healer | a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exe
Size

1007KB
MD5

dee7f596620d1e3f98260d1f9312849d
SHA1

f32d39b526c803f1a083bb2c5645945c8288e3b2
SHA256

a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b
SHA512

d9698c96c5a3eb4087f6c4290a6c2f9e8f646749399788b671efb7e18d4fabb816d0414ac5f7a6c9854a953c3d96f5742a44f15ee85c1d96a7ec6db2ef5bdc29
SSDEEP

12288:tMrTy90vibHjlnLEXY9JyjLbZ9GQQnkwVtDPCRMr7pDwFyVnAidghqwVtwCU0rp:myNZL2Y9JUPaPxtVxzVnAhAwVtgK9o

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu281174.exe	healer
behavioral1/memory/4208-28-0x0000000000970000-0x000000000097A000-memory.dmp	healer
behavioral1/memory/5064-34-0x00000000025A0000-0x00000000025BA000-memory.dmp	healer
behavioral1/memory/5064-36-0x00000000026A0000-0x00000000026B8000-memory.dmp	healer
behavioral1/memory/5064-62-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-60-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-58-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-56-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-54-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-52-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-50-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-48-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-46-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-64-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-44-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-42-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-40-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-38-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/5064-37-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

bu281174.execor2403.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu281174.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor2403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor2403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor2403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu281174.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu281174.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu281174.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu281174.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor2403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor2403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor2403.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bu281174.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2000-72-0x0000000002930000-0x0000000002976000-memory.dmp	family_redline
behavioral1/memory/2000-73-0x0000000002A20000-0x0000000002A64000-memory.dmp	family_redline
behavioral1/memory/2000-85-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-75-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-74-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-91-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-107-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-105-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-103-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-99-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-97-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-95-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-94-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-89-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-88-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-83-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-81-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-79-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-77-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline
behavioral1/memory/2000-101-0x0000000002A20000-0x0000000002A5F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 6 IoCs

Processes:

kina7804.exekina6638.exekina6881.exebu281174.execor2403.exedDf82s84.exe

pid process

5024 kina7804.exe
1836 kina6638.exe
1728 kina6881.exe
4208 bu281174.exe
5064 cor2403.exe
2000 dDf82s84.exe

pid	process
5024	kina7804.exe
1836	kina6638.exe
1728	kina6881.exe
4208	bu281174.exe
5064	cor2403.exe
2000	dDf82s84.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

bu281174.execor2403.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu281174.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor2403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor2403.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exekina7804.exekina6638.exekina6881.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina7804.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina6638.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina6881.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3272 5064 WerFault.exe cor2403.exe

pid	pid_target	process	target process
3272	5064	WerFault.exe	cor2403.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cor2403.exedDf82s84.exea149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exekina7804.exekina6638.exekina6881.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cor2403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dDf82s84.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kina7804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kina6638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kina6881.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

bu281174.execor2403.exe

pid process

4208 bu281174.exe
4208 bu281174.exe
5064 cor2403.exe
5064 cor2403.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bu281174.execor2403.exedDf82s84.exe

description pid process

Token: SeDebugPrivilege 4208 bu281174.exe
Token: SeDebugPrivilege 5064 cor2403.exe
Token: SeDebugPrivilege 2000 dDf82s84.exe

pid	process
4208	bu281174.exe
4208	bu281174.exe
5064	cor2403.exe
5064	cor2403.exe

description	pid	process
Token: SeDebugPrivilege	4208	bu281174.exe
Token: SeDebugPrivilege	5064	cor2403.exe
Token: SeDebugPrivilege	2000	dDf82s84.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exekina7804.exekina6638.exekina6881.exe

description	pid	process	target process
PID 392 wrote to memory of 5024	392	a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exe	kina7804.exe
PID 392 wrote to memory of 5024	392	a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exe	kina7804.exe
PID 392 wrote to memory of 5024	392	a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exe	kina7804.exe
PID 5024 wrote to memory of 1836	5024	kina7804.exe	kina6638.exe
PID 5024 wrote to memory of 1836	5024	kina7804.exe	kina6638.exe
PID 5024 wrote to memory of 1836	5024	kina7804.exe	kina6638.exe
PID 1836 wrote to memory of 1728	1836	kina6638.exe	kina6881.exe
PID 1836 wrote to memory of 1728	1836	kina6638.exe	kina6881.exe
PID 1836 wrote to memory of 1728	1836	kina6638.exe	kina6881.exe
PID 1728 wrote to memory of 4208	1728	kina6881.exe	bu281174.exe
PID 1728 wrote to memory of 4208	1728	kina6881.exe	bu281174.exe
PID 1728 wrote to memory of 5064	1728	kina6881.exe	cor2403.exe
PID 1728 wrote to memory of 5064	1728	kina6881.exe	cor2403.exe
PID 1728 wrote to memory of 5064	1728	kina6881.exe	cor2403.exe
PID 1836 wrote to memory of 2000	1836	kina6638.exe	dDf82s84.exe
PID 1836 wrote to memory of 2000	1836	kina6638.exe	dDf82s84.exe
PID 1836 wrote to memory of 2000	1836	kina6638.exe	dDf82s84.exe

C:\Users\Admin\AppData\Local\Temp\a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exe
"C:\Users\Admin\AppData\Local\Temp\a149211f544b85c5985a81897218fba74100b8436bcb5aec489aeb4e108eb30b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7804.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7804.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina6638.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina6638.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6881.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6881.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu281174.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu281174.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor2403.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor2403.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1080
6⤵
- Program crash
PID:3272

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dDf82s84.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dDf82s84.exe
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5064 -ip 5064
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7804.exe

Filesize
823KB

MD5
dea9fa7b7df8c224c10261d7a01b75fd

SHA1
d1e48c16aa2a73ca3f0dba74521761467835d8d7

SHA256
ce4676945880630bd852a5852e2d1d278fb96cfdf2d823adb1ca69760aed3c7a

SHA512
30391d1b9a429d5e7d708ccb399081cde14f9c50ab7fa38aabd4f2a2ba7d1edfab656813bd908e517543def0ba68bb8f53d424a03cf0b7b16153b1ed62025d40

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina6638.exe

Filesize
681KB

MD5
b38501e0e214d3ba344b64f8c5d99c18

SHA1
67448da478fe8b1d4acfab6c62bd82ceacf5ac72

SHA256
376cf04d4a157aa7dd02d1ef9daffc4adf11faefc756dae6bc540d92eaaa8206

SHA512
366571600ad17b079214c7430c46aace24775d47024ee3838983abe63c8a38a7f21c44754229693a5942bb7be7eb01344bc6108c2de1125d2d36b30a7bcb2327

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dDf82s84.exe

Filesize
352KB

MD5
e724634f9b9606804c5db019a5cd197f

SHA1
c041b809a2dd561d6cc28305860353a57d76860e

SHA256
6307b365a5e770073276e978ad8011cc09efa9878923872b7075b0be73d60d96

SHA512
d52470baa3360c79839d72f72ece6c50d78f63a90ea054c373d52cf8130d26902c8e6352bae2d5a4d1a6d2f3eb04623f12fc30e7daa5344fa0847f72f16bb34e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6881.exe

Filesize
338KB

MD5
355928cd14cc8ebcd7ff3a98de815f50

SHA1
9cf3972dd26bfc27ada4cc88bd19f6221612848d

SHA256
30a359b9143df7995b003d3a20895f9020ce578818d2f2dc531fad85f5708bd7

SHA512
5b4fb797a6d56ad650fe81e638140f8b67805b3b7a617fe23ac61b124636c1ec9baa7d7064a9ca6b3dd814c2cbe1426fa12885bee6162f8e3d5bd4d7050661a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu281174.exe

Filesize
13KB

MD5
2bc5c34b15f1b837e4feb95e0003222a

SHA1
251383cca1e8393ac42cc488da812c22b22212a2

SHA256
6fc96ef5a95028e46a0744481babb8bcb516845c8d99eb9dfa154d43b729aa22

SHA512
be9c010f229eb20f9b2135ad5375c7b4ad14b41b0a25c1f1338e9760e7d42fd2c2d556dd5db183622ff0544e4b64054e48c07f22c2857ecfa1f8070fa9fd35a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor2403.exe

Filesize
294KB

MD5
0e405c89ff4f2e25777afc4b57e4e9db

SHA1
7994f9ec95deab1ca876f643f4aa5612822474eb

SHA256
27a52b8fc446566697e3c3d271917320c0bf246d21efbc80f63ef02c3450ad31

SHA512
4892d79201d1af3e61011f3a2056898ebc6f2d455035ae3b67fbd62c0c72d575bae4396b2b9daf2f0abae96f66332a988190094f56c9c378f897e631d6833826

Download Submit
memory/2000-94-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-89-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-984-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download
memory/2000-983-0x0000000005060000-0x000000000509C000-memory.dmp

Filesize
240KB

Download
memory/2000-982-0x0000000005040000-0x0000000005052000-memory.dmp

Filesize
72KB

Download
memory/2000-981-0x0000000004F10000-0x000000000501A000-memory.dmp

Filesize
1.0MB

Download
memory/2000-980-0x0000000005660000-0x0000000005C78000-memory.dmp

Filesize
6.1MB

Download
memory/2000-101-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-77-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-79-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-81-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-83-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-88-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-95-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-97-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-99-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-103-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-105-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-107-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-91-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-74-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-72-0x0000000002930000-0x0000000002976000-memory.dmp

Filesize
280KB

Download
memory/2000-73-0x0000000002A20000-0x0000000002A64000-memory.dmp

Filesize
272KB

Download
memory/2000-85-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/2000-75-0x0000000002A20000-0x0000000002A5F000-memory.dmp

Filesize
252KB

Download
memory/4208-28-0x0000000000970000-0x000000000097A000-memory.dmp

Filesize
40KB

Download
memory/5064-64-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-60-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-37-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-38-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-40-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-42-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-44-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-46-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-36-0x00000000026A0000-0x00000000026B8000-memory.dmp

Filesize
96KB

Download
memory/5064-65-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/5064-67-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/5064-48-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-50-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-52-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-54-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-56-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-58-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-34-0x00000000025A0000-0x00000000025BA000-memory.dmp

Filesize
104KB

Download
memory/5064-62-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/5064-35-0x0000000004FD0000-0x0000000005574000-memory.dmp

Filesize
5.6MB

Download