healer | 5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2b

Analysis

max time kernel
113s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2bN.exe
Size

989KB
MD5

b1fc96a847e1d1e7537609c37fbba240
SHA1

d55da593a5ff24ed4710b47f906233f75bab2dee
SHA256

5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2b
SHA512

49ed7a5206ac62727c09fc9b58aad82e7438143f0ba7c81d6fe7b3b271cf9155e9c2f34f409ccea0be8f08d6d608ab17cd339a6a541d4aed4e76ed05971403bd
SSDEEP

24576:2yKSRwuwJTL71eEN5nTnG94oWK+J9/Vbr/:FULTL71lnTGyoql

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cb2-19.dat	healer
behavioral1/memory/3564-22-0x0000000000470000-0x000000000047A000-memory.dmp	healer
behavioral1/memory/3644-29-0x00000000025D0000-0x00000000025EA000-memory.dmp	healer
behavioral1/memory/3644-31-0x0000000002820000-0x0000000002838000-memory.dmp	healer
behavioral1/memory/3644-41-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-59-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-57-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-55-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-53-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-51-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-50-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-47-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-45-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-43-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-39-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-37-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-35-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-33-0x0000000002820000-0x0000000002832000-memory.dmp	healer
behavioral1/memory/3644-32-0x0000000002820000-0x0000000002832000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu928187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	az484419.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	bu928187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu928187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu928187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu928187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu928187.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	az484419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	az484419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	az484419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	az484419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	az484419.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/3716-67-0x00000000026E0000-0x000000000271C000-memory.dmp	family_redline
behavioral1/memory/3716-68-0x00000000029B0000-0x00000000029EA000-memory.dmp	family_redline
behavioral1/memory/3716-74-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-82-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-102-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-100-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-96-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-94-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-92-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-90-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-88-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-84-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-80-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-78-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-76-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-98-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-86-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-72-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-70-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline
behavioral1/memory/3716-69-0x00000000029B0000-0x00000000029E5000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
1756	ki818374.exe
3188	ki341028.exe
3564	az484419.exe
3644	bu928187.exe
3716	co200969.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	az484419.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	bu928187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu928187.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ki818374.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ki341028.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	3644	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ki818374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ki341028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bu928187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	co200969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2bN.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3564	az484419.exe
3564	az484419.exe
3644	bu928187.exe
3644	bu928187.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	az484419.exe
Token: SeDebugPrivilege	3644	bu928187.exe
Token: SeDebugPrivilege	3716	co200969.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 1756	3940	5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2bN.exe	83
PID 3940 wrote to memory of 1756	3940	5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2bN.exe	83
PID 3940 wrote to memory of 1756	3940	5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2bN.exe	83
PID 1756 wrote to memory of 3188	1756	ki818374.exe	85
PID 1756 wrote to memory of 3188	1756	ki818374.exe	85
PID 1756 wrote to memory of 3188	1756	ki818374.exe	85
PID 3188 wrote to memory of 3564	3188	ki341028.exe	86
PID 3188 wrote to memory of 3564	3188	ki341028.exe	86
PID 3188 wrote to memory of 3644	3188	ki341028.exe	97
PID 3188 wrote to memory of 3644	3188	ki341028.exe	97
PID 3188 wrote to memory of 3644	3188	ki341028.exe	97
PID 1756 wrote to memory of 3716	1756	ki818374.exe	102
PID 1756 wrote to memory of 3716	1756	ki818374.exe	102
PID 1756 wrote to memory of 3716	1756	ki818374.exe	102

C:\Users\Admin\AppData\Local\Temp\5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2bN.exe
"C:\Users\Admin\AppData\Local\Temp\5fb543090ef9f35755eb46f0a7ef6086cc4d6f9a6664462255272d8c0c1e5b2bN.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki818374.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki818374.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki341028.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki341028.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az484419.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az484419.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu928187.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu928187.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3644
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 1084
        5⤵
        Program crash
        
        PID:2628
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\co200969.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\co200969.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3644 -ip 3644
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki818374.exe

Filesize
806KB

MD5
440c9bdf236a0a37785acecd86717973

SHA1
049b0435b8e7b7610112c7765d6412cc275a9a17

SHA256
672224f875a17a9d76e9023c9a8b63faf27f18d649cff0075115d6c145c8cc4f

SHA512
cf061c1a0fa7984bc12ff29bdac96ffec784480ef8696a2f2acc88ad9ff509b2172f5b428a5d73ff87fa085b83d9f4463055f1b20fa77c96a026252df82c12be

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\co200969.exe

Filesize
486KB

MD5
daa8335e0a1a43a88027f1fd217351a3

SHA1
d5163b4a6a230786402894fd3c1a5bab32c56fd6

SHA256
37e7fe41056982564274bd548a773ed29f2e48881764085d18b7f2bed32c725b

SHA512
688488953a44d5d28c50457818fbac7fb5c45129aeb5fd233d07c947b4e1e0a240ec182b9b57069513c9539ff1a497e6ad054c70b564788fe21eddcbec012b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki341028.exe

Filesize
388KB

MD5
9aaeafc8e44ae06f4c209683070a81b0

SHA1
4a343c159aee8d8e008d2f362fb112f2cfa0dd6c

SHA256
e59ec01a89f115e6d56641362516a6cb06bf7ae8ebf1a70982eec481a2e2b9fe

SHA512
f981906d83e9c0f920fabbd0d8c0291029840e74527f2ee8d879a8955b7227746bc49884b7058ca25727c7fa708d58b8ce74e9a13347f2aea1364f5a2e00288e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az484419.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu928187.exe

Filesize
403KB

MD5
078f36d020e9f78ec99b21d541f5b829

SHA1
30e6e27346488ae2518269844d4c402773af2fe0

SHA256
572330468b890c4ceb908fa76f502ba5aded8d20b35c8984c174682baee49833

SHA512
3aa36c701fc11d64d51b8a091ddd02fde538962d3282c520d3cb94105b1fa83c6c07abe5233800368f9ae4c1264b642c246d750b9d9bbac9d5b532280957fbae

Download Submit
memory/3564-21-0x00007FF914C23000-0x00007FF914C25000-memory.dmp

Filesize
8KB

Download
memory/3564-22-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/3564-23-0x00007FF914C23000-0x00007FF914C25000-memory.dmp

Filesize
8KB

Download
memory/3644-60-0x0000000000400000-0x0000000000809000-memory.dmp

Filesize
4.0MB

Download
memory/3644-31-0x0000000002820000-0x0000000002838000-memory.dmp

Filesize
96KB

Download
memory/3644-41-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-59-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-57-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-55-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-53-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-51-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-50-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-47-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-45-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-43-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-39-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-37-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-35-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-33-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-32-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/3644-30-0x0000000004ED0000-0x0000000005474000-memory.dmp

Filesize
5.6MB

Download
memory/3644-62-0x0000000000400000-0x0000000000809000-memory.dmp

Filesize
4.0MB

Download
memory/3644-29-0x00000000025D0000-0x00000000025EA000-memory.dmp

Filesize
104KB

Download
memory/3716-82-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-78-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-74-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-67-0x00000000026E0000-0x000000000271C000-memory.dmp

Filesize
240KB

Download
memory/3716-102-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-100-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-96-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-94-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-92-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-90-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-88-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-84-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-80-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-68-0x00000000029B0000-0x00000000029EA000-memory.dmp

Filesize
232KB

Download
memory/3716-76-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-98-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-86-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-72-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-70-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-69-0x00000000029B0000-0x00000000029E5000-memory.dmp

Filesize
212KB

Download
memory/3716-861-0x0000000007970000-0x0000000007F88000-memory.dmp

Filesize
6.1MB

Download
memory/3716-862-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/3716-863-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/3716-864-0x00000000080F0000-0x000000000812C000-memory.dmp

Filesize
240KB

Download
memory/3716-865-0x0000000002780000-0x00000000027CC000-memory.dmp

Filesize
304KB

Download