healer | 822cb7b6fc534626018354dc2f11707c6c5f80dc886a5969a8071a8c2d0259b9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb.exe
Size

1.0MB
MD5

f6e3aa012f0f42e0504ba0c5699eb95b
SHA1

c388ba51516a7ada32a035997a30ca2b0e64a453
SHA256

234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb
SHA512

44c3e644262c94521ddc4f72e6922ea4d3e890c88d8aa5870a100a4f528450ce53db40b7a8ea446dea6a23900bd9b337d85112ab3ab8557910958a332fd58ba3
SSDEEP

24576:HySYMy815XptL4iO/T4cjJ0gcXHEmfgLZwbr+A4KlLd1:SNwZptL4ZFj2gc0Pwm1E

Score

10^/10

healer redline droz norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

77.91.124.145:4125

Attributes

auth_value
d099adf6dbf6ccb8e16967104280634a

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4356-25-0x0000000002460000-0x000000000247A000-memory.dmp	healer
behavioral1/memory/4356-27-0x0000000004A40000-0x0000000004A58000-memory.dmp	healer
behavioral1/memory/4356-28-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-52-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-55-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-54-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-49-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-47-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-45-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-43-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-41-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-39-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-37-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-35-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-33-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-31-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/4356-29-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr971896.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr971896.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr971896.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr971896.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr971896.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr971896.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/5084-2149-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
behavioral1/files/0x0013000000023a64-2154.dat	family_redline
behavioral1/memory/4160-2162-0x0000000000770000-0x00000000007A0000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b7f-2170.dat	family_redline
behavioral1/memory/4628-2173-0x00000000003A0000-0x00000000003CE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	qu779639.exe

Executes dropped EXE 6 IoCs

pid	Process
2100	un543209.exe
2720	un926973.exe
4356	pr971896.exe
5084	qu779639.exe
4160	1.exe
4628	rk710539.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr971896.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr971896.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un543209.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un926973.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2108	4356	WerFault.exe	88
5516	5084	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rk710539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un543209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un926973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr971896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu779639.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4356	pr971896.exe
4356	pr971896.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	pr971896.exe
Token: SeDebugPrivilege	5084	qu779639.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2100	2888	234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb.exe	83
PID 2888 wrote to memory of 2100	2888	234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb.exe	83
PID 2888 wrote to memory of 2100	2888	234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb.exe	83
PID 2100 wrote to memory of 2720	2100	un543209.exe	86
PID 2100 wrote to memory of 2720	2100	un543209.exe	86
PID 2100 wrote to memory of 2720	2100	un543209.exe	86
PID 2720 wrote to memory of 4356	2720	un926973.exe	88
PID 2720 wrote to memory of 4356	2720	un926973.exe	88
PID 2720 wrote to memory of 4356	2720	un926973.exe	88
PID 2720 wrote to memory of 5084	2720	un926973.exe	100
PID 2720 wrote to memory of 5084	2720	un926973.exe	100
PID 2720 wrote to memory of 5084	2720	un926973.exe	100
PID 5084 wrote to memory of 4160	5084	qu779639.exe	101
PID 5084 wrote to memory of 4160	5084	qu779639.exe	101
PID 5084 wrote to memory of 4160	5084	qu779639.exe	101
PID 2100 wrote to memory of 4628	2100	un543209.exe	104
PID 2100 wrote to memory of 4628	2100	un543209.exe	104
PID 2100 wrote to memory of 4628	2100	un543209.exe	104

C:\Users\Admin\AppData\Local\Temp\234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb.exe
"C:\Users\Admin\AppData\Local\Temp\234e9e282e7f2ad1cbbc5ffc2aa67267eb2d5eaf34542df1f7f891fab36aedfb.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un543209.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un543209.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un926973.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un926973.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr971896.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr971896.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 1100
        5⤵
        Program crash
        
        PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu779639.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu779639.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1548
        5⤵
        Program crash
        
        PID:5516
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk710539.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk710539.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4356 -ip 4356
1⤵
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5084 -ip 5084
1⤵
PID:5412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un543209.exe

Filesize
798KB

MD5
270822d1b3a8ce3229dc55632f45978a

SHA1
1a6fc5b9d9e551ccb57e717eae48ba5d9d06531c

SHA256
3fdfbfeb4f17864d69ae38d88535449c90722f08146551b8ef38cdf9d7eb3cb6

SHA512
3f7586af13b0c380423414a8a754956bd6e777a88cc7effd2c66972fb1a7bf985f8f0ec310fe37d0f5c37fa6a9e49b208b5268e5f159a3f6458584b62ccf5513

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk710539.exe

Filesize
169KB

MD5
d55ac2e65a265037becf8894bac69b3e

SHA1
e25303f4af593d05aacebab18e16169b2a8b1d6e

SHA256
a877f78f54adbc7a3ae82ae4edcd107f92eb9f40cf082d79528ac9efd07fc890

SHA512
7968148c5606ed07e3ea9878868b9f474b407245c5dfa2fa8158dce5683befad836015cd9e0a12b6a7a21fda1db4fcc0a99680d2d54248e840fb2a7aa36fed0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un926973.exe

Filesize
644KB

MD5
a422f4854ad234982193490b870c5a37

SHA1
9794829264c0a1ddbaa03341dd7c24b0130a2aaa

SHA256
b9766333d629e962542a4b6f386ab6c745d7801c54a086c30cbd1ea8fea2b8d9

SHA512
99cd617a179679200aa8922667bcc8f3c56e1b1fc3b0ef8acfaf691416040fbd7d92fefea0ed128c702b2e571501b1c25bfaf8630d28fc3cc1514edbfd16142e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr971896.exe

Filesize
243KB

MD5
02ad61a70979c76f96373b9bd63691ae

SHA1
a350fbe51d6ea91eeb0f5f9210866298f99fca74

SHA256
b45f4d6691bbd4f4908c5e179ebee1ab92b14f98d331dfd1217e69b6311a9326

SHA512
082e0c18d8608aa040ecb182e10ad835e7522155488d1a823585f7c214f2bbce09f78801b2c261d5dc56915e67fb7775228e728ac06d99e1fbbf8906537f1ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu779639.exe

Filesize
426KB

MD5
94d16dd22e6eaaa7822dd1e7756469a6

SHA1
6d207d658fcae4ec2026947da4822214d7f74872

SHA256
12471ed3ffd0c6575632b6df7be4b94841c1e324417437bc4ec8b7295e27ff83

SHA512
70048766a38b9697e2cb0c3b7c7a4628807462d7350d788e78afa1559c5fae72f03b7b482a885bf5741c832185b24408045050696376bd6942152c415962ea3e

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/4160-2166-0x00000000050F0000-0x0000000005102000-memory.dmp

Filesize
72KB

Download
memory/4160-2165-0x00000000051D0000-0x00000000052DA000-memory.dmp

Filesize
1.0MB

Download
memory/4160-2164-0x00000000056E0000-0x0000000005CF8000-memory.dmp

Filesize
6.1MB

Download
memory/4160-2163-0x0000000005050000-0x0000000005056000-memory.dmp

Filesize
24KB

Download
memory/4160-2162-0x0000000000770000-0x00000000007A0000-memory.dmp

Filesize
192KB

Download
memory/4160-2168-0x0000000005150000-0x000000000518C000-memory.dmp

Filesize
240KB

Download
memory/4160-2172-0x00000000052E0000-0x000000000532C000-memory.dmp

Filesize
304KB

Download
memory/4356-61-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4356-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4356-45-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-43-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-41-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-39-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-37-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-35-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-33-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-31-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-29-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-56-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/4356-57-0x00000000004B0000-0x00000000004DD000-memory.dmp

Filesize
180KB

Download
memory/4356-58-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4356-59-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4356-55-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-49-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-54-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-52-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-28-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-22-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/4356-24-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4356-23-0x00000000004B0000-0x00000000004DD000-memory.dmp

Filesize
180KB

Download
memory/4356-25-0x0000000002460000-0x000000000247A000-memory.dmp

Filesize
104KB

Download
memory/4356-26-0x0000000004B70000-0x0000000005114000-memory.dmp

Filesize
5.6MB

Download
memory/4356-47-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/4356-27-0x0000000004A40000-0x0000000004A58000-memory.dmp

Filesize
96KB

Download
memory/4628-2173-0x00000000003A0000-0x00000000003CE000-memory.dmp

Filesize
184KB

Download
memory/4628-2174-0x0000000000A50000-0x0000000000A56000-memory.dmp

Filesize
24KB

Download
memory/5084-96-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-82-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-80-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-78-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-76-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-74-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-90-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-70-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-69-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-2149-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download
memory/5084-84-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-88-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-92-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-94-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-98-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-100-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-102-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-86-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-72-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/5084-68-0x00000000051C0000-0x0000000005226000-memory.dmp

Filesize
408KB

Download
memory/5084-67-0x0000000004950000-0x00000000049B6000-memory.dmp

Filesize
408KB

Download