healer | 42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd.exe
Size

1.0MB
MD5

e655f4cc352a6dbd3523496f7572f46a
SHA1

40d5508b323117cebc0754330e7014c77cf27e76
SHA256

42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd
SHA512

f41be238aedfd58d0671c6c1f34cca03111abe052439521707d3a7ea92efa2e0cca84a8f9ce5ad43ff72d91092e4edf3c5a90a7b54a64400a1427ba78cff2380
SSDEEP

24576:sy2AVQfRKDWTheB9VMWaZAFCR1wOhg7B+:b2AqfRKDSho9avPo

Score

10^/10

healer redline down discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b92-26.dat	healer
behavioral1/memory/436-28-0x0000000000FB0000-0x0000000000FBA000-memory.dmp	healer
behavioral1/memory/3804-34-0x0000000002480000-0x000000000249A000-memory.dmp	healer
behavioral1/memory/3804-36-0x0000000002520000-0x0000000002538000-memory.dmp	healer
behavioral1/memory/3804-52-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-62-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-60-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-58-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-56-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-54-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-50-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-48-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-46-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-44-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-64-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-42-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-40-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-38-0x0000000002520000-0x0000000002532000-memory.dmp	healer
behavioral1/memory/3804-37-0x0000000002520000-0x0000000002532000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor1942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bus8296.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bus8296.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor1942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bus8296.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor1942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor1942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor1942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor1942.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bus8296.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bus8296.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bus8296.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1500-72-0x0000000004A30000-0x0000000004A76000-memory.dmp	family_redline
behavioral1/memory/1500-73-0x00000000050A0000-0x00000000050E4000-memory.dmp	family_redline
behavioral1/memory/1500-83-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-97-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-107-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-105-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-103-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-101-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-95-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-93-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-89-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-87-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-85-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-99-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-91-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-81-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-79-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-77-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-75-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1500-74-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
4528	kino7723.exe
992	kino7424.exe
3948	kino9472.exe
436	bus8296.exe
3804	cor1942.exe
1500	dcq28s22.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor1942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor1942.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bus8296.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kino7723.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kino7424.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kino9472.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4540	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	3804	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kino7424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kino9472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cor1942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcq28s22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kino7723.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
436	bus8296.exe
436	bus8296.exe
3804	cor1942.exe
3804	cor1942.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	bus8296.exe
Token: SeDebugPrivilege	3804	cor1942.exe
Token: SeDebugPrivilege	1500	dcq28s22.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 4528	1716	42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd.exe	84
PID 1716 wrote to memory of 4528	1716	42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd.exe	84
PID 1716 wrote to memory of 4528	1716	42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd.exe	84
PID 4528 wrote to memory of 992	4528	kino7723.exe	86
PID 4528 wrote to memory of 992	4528	kino7723.exe	86
PID 4528 wrote to memory of 992	4528	kino7723.exe	86
PID 992 wrote to memory of 3948	992	kino7424.exe	87
PID 992 wrote to memory of 3948	992	kino7424.exe	87
PID 992 wrote to memory of 3948	992	kino7424.exe	87
PID 3948 wrote to memory of 436	3948	kino9472.exe	88
PID 3948 wrote to memory of 436	3948	kino9472.exe	88
PID 3948 wrote to memory of 3804	3948	kino9472.exe	95
PID 3948 wrote to memory of 3804	3948	kino9472.exe	95
PID 3948 wrote to memory of 3804	3948	kino9472.exe	95
PID 992 wrote to memory of 1500	992	kino7424.exe	99
PID 992 wrote to memory of 1500	992	kino7424.exe	99
PID 992 wrote to memory of 1500	992	kino7424.exe	99

C:\Users\Admin\AppData\Local\Temp\42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd.exe
"C:\Users\Admin\AppData\Local\Temp\42378106d8898c174587e89fb5b639b671187b7f30068e7fafe84533d58281dd.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7723.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7723.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7424.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7424.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino9472.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino9472.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8296.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8296.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1942.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1942.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 1080
        6⤵
        Program crash
        
        PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcq28s22.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcq28s22.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3804 -ip 3804
1⤵
PID:3640

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7723.exe

Filesize
852KB

MD5
61f823fd76de5f442204683479ca9eb5

SHA1
306e1470813b53f2e78ce83a14d0cc18b82affbf

SHA256
12587b6f163c26123fb20b49c0df7fa58e5fec7096f501cfe991339eb4941c19

SHA512
6f910a5c757cb48310ce193634939b334f8c39dfe648727c0f1ebe93af9e98ccc5dbdfb695190499e7b66423dc27f483dfdc85964cee73ec9b33050f681fe016

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7424.exe

Filesize
710KB

MD5
2ae939726a392844ef0c6bdec70aefcb

SHA1
6ed5c77420388e81d767e399b667c4769de06342

SHA256
5058d22632d67b74e78f6d4052ba52b2004239af7b26fa8c404440d3818cc493

SHA512
97467eef3cc0999c6cdcb30338d88563f525f50ff3823e348e3f6d24b414c9e64f1eaba6fbfbba8d258551412f114720df07ac19a1c2cfd91dbbb194aaf5dac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcq28s22.exe

Filesize
497KB

MD5
f5d14e4c09f5fe1ffeeb21e4893c8e37

SHA1
09d4e9c27e246a7df7dca460c4097e19bcd3d2f3

SHA256
cebc5ef01fa6ff49dd6adbf12761ff13b68fe1e05d789f3d8e8bbc6f7d8525f4

SHA512
62743759a00d891e5389cf843b27d64282058385a6a7ef9eee773b30eead98187dbbf82cae6502d23146a256acfec3848349297f862f8d6c0f855a82214dfed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino9472.exe

Filesize
352KB

MD5
770e1d24475bcee99b1d0a83ab46c339

SHA1
925be52fb718bc8372eb68acbb82d047d064b882

SHA256
b01d92385fc6be026e489140edd32557d606874f47dd015a63fd7409750fbb2c

SHA512
c534d0f2f3283f4b910b36e9ca590ae32a607dd9aca5dd1b9dd1d1d39dd298c01ce4020f76579b3f9dbf45476865c1303b57103dc18b0ccf5dcde63244c22e09

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8296.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1942.exe

Filesize
439KB

MD5
3e7853ea6ed514799fd8e363fac4ec3b

SHA1
bdc65414a7dce048f8b7b8f4033ee0cd5010b3c5

SHA256
d2cf9a88b4141bc80561debb63f3abdd28da875d08ec75b25e5d1572c59497d4

SHA512
5d6a4a7c9571c720e3cccf76ca06c2d84ebb8cee186682dc283bf1a0703c209047c412f68c165764416c8f97672038fc807eb26be4addab91d2f615801831456

Download Submit
memory/436-28-0x0000000000FB0000-0x0000000000FBA000-memory.dmp

Filesize
40KB

Download
memory/1500-85-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-91-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-984-0x0000000005A80000-0x0000000005ACC000-memory.dmp

Filesize
304KB

Download
memory/1500-983-0x0000000005930000-0x000000000596C000-memory.dmp

Filesize
240KB

Download
memory/1500-982-0x0000000005910000-0x0000000005922000-memory.dmp

Filesize
72KB

Download
memory/1500-981-0x00000000057D0000-0x00000000058DA000-memory.dmp

Filesize
1.0MB

Download
memory/1500-980-0x0000000005130000-0x0000000005748000-memory.dmp

Filesize
6.1MB

Download
memory/1500-74-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-75-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-77-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-79-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-81-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-99-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-87-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-89-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-93-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-95-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-101-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-103-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-105-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-72-0x0000000004A30000-0x0000000004A76000-memory.dmp

Filesize
280KB

Download
memory/1500-73-0x00000000050A0000-0x00000000050E4000-memory.dmp

Filesize
272KB

Download
memory/1500-83-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-97-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1500-107-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/3804-44-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-60-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-65-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/3804-37-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-38-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-40-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-42-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-35-0x0000000004CC0000-0x0000000005264000-memory.dmp

Filesize
5.6MB

Download
memory/3804-52-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-67-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/3804-34-0x0000000002480000-0x000000000249A000-memory.dmp

Filesize
104KB

Download
memory/3804-46-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-48-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-50-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-54-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-56-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-58-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-36-0x0000000002520000-0x0000000002538000-memory.dmp

Filesize
96KB

Download
memory/3804-62-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/3804-64-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download