healer | 1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f.exe
Size

850KB
MD5

870d4f786a2d4ecb91bb189f85e3b47a
SHA1

c4ad44a4d8de842ad08e673a7debeb2c26f88642
SHA256

1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f
SHA512

0083aa2d52f05bca67c347f0a0d0c255e1accb0a20c06fa0ba66dfac1dca73fd43161d00c723280a1c686b66e6377e60a67014704423b909723e3014dd3006c8
SSDEEP

12288:eMrCy90AhLemA4Tf7lW+khHE2sMdEX5WsBVkdIMYpehXr52ZR7+SUiL1JT0RWUL:4yXrEHE2sMEX0kkdupeDU7aW+

Score

10^/10

healer redline gena discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c9b-19.dat	healer
behavioral1/memory/1800-22-0x0000000000680000-0x000000000068A000-memory.dmp	healer
behavioral1/memory/1636-29-0x00000000048C0000-0x00000000048DA000-memory.dmp	healer
behavioral1/memory/1636-31-0x0000000007650000-0x0000000007668000-memory.dmp	healer
behavioral1/memory/1636-32-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-41-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-57-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-55-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-53-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-51-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-50-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-47-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-45-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-43-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-39-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-37-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-35-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-33-0x0000000007650000-0x0000000007662000-memory.dmp	healer
behavioral1/memory/1636-59-0x0000000007650000-0x0000000007662000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h68MS65.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h68MS65.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h68MS65.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f0324uV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f0324uV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	h68MS65.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f0324uV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h68MS65.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h68MS65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	f0324uV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	f0324uV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	f0324uV.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4888-67-0x00000000048E0000-0x0000000004926000-memory.dmp	family_redline
behavioral1/memory/4888-68-0x0000000004BB0000-0x0000000004BF4000-memory.dmp	family_redline
behavioral1/memory/4888-102-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-100-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-98-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-96-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-94-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-92-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-90-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-88-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-86-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-84-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-82-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-78-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-76-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-74-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-72-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-80-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-70-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline
behavioral1/memory/4888-69-0x0000000004BB0000-0x0000000004BEE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
4836	niba9480.exe
2424	niba3098.exe
1800	f0324uV.exe
1636	h68MS65.exe
4888	iwstf31.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	f0324uV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	h68MS65.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	h68MS65.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	niba9480.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	niba3098.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2384	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iwstf31.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	niba9480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	niba3098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	h68MS65.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1800	f0324uV.exe
1800	f0324uV.exe
1636	h68MS65.exe
1636	h68MS65.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	f0324uV.exe
Token: SeDebugPrivilege	1636	h68MS65.exe
Token: SeDebugPrivilege	4888	iwstf31.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4836	3568	1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f.exe	84
PID 3568 wrote to memory of 4836	3568	1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f.exe	84
PID 3568 wrote to memory of 4836	3568	1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f.exe	84
PID 4836 wrote to memory of 2424	4836	niba9480.exe	86
PID 4836 wrote to memory of 2424	4836	niba9480.exe	86
PID 4836 wrote to memory of 2424	4836	niba9480.exe	86
PID 2424 wrote to memory of 1800	2424	niba3098.exe	87
PID 2424 wrote to memory of 1800	2424	niba3098.exe	87
PID 2424 wrote to memory of 1636	2424	niba3098.exe	94
PID 2424 wrote to memory of 1636	2424	niba3098.exe	94
PID 2424 wrote to memory of 1636	2424	niba3098.exe	94
PID 4836 wrote to memory of 4888	4836	niba9480.exe	95
PID 4836 wrote to memory of 4888	4836	niba9480.exe	95
PID 4836 wrote to memory of 4888	4836	niba9480.exe	95

C:\Users\Admin\AppData\Local\Temp\1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f.exe
"C:\Users\Admin\AppData\Local\Temp\1cda71a3e37dbacc2187b00ee7cccd6901383ab1e08330cfd6791c2444959b2f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9480.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9480.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba3098.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba3098.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0324uV.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0324uV.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h68MS65.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h68MS65.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1636
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iwstf31.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iwstf31.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4888

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba9480.exe

Filesize
708KB

MD5
fff96a6ff2a8cecc4635ff1351e7c2d4

SHA1
4f89a5a84e4fc8cd5a8087420b645516df6df37e

SHA256
ab84165a0cd2874642fc1940fe0734a6cd7331e8d94a8d6ecf7611c6335f5c90

SHA512
556b72a9d0c29f007404e80e992dae5cd1bb55921b0c5bb072cc34a7e8a06474ee2db1ac23a73b9fb2c404d07b4edf351bd935925935b034ba7aeb6ea98333f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iwstf31.exe

Filesize
391KB

MD5
993386ce2cb889f7c4281a9b242dca5e

SHA1
cd61db5ef0f858f1f02b5e5780310fc6927754b5

SHA256
a5df2311f6aa33993928bc9bfb293f4ea2e516c3ab09833800f5b49b6424104e

SHA512
c975c69ccccb7c23b4e220998cef2b8236506d8cc9b284972487127feb69226f361f9ec080eedaf35c219c92dc6c99748d3a547564d8b7b54da7d65ff74ecddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba3098.exe

Filesize
358KB

MD5
8c11a887fc05de4e4edfd3a16aa7d976

SHA1
9001cb43379f904d1c5ee012c71b742cdfecc69f

SHA256
728687b144fb0e29588fbb77abfd9c2546857f0cef254a84125af97a0cfa9e4b

SHA512
d8bccb2379fcbd3da1ac6a6695dcd0541b1ece7ae00abd719fcecb2f368e5d9c71ef51ff2f8af87117269c9505d99840ee7afe8a843c6956b28409c9d9da5c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0324uV.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h68MS65.exe

Filesize
371KB

MD5
3903ce0422c7b533a4f3db566e453112

SHA1
e1d7e4e3c5d33806b33c348617a53db8a24fa7ff

SHA256
0c30727af2f1b1996118e53b1ce09ad3de1ec3f87704a5a5e2af300c9584d667

SHA512
24057448f67f5cd9fcc6f428c5d1fb4460fb86c1b0a2c2b1791d6d4f97134f4eeba7206328c88de5a0df745aff83cc940e02a06460973e9cd35ee75b68bc6277

Download Submit
memory/1636-60-0x0000000000400000-0x0000000002B0C000-memory.dmp

Filesize
39.0MB

Download
memory/1636-50-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-29-0x00000000048C0000-0x00000000048DA000-memory.dmp

Filesize
104KB

Download
memory/1636-30-0x0000000007090000-0x0000000007634000-memory.dmp

Filesize
5.6MB

Download
memory/1636-31-0x0000000007650000-0x0000000007668000-memory.dmp

Filesize
96KB

Download
memory/1636-32-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-41-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-57-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-55-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-53-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-51-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-43-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-47-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-45-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-62-0x0000000000400000-0x0000000002B0C000-memory.dmp

Filesize
39.0MB

Download
memory/1636-39-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-37-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-35-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-33-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1636-59-0x0000000007650000-0x0000000007662000-memory.dmp

Filesize
72KB

Download
memory/1800-22-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download
memory/1800-21-0x00007FFBABA53000-0x00007FFBABA55000-memory.dmp

Filesize
8KB

Download
memory/1800-23-0x00007FFBABA53000-0x00007FFBABA55000-memory.dmp

Filesize
8KB

Download
memory/4888-69-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-88-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-102-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-100-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-98-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-96-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-94-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-92-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-90-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-68-0x0000000004BB0000-0x0000000004BF4000-memory.dmp

Filesize
272KB

Download
memory/4888-86-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-84-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-82-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-78-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-76-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-74-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-72-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-80-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-70-0x0000000004BB0000-0x0000000004BEE000-memory.dmp

Filesize
248KB

Download
memory/4888-67-0x00000000048E0000-0x0000000004926000-memory.dmp

Filesize
280KB

Download
memory/4888-975-0x0000000007880000-0x0000000007E98000-memory.dmp

Filesize
6.1MB

Download
memory/4888-976-0x0000000007F20000-0x000000000802A000-memory.dmp

Filesize
1.0MB

Download
memory/4888-977-0x0000000008060000-0x0000000008072000-memory.dmp

Filesize
72KB

Download
memory/4888-978-0x0000000008080000-0x00000000080BC000-memory.dmp

Filesize
240KB

Download
memory/4888-979-0x00000000081D0000-0x000000000821C000-memory.dmp

Filesize
304KB

Download