memory of 5004	2732	un518391.exe	qu2916.exe
PID 2732 wrote to memory of 5004	2732	un518391.exe	qu2916.exe
PID 5004 wrote to memory of 4876	5004	qu2916.exe	1.exe
PID 5004 wrote to memory of 4876	5004	qu2916.exe	1.exe
PID 5004 wrote to memory of 4876	5004	qu2916.exe	1.exe
PID 1556 wrote to memory of 712	1556	205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe	si445823.exe
PID 1556 wrote to memory of 712	1556	205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe	si445823.exe
PID 1556 wrote to memory of 712	1556	205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe	si445823.exe

C:\Users\Admin\AppData\Local\Temp\205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe
"C:\Users\Admin\AppData\Local\Temp\205bc722302aa316b8230cd2e44f4a3e8814b7053ec86d201a3a2308ac5ec435.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un518391.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un518391.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9868.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9868.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 1080
4⤵
- Program crash
PID:4788

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2916.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2916.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 1196
4⤵
- Program crash
PID:5448

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si445823.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si445823.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2908 -ip 2908
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5004 -ip 5004
1⤵
PID:5384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si445823.exe

Filesize
169KB

MD5
b873b049af6910e5e1403e727aceaea7

SHA1
7f8fbe8a8c0b13f5bee0d0476172d6b5ac7f884c

SHA256
e33af94d213c2ce1eb8f2b2a2c9901a34e7c6909e7f8f380e2216df4657f2a3f

SHA512
bf93c145c1593d1ac9618f1a5ac359868657264017b265bb4534fdcb40e73e9952bd0911d53ddbf98e7a5d6408e0737cdf1af211c0ccfc11e58c1ca92e31866c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un518391.exe

Filesize
635KB

MD5
e7869f8ccc5a1497da610788920d2791

SHA1
a95003399833053f09073c7888962aadd5a516fa

SHA256
084a095b575de1849540b4ac995eeae59ec85a83c97164e1fb2aa62df6396385

SHA512
0645bf54abfdf953559a94c9cd21741057d30cc59602bade49c37eb9c05fef366ae7d0bb962abb80f4d0b4f785e63f30760d6085336cb6883b1e5f56a3b804a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9868.exe

Filesize
233KB

MD5
31364ef71f81942502b08be68a6bd8b2

SHA1
1cbac96da196b5777c5acc745a102515469dde4a

SHA256
54e8fa7791fbb2e1127ee71217fb505d616cdabe80338d8ac91fc1f0d2bc070d

SHA512
08c1c061d968ce8fc4ba0b34f7e8399dec58c3ca0414bb0de8a991b7e2f841306f9cca373adb91f06c7ab77c9a06205d08d05e4a69365f06b8e0570c705b0d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2916.exe

Filesize
417KB

MD5
9d10ce738a8e8ee015e3faf32768400f

SHA1
2730619a3789e591c61fa8cde4e7075ea3ef6b94

SHA256
b57ee32f2837b2d973fe354c269f4af2314b0908e62072940d173a3adc23bd1c

SHA512
5dc19318708c6c2b7113b2540795df562264c34e6f7633b92b76a5358197d8a82a0c1e6a6aad18eb72fb13b98c089ece17a56d84b4f25de631c275841e142bea

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/712-2166-0x00000000001B0000-0x00000000001DE000-memory.dmp

Filesize
184KB

Download
memory/712-2167-0x0000000004990000-0x0000000004996000-memory.dmp

Filesize
24KB

Download
memory/2908-41-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-33-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-20-0x0000000004BB0000-0x0000000005154000-memory.dmp

Filesize
5.6MB

Download
memory/2908-21-0x00000000024A0000-0x00000000024B8000-memory.dmp

Filesize
96KB

Download
memory/2908-22-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-49-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-47-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-45-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-43-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-18-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2908-40-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-37-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-35-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-19-0x00000000023B0000-0x00000000023CA000-memory.dmp

Filesize
104KB

Download
memory/2908-31-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-29-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-27-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-25-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-23-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/2908-50-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/2908-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2908-54-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2908-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2908-17-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2908-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2908-15-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/4876-2155-0x0000000000350000-0x0000000000380000-memory.dmp

Filesize
192KB

Download
memory/4876-2158-0x0000000004DC0000-0x0000000004ECA000-memory.dmp

Filesize
1.0MB

Download
memory/4876-2156-0x0000000004C30000-0x0000000004C36000-memory.dmp

Filesize
24KB

Download
memory/4876-2157-0x00000000052D0000-0x00000000058E8000-memory.dmp

Filesize
6.1MB

Download
memory/4876-2162-0x0000000004ED0000-0x0000000004F1C000-memory.dmp

Filesize
304KB

Download
memory/4876-2160-0x0000000004D30000-0x0000000004D6C000-memory.dmp

Filesize
240KB

Download
memory/4876-2159-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

Filesize
72KB

Download
memory/5004-85-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-87-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-82-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-79-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-77-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-75-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-73-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-69-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-67-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-65-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-61-0x0000000002730000-0x0000000002796000-memory.dmp

Filesize
408KB

Download
memory/5004-83-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-89-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-91-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-60-0x00000000026C0000-0x0000000002726000-memory.dmp

Filesize
408KB

Download
memory/5004-93-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-71-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-63-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-95-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-62-0x0000000002730000-0x000000000278F000-memory.dmp

Filesize
380KB

Download
memory/5004-2142-0x0000000005410000-0x0000000005442000-memory.dmp

Filesize
200KB

Download