healer | 04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c

Analysis

max time kernel
62s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe
Size

437KB
MD5

6d68c6ee3cfb0db466a6e1cb75c82159
SHA1

76582075bc63a764b26f3b08879916edc3e0cc1a
SHA256

04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c
SHA512

8964c14f2897afc19a9a0652b1a3dfeea895eefce98ab1ddd25b7087ccc594b0c51f0d9be29d05b1a2a9cf2a57438a99011eccfd66f1e6cb5cfb8ab7a660e92a
SSDEEP

6144:Rsp0yN90QEyrt8fS7LT1iXm3PgsB308Cz55r/MNc1WK1HC5B2c7cZ40keje/N+M:ry90EtLJPTE55LMSWK1i17cq0hQR

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 34 IoCs

resource	yara_rule
behavioral1/memory/4232-7-0x0000000002290000-0x00000000022AA000-memory.dmp	healer
behavioral1/memory/4232-12-0x0000000004990000-0x00000000049A8000-memory.dmp	healer
behavioral1/memory/4232-38-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-40-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-37-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-34-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-32-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-30-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-28-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-26-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-24-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-22-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-20-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-18-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-16-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-14-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/4232-13-0x0000000004990000-0x00000000049A3000-memory.dmp	healer
behavioral1/memory/3928-50-0x0000000002360000-0x000000000237A000-memory.dmp	healer
behavioral1/memory/3928-52-0x00000000024B0000-0x00000000024C8000-memory.dmp	healer
behavioral1/memory/3928-81-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-79-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-77-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-75-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-73-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-71-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-69-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-67-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-65-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-63-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-61-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-59-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-57-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-55-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral1/memory/3928-54-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	283533626.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	283533626.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	283533626.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	283533626.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	161491743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	161491743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	161491743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	283533626.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	161491743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	161491743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	161491743.exe

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 34 IoCs

resource	yara_rule
behavioral1/memory/4232-7-0x0000000002290000-0x00000000022AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-12-0x0000000004990000-0x00000000049A8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-38-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-40-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-37-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-34-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-32-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-30-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-28-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-26-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-24-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-22-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-20-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-18-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-16-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-14-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4232-13-0x0000000004990000-0x00000000049A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-50-0x0000000002360000-0x000000000237A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-52-0x00000000024B0000-0x00000000024C8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-81-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-79-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-77-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-75-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-73-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-71-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-69-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-67-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-65-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-63-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-61-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-59-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-57-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-55-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3928-54-0x00000000024B0000-0x00000000024C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 2 IoCs

pid	Process
4232	161491743.exe
3928	283533626.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	161491743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	161491743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	283533626.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1236	3928	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4232	161491743.exe
4232	161491743.exe
3928	283533626.exe
3928	283533626.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	161491743.exe
Token: SeDebugPrivilege	3928	283533626.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 4232	3356	04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe	84
PID 3356 wrote to memory of 4232	3356	04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe	84
PID 3356 wrote to memory of 4232	3356	04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe	84
PID 3356 wrote to memory of 3928	3356	04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe	89
PID 3356 wrote to memory of 3928	3356	04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe	89
PID 3356 wrote to memory of 3928	3356	04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe	89

C:\Users\Admin\AppData\Local\Temp\04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe
"C:\Users\Admin\AppData\Local\Temp\04ccc94ffe962e255e62c1a95914c62569b16af49feea119bd9d7a36e0feb37c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\161491743.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\161491743.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\283533626.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\283533626.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 1080
    3⤵
    - Program crash
    PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3928 -ip 3928
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\161491743.exe

Filesize
175KB

MD5
ea5962c6896c58b0c43e396f1c7a2960

SHA1
c499a98d0db2cd886559364727a4f8aa0355d7bb

SHA256
72ba5705fc6129976f5b7940e302b1fe45d28d40290f96cc4876958ad369f4ca

SHA512
8c635383330d9ca3ff4195164fed13fcbfde5e0f5392e34378d0118658d4042d4f43731f21825242f51b73a36aeda031845b2ebbae78868912c45438685f8558

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\283533626.exe

Filesize
332KB

MD5
1e9dc1b0c2d04b90843dc698ab159f91

SHA1
da9a5344cf089916e15dbad341b9d450af9ad0be

SHA256
f3bf0d39dd835a1d31d94200d74922979ccb5ae6c97a50a73133de98655c4e15

SHA512
0b15f25cbdae011ef81ad10af1a2c4157f2a643b1f4b8b7ab36d599ccce8abafc8276655616700316bb83d7cfd21dcb6671d702454f074249882aa2c4430de54

Download Submit
memory/3928-71-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-67-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-85-0x0000000074010000-0x00000000747C0000-memory.dmp

Filesize
7.7MB

Download
memory/3928-53-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/3928-54-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-55-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-57-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-59-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-61-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-63-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-65-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-50-0x0000000002360000-0x000000000237A000-memory.dmp

Filesize
104KB

Download
memory/3928-69-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-73-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-75-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-77-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-48-0x00000000005E0000-0x000000000060D000-memory.dmp

Filesize
180KB

Download
memory/3928-79-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-81-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/3928-52-0x00000000024B0000-0x00000000024C8000-memory.dmp

Filesize
96KB

Download
memory/3928-47-0x0000000000760000-0x0000000000860000-memory.dmp

Filesize
1024KB

Download
memory/3928-49-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3928-51-0x0000000074010000-0x00000000747C0000-memory.dmp

Filesize
7.7MB

Download
memory/3928-84-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4232-26-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-18-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-8-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/4232-42-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/4232-13-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-14-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-16-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-20-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-22-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-24-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-7-0x0000000002290000-0x00000000022AA000-memory.dmp

Filesize
104KB

Download
memory/4232-9-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/4232-28-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-30-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-32-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-34-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-37-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-40-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-38-0x0000000004990000-0x00000000049A3000-memory.dmp

Filesize
76KB

Download
memory/4232-12-0x0000000004990000-0x00000000049A8000-memory.dmp

Filesize
96KB

Download
memory/4232-11-0x0000000004A90000-0x0000000005034000-memory.dmp

Filesize
5.6MB

Download
memory/4232-10-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download