healer | 03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2.exe
Size

1.2MB
MD5

0dbf2d1e6ae8b513339b69132951ef97
SHA1

e813d5e9dbb51d9c6fc57ba2d00773d6f2b56352
SHA256

03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2
SHA512

be9ef12e4877ff861f37360a3883a0a629a689ee25a9b429af6cf441e4761e51f05a752a7e28533f234eced8956d63cca91c8f20f5c8599cadd41ab27d5f7163
SSDEEP

24576:Wy3oRq9QjwLW2Ijk0fWJx/A2tg0O4DwPI49BV7R9C1A6qpFxA4om:l3TQWs5WJPtJDkV7RoA6qpFx

Score

10^/10

healer redline rumfa discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rumfa

193.233.20.24:4123

Attributes

auth_value
749d02a6b4ef1fa2ad908e44ec2296dc

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b81-33.dat	healer
behavioral1/memory/2508-35-0x0000000000520000-0x000000000052A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	buIl19xu91.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	buIl19xu91.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	buIl19xu91.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	buIl19xu91.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	buIl19xu91.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	buIl19xu91.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/868-41-0x0000000002670000-0x00000000026B6000-memory.dmp	family_redline
behavioral1/memory/868-43-0x0000000005150000-0x0000000005194000-memory.dmp	family_redline
behavioral1/memory/868-47-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-54-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-107-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-105-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-103-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-101-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-99-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-97-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-93-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-91-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-89-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-87-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-85-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-83-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-81-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-79-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-77-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-73-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-71-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-70-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-65-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-63-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-61-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-60-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-57-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-55-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-51-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-49-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-95-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-75-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-67-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-45-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline
behavioral1/memory/868-44-0x0000000005150000-0x000000000518E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
3860	plIh45Yr02.exe
2908	plIR88Ev78.exe
5100	plGx35Hx23.exe
3312	plVg48uh83.exe
2508	buIl19xu91.exe
868	caGm08ix16.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	buIl19xu91.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	plGx35Hx23.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	plVg48uh83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	plIh45Yr02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	plIR88Ev78.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
412	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plVg48uh83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caGm08ix16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plIh45Yr02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plIR88Ev78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plGx35Hx23.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2508	buIl19xu91.exe
2508	buIl19xu91.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	buIl19xu91.exe
Token: SeDebugPrivilege	868	caGm08ix16.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3860	4808	03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2.exe	83
PID 4808 wrote to memory of 3860	4808	03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2.exe	83
PID 4808 wrote to memory of 3860	4808	03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2.exe	83
PID 3860 wrote to memory of 2908	3860	plIh45Yr02.exe	84
PID 3860 wrote to memory of 2908	3860	plIh45Yr02.exe	84
PID 3860 wrote to memory of 2908	3860	plIh45Yr02.exe	84
PID 2908 wrote to memory of 5100	2908	plIR88Ev78.exe	86
PID 2908 wrote to memory of 5100	2908	plIR88Ev78.exe	86
PID 2908 wrote to memory of 5100	2908	plIR88Ev78.exe	86
PID 5100 wrote to memory of 3312	5100	plGx35Hx23.exe	87
PID 5100 wrote to memory of 3312	5100	plGx35Hx23.exe	87
PID 5100 wrote to memory of 3312	5100	plGx35Hx23.exe	87
PID 3312 wrote to memory of 2508	3312	plVg48uh83.exe	89
PID 3312 wrote to memory of 2508	3312	plVg48uh83.exe	89
PID 3312 wrote to memory of 868	3312	plVg48uh83.exe	97
PID 3312 wrote to memory of 868	3312	plVg48uh83.exe	97
PID 3312 wrote to memory of 868	3312	plVg48uh83.exe	97

C:\Users\Admin\AppData\Local\Temp\03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2.exe
"C:\Users\Admin\AppData\Local\Temp\03831d20fdf191cad660839546787fd3b26c259c75e5b84485d73f7302b267c2.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plIh45Yr02.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plIh45Yr02.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plIR88Ev78.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plIR88Ev78.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plGx35Hx23.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plGx35Hx23.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plVg48uh83.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plVg48uh83.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buIl19xu91.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buIl19xu91.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caGm08ix16.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caGm08ix16.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:868

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plIh45Yr02.exe

Filesize
1.0MB

MD5
d9319b62584e829719325002b07bc267

SHA1
3854fbe56d443ee327822f46538792fd66c6ed8b

SHA256
9093b9166b1785712903eae8ed2215c8ebaea8be4b4380f6d4d54b8f8c094612

SHA512
ea8bc541fcdb3c25bf295ec3a5a2e4c903568725602d509034ff7c6a579fa0e10b26fad75881b7f9a5160df41dc5fac5cb4bc7bdd73f350ddad6a94afd0e24f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plIR88Ev78.exe

Filesize
940KB

MD5
dae5c62ee872888cb96ba2c32af02afb

SHA1
0266c962c4351620ff9ec429b757fd2cda2fdbba

SHA256
58e95051fe098e5dec8eeed50607d0a081358458edf511444d82a8249402ddc5

SHA512
6d6e377707554486fafaeb68bb2ced3d8fcf48bbd9cde015dcfb45f5589598706ade158ff5e037aa7d9e78c4ef116e0eb6fa23c725a049964185e1c71409d6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plGx35Hx23.exe

Filesize
669KB

MD5
3ad4bb93177a31f0bfb6506526ebc215

SHA1
2fa792a801b2fa21bef36ca56e7b29c293594943

SHA256
c65da44cb6ebe704f5ee4f83851ed6abfa407987b53977f551d7471d094a398d

SHA512
8838411c510732192f04ba55877c23eb81b38bc37dda39ba98f394a8bd1ce588eedf399a4b8efaefdc21628e288d5f6593111bd8e02370ffe6d5b02de985c655

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plVg48uh83.exe

Filesize
393KB

MD5
91c736913bf617a3c5e967b8b6f3efec

SHA1
e77bd4bfca4c5cd546f74f4352252609892192fa

SHA256
41811989aed5d62c7e3f3168402257141db73908cc8363deb408e1e04efb4106

SHA512
42f8092e6988fa697964196b5f60cb39f176f5e9ff13eac9c41443332931cab13eb0ecf0b0365a23476490654eb0c167e0d22687a0820cc461c3bcd7c3e1045d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buIl19xu91.exe

Filesize
12KB

MD5
a66d1556804fb326db84703efa573f2f

SHA1
b96d1ae27c70cd1e7273ec3c270ee07a5e403c71

SHA256
0a93fa8915486c33e2f874d90ca3c8d7c6b77bc587a9f23a565f2d1e0937ee11

SHA512
9d7aa8584346a34edeb9c8f5ffbcb04f818d964f705393fe2c49ee01a07939c04594a27820c1869e214ca8c77f38b922bee64edcf71a8e33abda58384b3db8d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caGm08ix16.exe

Filesize
304KB

MD5
e8a74f8947be8861da483f9a1b725bea

SHA1
c9485cc022bb2ee5eb15bc98e1aa5330b1b5c09a

SHA256
b27c4b8cc67abed8e257f5b43a656dbfafea50833d2aae5b7fe545ac82d74727

SHA512
4ac48c039d81d9b6f5dd9cd4700855bc27efec45bb167fbf0268ec56c238138865a9d9b9575b2e71f2ab204f29da0daff1e78f5ac12cb54d0383766b7c82e2e8

Download Submit
memory/868-81-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-73-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-42-0x0000000004B60000-0x0000000005104000-memory.dmp

Filesize
5.6MB

Download
memory/868-43-0x0000000005150000-0x0000000005194000-memory.dmp

Filesize
272KB

Download
memory/868-47-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-54-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-107-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-105-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-103-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-101-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-99-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-97-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-93-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-91-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-89-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-87-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-85-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-83-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-954-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Filesize
304KB

Download
memory/868-79-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-77-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-41-0x0000000002670000-0x00000000026B6000-memory.dmp

Filesize
280KB

Download
memory/868-71-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-70-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-65-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-63-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-61-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-60-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-57-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-55-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-51-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-49-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-95-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-75-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-67-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-45-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-44-0x0000000005150000-0x000000000518E000-memory.dmp

Filesize
248KB

Download
memory/868-951-0x0000000005860000-0x000000000596A000-memory.dmp

Filesize
1.0MB

Download
memory/868-950-0x00000000051C0000-0x00000000057D8000-memory.dmp

Filesize
6.1MB

Download
memory/868-952-0x00000000059A0000-0x00000000059B2000-memory.dmp

Filesize
72KB

Download
memory/868-953-0x00000000059C0000-0x00000000059FC000-memory.dmp

Filesize
240KB

Download
memory/2508-35-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download