healer | 1776d87de1e6338489fcba5b05e66955ddbaf19aa928b5c2d9f35494929cf1f7

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a8241ce1fa590e8003538c5bd2224a315521b27bb8c8e855ad94218848f7826.exe
Size

1.0MB
MD5

ec78aa127149b0ef564b411a9938aa58
SHA1

5397782fa440e0136c4b8833a181ba155a32972a
SHA256

4a8241ce1fa590e8003538c5bd2224a315521b27bb8c8e855ad94218848f7826
SHA512

58067d652c5861093a32f0a4e8eb23a71d551a080cdccc9410da952c25326f1183b0108cb0291c6e7756e239154b005c773cefbbe3ca12f298cc74f263cb6313
SSDEEP

24576:4ydiX50I1gU453Ei1aruhaeieAo/TCyJN2Ot2r6cEbHb0KK:/dSp450i1aiEe/IW3Tb

Score

10^/10

healer redline droz norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

77.91.124.145:4125

Attributes

auth_value
d099adf6dbf6ccb8e16967104280634a

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3420-25-0x0000000002230000-0x000000000224A000-memory.dmp	healer
behavioral1/memory/3420-27-0x0000000004A50000-0x0000000004A68000-memory.dmp	healer
behavioral1/memory/3420-55-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-53-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-51-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-49-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-47-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-45-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-43-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-41-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-39-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-37-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-35-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-33-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-31-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-29-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3420-28-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr385051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr385051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr385051.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr385051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr385051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr385051.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/4796-2149-0x0000000005410000-0x0000000005442000-memory.dmp	family_redline
behavioral1/files/0x000b000000023c6e-2154.dat	family_redline
behavioral1/memory/3976-2162-0x0000000000590000-0x00000000005C0000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c69-2170.dat	family_redline
behavioral1/memory/2072-2173-0x00000000000C0000-0x00000000000EE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	qu027249.exe

Executes dropped EXE 6 IoCs

pid	Process
620	un870415.exe
3652	un075053.exe
3420	pr385051.exe
4796	qu027249.exe
3976	1.exe
2072	rk411921.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr385051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr385051.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4a8241ce1fa590e8003538c5bd2224a315521b27bb8c8e855ad94218848f7826.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un870415.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un075053.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3176	3420	WerFault.exe	86
2640	4796	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a8241ce1fa590e8003538c5bd2224a315521b27bb8c8e855ad94218848f7826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un870415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un075053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr385051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu027249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rk411921.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3420	pr385051.exe
3420	pr385051.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	pr385051.exe
Token: SeDebugPrivilege	4796	qu027249.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 620	2452	4a8241ce1fa590e8003538c5bd2224a315521b27bb8c8e855ad94218848f7826.exe	83
PID 2452 wrote to memory of 620	2452	4a8241ce1fa590e8003538c5bd2224a315521b27bb8c8e855ad94218848f7826.exe	83
PID 2452 wrote to memory of 620	2452	4a8241ce1fa590e8003538c5bd2224a315521b27bb8c8e855ad94218848f7826.exe	83
PID 620 wrote to memory of 3652	620	un870415.exe	85
PID 620 wrote to memory of 3652	620	un870415.exe	85
PID 620 wrote to memory of 3652	620	un870415.exe	85
PID 3652 wrote to memory of 3420	3652	un075053.exe	86
PID 3652 wrote to memory of 3420	3652	un075053.exe	86
PID 3652 wrote to memory of 3420	3652	un075053.exe	86
PID 3652 wrote to memory of 4796	3652	un075053.exe	100
PID 3652 wrote to memory of 4796	3652	un075053.exe	100
PID 3652 wrote to memory of 4796	3652	un075053.exe	100
PID 4796 wrote to memory of 3976	4796	qu027249.exe	101
PID 4796 wrote to memory of 3976	4796	qu027249.exe	101
PID 4796 wrote to memory of 3976	4796	qu027249.exe	101
PID 620 wrote to memory of 2072	620	un870415.exe	104
PID 620 wrote to memory of 2072	620	un870415.exe	104
PID 620 wrote to memory of 2072	620	un870415.exe	104

C:\Users\Admin\AppData\Local\Temp\4a8241ce1fa590e8003538c5bd2224a315521b27bb8c8e855ad94218848f7826.exe
"C:\Users\Admin\AppData\Local\Temp\4a8241ce1fa590e8003538c5bd2224a315521b27bb8c8e855ad94218848f7826.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un870415.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un870415.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un075053.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un075053.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr385051.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr385051.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 1112
        5⤵
        Program crash
        
        PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu027249.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu027249.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 236
        5⤵
        Program crash
        
        PID:2640
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk411921.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk411921.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3420 -ip 3420
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4796 -ip 4796
1⤵
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un870415.exe

Filesize
798KB

MD5
b5000f9d49562d14f076b806848b394c

SHA1
8850ac3ce26503332ecc1900b727fcf7e298c20a

SHA256
c2217217444b24bd7a8c5c9cc64a6fd0b4971b7b3a1fd74bf5b2523080009337

SHA512
3b01a4e956954044f549c44b04bcbfafbdcf9dc7761a6d62c978cc296ce5e107e7d5995c8a2470f36f770172b63f809b6670c2548444c66c54184a922076600d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk411921.exe

Filesize
169KB

MD5
54b7706beab325860ee03ca889eee748

SHA1
89c226cc0465a4c3fc3d7d78860be13f152874f2

SHA256
e56d1573030c26d6817d750e1a7479bc083e1dab8ca3e1f45744e2bf4db5ece6

SHA512
634e2a7a74c199aa5236d3cd41eaecfab8633215b0f7768c877166df2de2283828b0f8458140064752fc0364051c4de51715428e0f423a2214192143f85f97fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un075053.exe

Filesize
644KB

MD5
e4e46742aedebdfebd0b339cc5828740

SHA1
07a862f1efa512ed94deb6d55b1e870e4a9e0191

SHA256
46e489ee6c9fada1a3f176b14e78b43569bdac49321cd30c6550da262be08d48

SHA512
49074dac2988a50d768b3b83464bcffb6dc1b07bb27c9342eb168c72abde757186e8cc12ee2f3235a7f4cbe7b467c25e201a17335dfdec1c623173f07b2c2f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr385051.exe

Filesize
243KB

MD5
fee66c939430dc7901ff5f4c0aa0d079

SHA1
670d534085e2abe0dd62ec320bfd7f56742594d5

SHA256
35e62211387387b2718e838b25f9891373557ff23a35ff8850b2889251a3156d

SHA512
71d63e9972f5329609ebf586c307200e3614214ba45d29b36cab1ff5f1cdd497b74a41abce0186b2b27becc5bb2c770c84b86f88e70e2486f41bace358bb8590

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu027249.exe

Filesize
426KB

MD5
b0c78763d2de32184b155fac23ce8253

SHA1
2ffdc35d972dc52d44f54f5bc67082f0d987cea4

SHA256
1fbb373eae5105ee6d407ec8bb88e79227c8e8f5677583ae11447c05c3d78274

SHA512
528c2a4bf44174276244a8dca55b6890ecba0314812e02c5be17ff4deba885a5d0aef467d6a907cef07df07daabd3826e689aa686cd659abfb269da35e1d9373

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/2072-2174-0x00000000048A0000-0x00000000048A6000-memory.dmp

Filesize
24KB

Download
memory/2072-2173-0x00000000000C0000-0x00000000000EE000-memory.dmp

Filesize
184KB

Download
memory/3420-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3420-57-0x00000000004C0000-0x00000000004ED000-memory.dmp

Filesize
180KB

Download
memory/3420-53-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-51-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-49-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-47-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-45-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-43-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-41-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-39-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-37-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-35-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-33-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-31-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-29-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-28-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-56-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/3420-25-0x0000000002230000-0x000000000224A000-memory.dmp

Filesize
104KB

Download
memory/3420-58-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3420-59-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3420-61-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3420-27-0x0000000004A50000-0x0000000004A68000-memory.dmp

Filesize
96KB

Download
memory/3420-26-0x0000000004B90000-0x0000000005134000-memory.dmp

Filesize
5.6MB

Download
memory/3420-22-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/3420-24-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3420-55-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3420-23-0x00000000004C0000-0x00000000004ED000-memory.dmp

Filesize
180KB

Download
memory/3976-2172-0x00000000050F0000-0x000000000513C000-memory.dmp

Filesize
304KB

Download
memory/3976-2167-0x0000000004F70000-0x0000000004FAC000-memory.dmp

Filesize
240KB

Download
memory/3976-2166-0x0000000004F10000-0x0000000004F22000-memory.dmp

Filesize
72KB

Download
memory/3976-2165-0x0000000004FE0000-0x00000000050EA000-memory.dmp

Filesize
1.0MB

Download
memory/3976-2164-0x00000000054E0000-0x0000000005AF8000-memory.dmp

Filesize
6.1MB

Download
memory/3976-2163-0x0000000004E70000-0x0000000004E76000-memory.dmp

Filesize
24KB

Download
memory/3976-2162-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/4796-102-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-82-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-80-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-78-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-76-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-74-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-72-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-70-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-69-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-2149-0x0000000005410000-0x0000000005442000-memory.dmp

Filesize
200KB

Download
memory/4796-84-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-90-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-92-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-94-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-96-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-98-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-100-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-88-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-86-0x0000000004B60000-0x0000000004BBF000-memory.dmp

Filesize
380KB

Download
memory/4796-68-0x0000000004B60000-0x0000000004BC6000-memory.dmp

Filesize
408KB

Download
memory/4796-67-0x0000000002670000-0x00000000026D6000-memory.dmp

Filesize
408KB

Download